Run Enrichment Actions within a case
Use this section to understand how enrichments actions are performed on case(s).
Before you begin
Role required: sn_sec_tisc.admin
Procedure
Navigate to Workspaces > Threat Intelligence Security Center.
Click Threat Analyst Workbench icon.
Go to Case Management > All Cases.
All the cases are displayed.
Select any case or case task.
Go to Artifacts tab.
Select the Observables related list.
Select one ore more Observables.
Click any Enrichment actions from the dropdown list.
Select the available implementation(s).
Click Submit.
For example, Run Threat Lookup. The selected enrichment action will be executed and an information message is displayed that Observable enrichment execution has started on the selected observable(s). Results will be available in the detail page of respective observable(s) once the execution is complete.
Note: Once the execution initiated or completed, a work notes is posted on the activity stream of the form view.
Enrichment actions
Parent Topic:Threat Analyst Workbench
Related topics
Creating cases using Threat Analyst Workbench
Summarize a Case with Now Assist for Threat Intelligence Security Center
Creating case task using Threat Analyst Workbench
Working with Investigation Canvas
Add artifacts to case(s) or case task(s)
Generate a Case Report using generative AI
Generate a Case Report using a template
Create a security incident from a TISC case