A county analyst wants a playbook to run for one parks notable without changing the correlation search. What Enterprise Security trigger path should they use?
Select an answer to reveal the explanation.
Short Explanation
One parks notable, one playbook, no search rewrite: that is the ad-hoc Send to SOAR or Run Playbook click on the Analyst Queue. Standing orders live on the correlation search. This one is a human choosing this case.
Full Explanation
A second basic trigger path is analyst-driven: Run Playbook in SOAR or Send to SOAR ad hoc from a notable or finding on the Analyst Queue. That does not require editing the correlation search. A&I rebuilds, disabling acceleration, and renaming notables are not SOAR trigger paths.