PagerDuty - Send Events for New Detections

This workflow checks for new XDR detections every 5 minutes using a schedule automation rule. For any new detection, an event is sent to PagerDuty.

More information about the XDR Query API can be found here: https://developer.cisco.com/docs/cisco-xdr/exporting-xdr-detection-findings-exporting-xdr-detection-findings/

Targets: Query APIs, PagerDuty - Events API

Steps:

• Calculate and format the timestamps
• For each page of findings:
  • Fetch this page of findings
  • For each finding returned:
    • Fetch and summarize its events
    • Send an event to PagerDuty
  • Check if there's a next page
    • If there isn't, end the loop
    • If there is, update the paging variables