How can I use custom entity scopes within the Quick Actions widget?

Question

Hi there,

We are using the Quick Actions widgets for different types of enrichment actions shown below:

The first playbook that runs on the alert already executes these actions automatically with all of entities at the time of alert ingestion. The purpose of these quick actions is that the analyst can execute any enrichment actions for manually created entities.

In the playbook I created the Entity Selection action below:

Question 1 -

Is it possible to see this custom entity scope when configuring the quick action as I cannot see it?

Question 2 - Does the custom entity scope automatically update once new entities match the conditions or is at the point in time when that action is run the scope is defined?

Thank you

SoarAndy · Answer

Q1/2 - I guess not. Even if you could, that will have executed at playbook time, so any IOC added after would not be in it’s output/selection

For something like this I might experiment with a playbook “follow on enrichment” that does the custom selection + all the enrichments you show, and you attach it / run it after you add more entities. Note it has a rerun limit of 10, so I would use it tactically when needed (and not as a job to run every minute automatically)

Sign up

Login with SSO

Login to the community

Login with SSO

Scanning file for viruses.

This file cannot be downloaded