This workflow template automates cyber threat case management by scheduling regular checks for new SentinelOne alerts and creating Torq cases for each alert. Upon pulling alerts via the SentinelOne API, relevant alert details are mapped to a predefined case structure to ensure consistent and organized case information. This solution enhances an organization's responsiveness to threats, streamlines processes within security operations, and ensures all relevant threat data is captured and actioned within Torq's case management framework.
Use Cases
Case Management
Workflow Breakdown
Establish a checkpoint to mark accurate beginning and end times.
Pull alerts from SentinelOne API on schedule.
Map alert fields to a predefined case layout.
Create a case for each new alert.
Vendors
Utils, SentinelOne, Torq, Torq Cases
Workflow Output
create
Tips