Creating SOAR workflows

1. Select Workflows from the Automation menu.
2. Click the Create Workflow button to display the SOAR Workflow editing screen.
3. Click + Add to specify a Trigger type of either Asset State Change, Case Status Change or Case Creation and click Apply.
4. Click + Add to specify a Decision panel and do one of the following depending on your SOAR action trigger type: select a Risk Score Threshold ( ) or Rule ( ) from the dropdown menu.
   • Asset State Change: Enter a Decision Rule and Risk Score Threshold Value.
   • Case Status Change: Select the desired case type and status change from the drop-down menus.
   • Case Creation: Select a Rule.
   • Detection Creation: Select a Rule.
5. To define an action or multiple actions, click + Add and select an application from the Application drop-down menu.
6. Select from the Action drop-down menu. The available actions depend on the selected application. The remaining configuration options are determined by the selection of both Application and Action, and can include:
   • Machine ID
   • Host
   • Device ID
   • Apply Firewall Rule
   • Define a custom notification via email or webhook using a supported messaging application such as Teams or Slack
   • Message Consolidation: When the action selected is an external notification, you enable Message Consolidation to aggregate messages based on Time, Quantity, or the combination of both.
7. When you are finished configuring options for the action, click Save to save the workflow.