Add a Recommended Playbook Trigger - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Administrator Guide
Product
Cortex XSIAM
Creation date
2024-05-06
Last date published
2024-09-11
Category
Administrator Guide
Retire_Doc
Retiring
Link_to_new_Doc
/r/Cortex-XSIAM/Cortex-XSIAM-Documentation
Abstract

Add playbook triggers to an alert, so if the condition is met, a suitable response is issued through a playbook.

In the Playbook Triggers page, you can create a playbook trigger, add a recommended playbook trigger, view all playbook triggers, and change the order of priority. The Core - Investigation and Response content pack includes a number of recommended playbook triggers for alerts, which you can to add to relevant alerts that are ingested.

  1. Select Incident Response → Incident Configuration → Playbook Triggers → View Recommendations.

  2. In the Playbook Trigger Recommendations table, view and select the required recommended playbook triggers to add to the trigger table.

    You can view each playbook in detail in the Playbooks page.

  3. Click Add Selected triggers.

  4. Verify the order of the playbook triggers and change the order (if required),

  5. Save the changes to the Playbook Trigger table.