Great Thanks to Julian Gonzalez for working together on the playbooks templates!
In the previous article, Playbooks & Watchlists Part 1: Inform the subscription owner I have presented one scen...
Updated Nov 03, 2021
Version 3.0
Blog Post
4 MIN READ
Playbooks & Watchlists Part 2: Automate incident response for Deny-list/Allow-list
Excellent article, thanks!
Question: Is it possible to add a playbook task that reads a 'custom event parameter' from a sentinel alert?
eg. in the Sentinel rule, create the custom event parameter:
soartype={AdditionalExtensions})
And then perform some action based on that entity?
Or is there a better field to set in the rule than this?