+7HI everyone, I’m trying to find a documentation of the SOAR api, but I’m unable to find an API that lets me retrieve playbook results per alert.
I want to be able to retrieve the data from query enrichments that I’ve created.
Has anyone been successful at doing this?
+16Hey
Can you elaborate what you mean by fetching playbook results? In general, all of the information about action execution is stored as part of Case Wall activities.
+7Hey
Can you elaborate what you mean by fetching playbook results? In general, all of the information about action execution is stored as part of Case Wall activities.
We want to get all the action results from the playbook. for example: KQL query results.
+16
Where will be those action results used? Are you planning to use it a sync job or something else?
+7
Where will be those action results used? Are you planning to use it a sync job or something else?
We want to create an AI case investigation summary, via Google SOAR MCP.
For the investigation summary we need to use the playbook results.
+16
Wouldn’t using regular placeholders work for you, like [Action.JsonResult]?
+7
Wouldn’t using regular placeholders work for you, like [Action.JsonResult]?
Can you elaborate? I have multiple queries and enrichments in the playbook
+16
If you need a to generate an AI summary based on enrichment information, you should just use Vertex AI integration and then put the JSON Results from all actions from which you are collecting information.
JSON Results from actions are available via placeholders. Here is more information about it.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
