Details

This workflow is designed to be executed when an incident is resolved and ready to be closed. The workflow will export the incident summary to a supported product and then mark the incident as closed. Currently supported products include: Elastic Cloud, Splunk Cloud, and Splunk Enterprise.

Targets: Automation APIs, Conure APIs, Platform APIs, Elastic Cloud, Splunk Cloud, Splunk Enterprise

Steps:

  • Check how the workflow was started (if not playbook, end the workflow)
  • Get a list of XDR automation targets and extract the supported integrations
  • Check if there are supported integrations available (if not, end the workflow)
  • Fetch the incident summary (if this fails, end the workflow)
  • For each integration:
    • Attempt to export the incident summary to the integration
  • Set the incident's status to closed
About
Authorship
Cisco Managed