This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Privacy Policy. Click Preferences to customize your cookie settings.
Ingested phishing email data using soar webhook It created the simple event with all the json fields like json.headers How to extract fields and create entities out of it ?
Looks like you are using the native to SOAR webhook ingestion method. Note that after you ingest your first alert, you will need to setup the ontology for these types of events to extract what would be the entities which you can later enrich using playbooks. You can read more about this specific process here. This process is not retroactive, only alerts ingested after the ontology setup is completed will be parsed.
LinkedIn
Twitter
