Guardicore-Import-Incidents

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Content Index


Author: Accelerynt

Attribute Value
Type Playbook
Solution Standalone Content
Source View on GitHub

Tables Used

This content item queries data from the following tables:

Table Transformations Ingestion API Lake-Only
GCIncidents_CL ? ?

Logic App Connectors

This playbook uses 2 Logic App connectors / built-in actions:

Connector / Action Type Connections Actions
azureloganalyticsdatacollector Managed 1 1
http Built-in 0 3
Action parameters (URLs, paths, function IDs)

azureloganalyticsdatacollector (Managed)

Action Method Endpoint Other
Send_Data post /api/logs

http (Built-in)

Action Method Endpoint Other
Send_authorization_callout POST [concat('', parameters('GCURL'), '/api/v3.0/authenticate')]
Send_get_incidents_callout GET [concat('', parameters('GCURL'), '/api/v3.0/incidents?tags__not=sentinel')]
Send_update_incident_callout_to_Guardicore PUT [concat('', parameters('GCURL'), '/api/v3.0/incidents/@{items(''For_each_Guardicore_incident'')?[''_Id'']}?action=add_user_tag')]

Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊

Back to Playbooks