Playbook to enrich dataset data into alert context

[PA_nts]

Hi,

Is anyone able to guide me on how to achieve this perhaps?

I want to ran a task in a playbook that will do a custom query in a dataset and pull information and add it to the alert context data.. is this possible and if so guidelines would be appreciated. 

thanks in adv

[susekar]

Hello @PA_nts 

Greetings for the day!

Yes, it is possible to run a task in a playbook that performs a custom query on a dataset and pulls that information into the alert context. This process is commonly referred to as Context Enrichment.

Guidelines for Achievement

Execute the XQL Query:
Use the xdr-xql-generic-query command within a playbook task to run your custom XQL query. This command allows you to target specific datasets and retrieve the necessary information.

Pull Data into Context:
When a playbook task executes, its output is automatically stored in the Investigation Context. You can view these results in the War Room or the Context Data viewer within the incident workbench.

Map Data to Specific Fields:

To Incident Context:
Use the Set script (e.g., !Set key="key_name" value="${XQL_Result_Path}") to assign specific values from the query result to a context key.

To Custom Incident Fields:
Use the setParentIncidentFields command to map data from the context into predefined custom incident fields.

To Alert Fields:
You can use the Set script or custom automation to populate alert-specific context data, which can then be used in subsequent tasks or for visualization in custom layouts.

Important Considerations:

Performance:
Be cautious when retrieving large numbers of results. Repeatedly calling commands to process items one-by-one can cause severe latency. It is recommended to perform operations in bulk or single calls where possible.

Debugger Limitations:
Note that the Playbook Debugger may not always fully resolve incident-level context variables (such as parentIncidentFields) as accurately as a live execution environment.

Order of Operations:
Enrichment via playbooks happens after an alert has been ingested and an incident created. You cannot use this enriched data for initial Alert Exclusion rules, as exclusions are processed before playbooks are triggered.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar