In a playbook that was activated by an alert from a specific Product, I am trying to create an alert in a different environment. I've been trying to do that through an Execute HTTP Request Action.That action, which includes the following json in the Body Payload, is able to create an alert:
{
"name": "CRITICAL DOMAIN DETECTED FROM Px",
"environment": "MetR",
"rule_generator": "Playbook MetR Px",
"alert_identifier": "Px-[Case.Id]-[EntityIdentifier]",
"priority": 90,
"start_time": "2025-04-15T14:00:00Z",
"events": [
{
"event_name": "Event_No_Name",
"type": "Event_No_Name",
"severity": 4,
"source": "Px",
"device_product": "Teleg"
}
],
"entities": [
{
"identifier": "[Functions_Extract_IOCs_1.ScriptResult]",
"entity_type": "DOMAIN"
}
],
"custom_fields": {
"detected_from": "Px",
"source_case": "[Case.Id]",
"playbook_origin": "AlertsTelegPx",
"extracted_domains": "[Functions_Extract_IOCs_1.ScriptResult]"
}
}
However, the alarm is created with no entities. I would like to have the alert be generated with the exact same entities as the alert that activated the playbook. I thought that by adding in the json the entities with the [Functions_Extract_IOCs_1.ScriptResult], which is the result of an action where we successfully can see all the entities of the initial alarm would be enough, but it isn't. Is it possible to be done in any way?
