Hey @Kmart95 ,
Use action "Get Detection Details" , it has a useful predefined widget associated with it + JSON result will contain the unflattened version of detection.
This is perfect thank you.
I could see some potential issues with needing to make API calls for every alert that comes in, so I think it would still be nice to have this data saved somewhere during the ingestion process - in case you want my feedback.
But ultimately this does provide what i was looking for. Thanks
This is perfect thank you.
I could see some potential issues with needing to make API calls for every alert that comes in, so I think it would still be nice to have this data saved somewhere during the ingestion process - in case you want my feedback.
But ultimately this does provide what i was looking for. Thanks
I agree, I seen this done with having the ability to just call the field name:
principal_ip = to get the list of all the value and when you want a specific index from the array you just use principal_ip_x
Some thing like this would be nice especially when using variables.
Trying to pass all potential IPs into an action gets messy when you have to account for all possible indexes.
