Security Operations Integration- Publish to Watchlist capability

The Publish to Watchlist capability adds observables and indicators associated with a security incident to a third-party watchlist that monitors for security events and generates alerts. This capability is used as part of incident response during investigations.

주:

If no implementations are available, capability actions are not displayed in product menus.

• Security Operations Integration - Publish to Watchlist Flow
  The Security Operations Integrations - Publish to Watchlist flow is a high-level flow independent of integrations. It adds observables to third-party watchlist that support the capability. Use it to fulfill an integration.

관련 개념

• Security Operations Integration- Block Request capability
• Security Operations Integration- Email Search and Delete capability
• Security Operations Integration- Enrich CI capability
• Security Operations Integration- Enrich Observable capability
• Security Operations Integration- Get Network Statistics capability
• Security Operations Integration- Get Running Processes capability
• Security Operations Integration- Isolate Host capability
• Security Operations Integration- Sightings Search capability
• Security Operations Integration - Threat Lookup capability

관련 태스크

• Change the order of flow execution