XDR - Close and Export Incident
Details
This workflow is designed to be executed when an incident is resolved and ready to be closed. The workflow will export the incident summary to a supported product and then mark the incident as closed. Currently supported products include: Elastic Cloud, Splunk Cloud, and Splunk Enterprise.
Targets: Automation APIs, Conure APIs, Platform APIs, Elastic Cloud, Splunk Cloud, Splunk Enterprise
Steps:
- Check how the workflow was started (if not playbook, end the workflow)
- Get a list of XDR automation targets and extract the supported integrations
- Check if there are supported integrations available (if not, end the workflow)
- Fetch the incident summary (if this fails, end the workflow)
- For each integration:
- Attempt to export the incident summary to the integration
- Set the incident's status to closed
About
Integration
Authorship
Cisco Managed