Webex - Send Messages to Room for New Detection Findings
Details
This workflow checks for new XDR detections every 5 minutes using a schedule automation rule. For any new detection, a message is sent via Webex to the configured room.
Description
This workflow checks for new XDR detections every 5 minutes using a schedule automation rule. For any new detection, a message is sent via Webex to the configured room.
More information about the XDR Query API can be found here: https://developer.cisco.com/docs/cisco-xdr/exporting-xdr-detection-findings-exporting-xdr-detection-findings/
Targets: Query APIs, Webex
Steps:
- Make sure a room name was provided (if not, end the workflow)
- Calculate and format the timestamps
- For each page of findings:
- Fetch this page of findings
- For each finding returned:
- Fetch and summarize its events
- Send a Webex message
- Check if there's a next page
- If there isn't, end the loop
- If there is, update the paging variables
Required targets
This workflow requires the following targets to be available before it can be run.
Integration targets
- Cisco XDR
- Webex
About
Contact and support information
External links
Related workflows
Community
Automates analysis of user-reported phishing emails by monitoring a mailbox, enriching email data, and generating an XDR detection with analyst guidance.
Community
This scheduled workflow executes a search query in Cisco Secure Malware Analytics for new private samples submitted and convinced as malicious.
Community
When triggered, this workflow will review the Secure Endpoint machines about installed antivirus (AV) applications in Orbital and send a Webex Alert on new non-approved AV app.
Community
When triggered, this workflow will review the Secure Endpoint machines and local admin users in Orbital and send a Webex Alert on new non-approved admin user.
Community
This workflows runs a (scheduled) "Cisco XDR Integration Module Healthcheck" and posts a message to Webex if such a healthcheck fails.
Cisco Managed
This workflow works with an incident automation rule or playbook to create a Webex room when incidents are created in Cisco XDR.
Cisco Managed
This workflow works with an incident automation rule to send Webex messages when a new incident is created in Cisco XDR.