Skip to main content

Understanding how to interact with cases

  • October 11, 2024
  • 1 reply
  • 20 views
keso
Forum|alt.badge.img+7

Hey, I'm working with Cases and Playbooks but have got trouble understanding some things. 

1. When using the "Siemplify_Assign Case_1" in Dynamic mode, how does the "automatically select the instance work" work? What is the decision to select one or another case? 

Regarding the case, what is the decision in SIEM to create a new case or group it in a similar case?

Thank you!

1 reply

AymanC
Forum|alt.badge.img+14
  • AymanCBronze 5
  • Bronze 5
  • October 11, 2024

Hi @keso,

I've not used this functionality, so can only go based on references. The references below should help!

[1] - https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/specify-instance-in-dynamic-mode

[2] -  https://cloud.google.com/chronicle/docs/soar/release-notes#November_09_2023

Kind Regards,

Ayman C

Terms & ConditionsCookie settingsAccessibility statement
Privacy Policy Terms of Service Gen AI Policy Community Guidelines Cookie Settings

© 2025 Google. All rights reserved.