how to
- Move Alert Across Environments within same Tenant ?
- Transfer Alert to a Different SecOps Tenant ?
Solved
import/export an ALERT
+14- Silver 2
Best answer by josemarin
1. Move alert across Environments within same tenant:
Cases can be moved to different environments. To enable this, go to SOAR Settings > Advanced > General. In the "Move Case" section, ensure "Allow users to move cases between environments" is selected.
Then, you can change the environment directly in the case screen. Important: This closes the existing case and creates a copy in the selected environment.
2. Transfer Alert to a Different SecOps Tenant:
While there's no direct way to export an alert to another tenant, you can achieve this using the API and built-in actions. First, use the "Get original alert JSON" action in the tools power-up to retrieve the alert data (the JSON before processing by the SecOps ETL service). Then, use this data to create a new case in the target tenant via the CreateCase endpoint (available in Swagger). In playbooks, you can use the HTTPV2 integration for this.
+31. Move alert across Environments within same tenant:
Cases can be moved to different environments. To enable this, go to SOAR Settings > Advanced > General. In the "Move Case" section, ensure "Allow users to move cases between environments" is selected.
Then, you can change the environment directly in the case screen. Important: This closes the existing case and creates a copy in the selected environment.
2. Transfer Alert to a Different SecOps Tenant:
While there's no direct way to export an alert to another tenant, you can achieve this using the API and built-in actions. First, use the "Get original alert JSON" action in the tools power-up to retrieve the alert data (the JSON before processing by the SecOps ETL service). Then, use this data to create a new case in the target tenant via the CreateCase endpoint (available in Swagger). In playbooks, you can use the HTTPV2 integration for this.
+14- Silver 2
1. Move alert across Environments within same tenant:
Cases can be moved to different environments. To enable this, go to SOAR Settings > Advanced > General. In the "Move Case" section, ensure "Allow users to move cases between environments" is selected.
Then, you can change the environment directly in the case screen. Important: This closes the existing case and creates a copy in the selected environment.
2. Transfer Alert to a Different SecOps Tenant:
While there's no direct way to export an alert to another tenant, you can achieve this using the API and built-in actions. First, use the "Get original alert JSON" action in the tools power-up to retrieve the alert data (the JSON before processing by the SecOps ETL service). Then, use this data to create a new case in the target tenant via the CreateCase endpoint (available in Swagger). In playbooks, you can use the HTTPV2 integration for this.
Thank you @josemarin !!
+2Is there a way to automate moving alerts to different environment via playbook
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.