Skip to main content
Solved

Add Created Entities to Case

  • November 18, 2024
  • 1 reply
  • 23 views

Low-Ant
Forum|alt.badge.img

Hello Community, I am looking for an action that allows me to create entities from iocs in a playbook and add them to the case that triggered the playbook. I initially am using the Create Entity Action but that is just adding them to All Entity rather than associating them with the case that triggered the playbook. The event that triggers this is an email injested and added to a case with the trigger being [Event.orig_subject] with What will I need to do to solve this? Thanks!

 

Best answer by ddiserens

The "Create Entity" action should be adding them to the alert. Are you running the "Create Entity" Action inside the playbook or as a manual action?

1 reply

ddiserens
Staff
Forum|alt.badge.img+6
  • Staff
  • Answer
  • November 18, 2024

The "Create Entity" action should be adding them to the alert. Are you running the "Create Entity" Action inside the playbook or as a manual action?