Adds a step that logs that an Alert has been triaged.
One can add
details about the alert and
description about the steps taken in triaging the alert.
- Click + on the parent node.
- Search for Alert Triage operator in the search field and select the operator from the Results to open the operator form.
- In the Table drop-down, enter or select a table from which to source the data.
- In the Details field, enter the alert details.
- In the Description field, enter a description of the triaged alert.
- Click Run to view the result.
- Click Save to add the operator to the playbook.
- Click Cancel to discard the operator form.
alertTriage(table: TableReference, details: String, description: String)
table: Table Name
details: Alert Details
description: Description of Triaged Alert
Same as the input table. Additionally, logs triage-info and is available in
Input = alertTriageNode
alertTriage(alertTriageNode, "IP is malicious", "block this IP")
|22.214.171.124||IP is malicious||block this IP|
|126.96.36.199||IP is malicious||block this IP|
IP column is present in parent table 'alertTriageNode'.
Updated about 1 month ago