Managing SOAR workflows

Clicking Workflows from the Automation menu displays the Workflows screen. Here you can create, save, edit and delete SOAR Workflows for Forescout eyeAlert and Forescout eyeFocus.

Forescout Cloud currently triggers SOAR workflows for the following events:

• Asset State Change
• Case Status Change
• Case Creation

Workflows are based on specifying a Decision (triggered Rule) and one or more Actions (as supported by your integrated SOAR application). The top panel shows SOAR Workflow metrics for the following key elements:

• Total Workflows
• Enrichments
• Response
• Notifications
• Triggered Actions (Completed and Failed)

Each SOAR Workflow element has a specific icon. Saved workflows appear beneath the metrics panel, and display the icons for the SOAR Workflow elements it is using. Click the Hamburger button to edit and delete saved SOAR workflows.