IntSights

The action should not fail nor stop a playbook execution:

If successful (is_success=true): "Successfully add a note to the alert with ID '{0}' in Intsights ".format(alert id)

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to the server, or other is reported: "Error executing action "Add Note". Reason: {0}''.format(error.Stacktrace)

If the 404 status code is reported: "Error executing action "Add Note". Reason: alert with ID {alert id} was not found in IntSights.'

The action should not fail nor stop a playbook execution:

If successful: "Successfully asked analyst in the alert with ID '{0}' in Intsights ".format(alert id)

If the 400 or 500 status code is reported: "Action was not able to ask the analyst in the alert with ID {0} in Intsights. Reason: {1}.".format(alert_id, response string)

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to server, other is reported: "Error executing action "Ask an Analyst". Reason: {0}''.format(error.Stacktrace)

Specify the ID of the analyst that should be assigned to the alert.
Note: If both "Assignee ID" and "Assignee Email Address" are specified, action will prioritize "Assignee ID".

Specify the email address of the analyst that should be assigned to the alert.
Note: If both "Assignee ID" and "Assignee Email Address" are specified, action will prioritize "Assignee ID".

The action should not fail nor stop a playbook execution:

If successful with assignee ID: "Successfully assigned analyst with ID '{0}' to the alert with ID {1} in Intsights ".format(assignee id, alert id)

If successful with assignee email address: "Successfully assigned analyst with email address '{0}' to the alert with ID {1} in Intsights ".format(assignee email address, alert id)

If assignee is not found, the status code is 400, and worked with assignee ID:

"Action was not able to change the assignment on the alert with ID {0}. Reason: Assignee with ID {1} was not found.".format(alert_id, assignee id)"

If assignee is not found, the status code is 400, and worked with assignee email address: "Action was not able to change the assignment on the alert with ID {0}. Reason: Assignee with email address {1} was not found.format(alert_id, email address)"

If the 400 or 500 status code is reported: "Action was not able to change the assignment on the alert with ID {0}. Reason: {1}.".format(alert_id, response)

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to server, other is reported: "Error executing action "Assign Alert". Reason: {0}''.format(error.Stacktrace)

If the "Assignee ID" and "Assignee Email address" parameters are not specified: "Assignee ID or Email Address should be specified."

Problem Solved

Possible Values:

• Problem Solved
• Informational Only
• Problem We Are Aware Of
• Company Owned Domain
• Legitimate Application/Profile
• Not Related To My Company
• False Positive
• Other

The action should not fail nor stop a playbook execution:

If successful: "Successfully closed the alert with ID '{0}' in Intsights ".format(alert id)

If the 400 status code is reported: "Action was not able to close the alert with ID {0} in Intsights. Reason: {1}.".format(alert_id, response string)

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to server, other is reported: "Error executing action "Close Alert". Reason: {0}''.format(error.Stacktrace)

If the "Rate" parameter is not in the 1-5 range: "Rate value should be in range from 1 to 5."

The action should not fail nor stop a playbook execution:

If successful for at least one CSV (is_success=true): "Successfully downloaded CSV for the alert with ID {0} in Intsights:".format(alert_id)

If the 400 status code is reported (is_success=true): "No CSV information was found for the alert with ID {alert_id} in Intsights."

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to server, other is reported:

"Error executing action "Download Alert CSV". Reason: {0}''.format(error.Stacktrace)

If a file with the same name already exists, but "Overwrite" is set to false: "Error executing action "Download Alert CSV". Reason: file with path {0} already exists. Please delete the file or set "Overwrite" to true."

If the 404 status code is reported: "Error executing action "Download Alert CSV". Reason: Unable to find alert with ID {ID}'

Specify the comma-separated list of alert image IDs.
Example: id1,id2.

The action should not fail nor stop a playbook execution:

If successful for at least one image: "Successfully retrieved images from the following IDs in Intsights:".format(list of ids)

If not successful for at least one image: "Action wasn't able to successfully retrieve images from the following IDs in Intsights:\n".format(list of ids)

If not successful for all images: "No images were retrieved".

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to server, other is reported: "Error executing action "Get Alert Image". Reason: {0}''.format(error.Stacktrace)

The action should not fail nor stop a playbook execution:

If successful: "Successfully reopened the alert with ID '{0}' in Intsights ".format(alert id)

If the 400 status code is reported: "Action was not able to reopen the alert with ID {0} in Intsights. Reason: {1}.".format(alert_id, response string)

The action should fail and stop a playbook execution:

If a fatal error, like wrong credentials, no connection to server, other is reported: "Error executing action "Reopen Alert". Reason: {0}''.format(error.Stacktrace)