I'd like to take the generic polling concept and make it a little more specific, but I'm coming up short. I'm doing a QRadar search (although I suspect Splunk or anything else would be very similar.) The QRadarFullSearch playbook will poll and wait
I'm working on a failsafe automation to shut down an integration if it fetches more than a certain threshold of events in a time period. Is it possible to disable an integration, or turn off the "fetches incidents" parameter, with a command? Or throu
Trying to learn how to use this thing. I've got a very simple playbook set up that uses the Slack integration to send a simple yes/no prompt to a user. Within the Playground, I'm able to successfully send simple messages via slack, so the connectio
The built in Qualys commands from an instance don't quite do what I want to do so I have a python script that uses the api to grab the last report from a map scan, filter it for systems that have specific ports open, and then upload the ip addres
I recently fetched several incidents using an integration without any classification/mapping configured. I have since configured it correctly, is there any way to re-fetch or re-ingest these incidents so they get mapped and processed correctly?