Automate changes to Incident and Alerts to send to backend system

[PA_nts]

So looking at a way for when an analyst is working on an incident/case in XSIAM so that, if they add any notes, change the assignment, change severity, run commands in warroom etc - that these changes are sent automatically to a backend webhook via http post or API.

anyone done this before or know if possible?

thanks in adv

[PA_nts]

Ok so for anyone interested.. not something that is supported it seems.. however there are ways.

in my case, this will require a Job to be scheduled to trigger a playbook, the playbook will run the 'core-get-incidents' script that i can set on a time base for the 'since_modification_time' input say to 1 hour.. that means any change to an incident in the last hour (severity, assignment,status) will be added to the context data and this can be send to the webhook url as a payload.

then up to the devs on the webhook end to compare the data received to that of the already existing incident in the backend and update the fields if the changes are found to have changed.

bit of a process but the only we can get something at least. in this instance we use swimlane soar in the backend and there is no integration content pack yet for this platform..

hope this helps