Forum Discussion
Automation and Metrics
Hi All I am trying (and failing) to look for a way to pull some information that will show (by example) Number of Security Alerts Number of Security Incidents And then a pivot that says...
Do you have any way to determine which rules were closed automatically? Are you adding a tag, a comment, or a closing comment? Those would probably be some of the easier ways to determine which ones were closed automatically and then it shouldn't be too hard to get what you need.
Cheers Gary - I was hoping to be able to grab the metadata - or similar that is appended to it when updated. Yes there is a closing comment but no tag - but will push that aspect also. Assumption being that will then make it possible to do some stats ....
- Sadly there is nothing that is automatically added to let you know the incident was modified by a playbook, you would need to add that yourself.