+14
+3Can you provide more details to your use case?
Do the alerts being created by both connector have completely different entities between them? If so, what would be the criteria to group both alerts together?
Do you want to merge the alerts of both cases within 1 single case? or do you want to create a new case with a single alert that has all the information from the original alerts?
+12If both connectors are enabled, you will get 2 Alerts. If they match on Alert Grouping (e.g. within x hours AND have an entity in common) they go into 1 case. In your example you didn't elaborate on how you hope they will group, automatically or are you building logic into the playbook to handle this manually?
I don't see a playbook Trigger for specific Indicator. Maybe you would run a master playbook which uses 'Attach playbook' based on logic (though remember the playbook view is based on first playbook so the majority of logic should be there)
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
