SOAR case information

Forescout Cloud currently supports configuring and using Microsoft Defender for Endpoint and CrowdStrike EDR. For both products, a puller is used to retrieve the necessary event data to enable SOAR use cases.

Managing and executing SOAR Actions for Cases

When successfully integrated, each SOAR integration will be displayed on the Case Details view under the heading SOAR Actions.

The products that support SOAR actions can have multiple iterations within a customer network. The available response actions of each SOAR iteration can be assigned to either the Admin or Operator account role, with certain actions limited to only the Admin account.

To initiate a new SOAR action for the Case, click the + button and select the desired action from the ACTIONS dropdown. Depending on the SOAR action, you may be required to enter a Hostname or Machine ID. Click the Trigger button to initiate the action.

When a SOAR action is initiated successfully, a record is displayed on the Case Details view to preserve information about who triggered the action and why.

When a SOAR action fails, a record is displayed on the Case Details view as well with the failure error code and associated explanation (if available).

If the credentials associated with the action are not valid,   locks down action as follows:

  • An error in the action results on the Case Details view indicates invalid credentials.

  • A triage card is created on the Threats screen with a health alert for the SOAR Action.

  • The SOAR Action is disabled and no further iterations of that action are triggered until the customer re-enables that specific action in the UI