The "Initial SentinelOne Case Creation from DataConnector" workflow template streamlines incident management by automatically creating detailed cases from SentinelOne alerts and threats. It categorizes events into alerts and threats, mapping relevant data such as rule names, severity, and MITRE techniques into Torq cases. This process enhances Endpoint Detection and Response (EDR) by ensuring comprehensive case documentation with observables, custom fields, and markdown tables, facilitating efficient incident response and case management.
Trigger
Use Cases
Case Management , Endpoint Detection and Response (EDR) , Example
Workflow Breakdown
Receives SentinelOne Threats and Alerts streamed from the DataConnector trigger.
Routes by event type for a different field mapping.
Alerts map rule/process fields, Threats extract MITRE techniques.
Creates a tagged case with observables, custom fields, and markdown tables for both types.
Vendors
Utils, Torq Cases