Skip to main content

Hello Community, I am looking for an action that allows me to create entities from iocs in a playbook and add them to the case that triggered the playbook. I initially am using the Create Entity Action but that is just adding them to All Entity rather than associating them with the case that triggered the playbook. The event that triggers this is an email injested and added to a case with the trigger being [Event.orig_subject] with What will I need to do to solve this? Thanks!

 

The "Create Entity" action should be adding them to the alert. Are you running the "Create Entity" Action inside the playbook or as a manual action?


Reply