Is it possible to trigger a playbook based on a new case being created? I’m working on building a case notification system that alerts a security analyst when a new case is created.
The intended workflow is:
- Send an initial notification when a new case is created
- After a delay, allow a triage phase so all related alerts can be grouped into the case
- Send a follow-up “case summary” notification that includes all relevant case details to help the analyst determine whether the case is a true or false positive
The issue I’m running into is that when multiple alerts hit the SOAR system at the same time, multiple playbook executions occur, which results in duplicate notifications.
