Create a playbook trigger, so when an alert with specific characteristics is created, a suitable response is issued.
In the Playbook Triggers page, you can create a playbook trigger, add a recommended playbook trigger, view all playbook triggers, and change the order of priority.
Select → → → .
Add the following information:
Trigger name
Select a playbook to run
Add a meaningful description
In the field, select the criteria you want to add.
In this example, there are a number of alerts that are being ingested called McAfee + Zscaler - Malware Downloaded And Dropped To Disk. These alerts are as a result of malware which was detected by the Agent. We created a custom playbook to run these alerts, so that if action is detected by the ePO, to either quarantine the machine, where the malware is detected, or if no action to close the investigation. We want to create a playbook trigger, so the next time an alert is ingested, the playbook runs automatically.
Created a trigger called McAfee + Zscaler - Malware Downloaded And Dropped To Disk.
Add the custom playbook.
In the Alerts section, select the name McAfee + Zscaler - Malware Downloaded And Dropped To Disk alerts.
The alert is added to the playbook trigger table. The next time an alert is ingested with the criteria, the playbook runs according to the playbook trigger.
In this incident, you can see that there were 18 alerts that automatically ran 16 playbooks.
Select one of the alerts to see that the playbook ran (Work Plan or Alert War Room).