https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/integration-classifier-by-workflow/m-p/379386#M81 <P>Yes, some customers classify their incidents in playbook. Usually in the case you mentioned, that you don't have enough context in the incident creation time, but only during the playbook execution time.</P> Tue, 12 Jan 2021 22:19:52 GMT aazadaliyev 2021-01-12T22:19:52Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/integration-classifier-by-workflow/m-p/379303#M80 <P>Hi,</P><P>I have been thinking about this a few times by now. I have a mail listener that fetches incoming mails as incidents. To classify them I would like to send them through a playbook, as a classification key doesn't provide enough context to choose the right incident type.&nbsp;</P><P>Did anyone else try this before? Looking for some advice here <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Tue, 12 Jan 2021 13:31:05 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/integration-classifier-by-workflow/m-p/379303#M80 PieterVanGoethem 2021-01-12T13:31:05Z https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/integration-classifier-by-workflow/m-p/379386#M81 <P>Yes, some customers classify their incidents in playbook. Usually in the case you mentioned, that you don't have enough context in the incident creation time, but only during the playbook execution time.</P> Tue, 12 Jan 2021 22:19:52 GMT https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/integration-classifier-by-workflow/m-p/379386#M81 aazadaliyev 2021-01-12T22:19:52Z