Configuring SOAR actions

 

SOAR integrations are listed in the Integrations view under the heading SOAR.

Clicking an individual instance expands the entry to reveal the following three categories of information and configuration:

• Actions: SOAR actions can only be triggered by an authorized account user with the appropriate assigned role. Enable/Disable the desired individual actions supported by your SOAR product and specify an associated account role for each one. In the TIME-TO-LIVE field, specify in seconds the length of time after being triggered that the action will remain dormant before re-triggering.
• Details: This section provides information about the SOAR integration instance for the product, including who created it and when.
• Configuration: This section allows you to adjust the authentication information for the product's SOAR integration.

Click the Apply Changes to save any modifications to the configuration.