How can a scheduled detection automatically start SOAR work from Enterprise Security?
Select an answer to reveal the explanation.
Short Explanation
Want SOAR to wake up when the detection fires? Hang Send to SOAR on the correlation search Adaptive Response so the event is created without an analyst clicking. Dashboards and dispositions do not ship the notable.
Full Explanation
One basic ES-to-SOAR trigger is a scheduled Adaptive Response on the correlation search or detection, commonly Send to SOAR, which creates a SOAR event or artifact automatically. Analysts do not author Python on the search head to get that path. Data-model acceleration and disposition changes are unrelated trigger mechanisms.