I’m building a playbook that runs on new alerts and enriches it’s entities. To avoid unnecessary API calls, I want to only enrich entities that have not already been enriched. Some cases may contain alerts with the same entities, it would be inefficient to run each duplicate entity through enrichment each time.
The idea is to have a condition at the start of the playbook that filters on the ‘Entity.IsEnriched’ field. If this field is False, perform enrichment. Once enrichment is complete, the playbook would then set the field to True.
I can set the field value for an entity fine using the ‘Enrichment - Enrich Entity With Field’ action. My issue is that I cannot access this field from anywhere in the playbook. Other fields such as ‘Entity.IsInternal’ are exposed, but this is not.
Why is this?
