Log360 Cloud - Create or update incident

Playbook Description

The Log360 Cloud playbook automates incident lifecycle management. It first lists incidents to fetch current status details. If an open incident exists, the flow attaches new evidence to the existing record. If no open case is found, it creates a new critical incident, populating it with alert evidence and investigative notes to ensure streamlined response and historical tracking.

MITRE D3FEND mapping

Dependencies

Utility:

• utility_getIncidentStatusDetails

Execution workflow

• Lists incidents matching the given name.
• Fetches incident status details and sets the name.
• If open, updates the existing incident.
• If no open incident found, creates a new critical incident.