After Actions Report

after actions report is a platform for generating structured, comprehensive reports documenting incident responses and findings after actions report enables organizations to generate comprehensive incident documentation, capturing all critical details and findings following a security event this connector allows swimlane turbine users to automate the creation of detailed after action reports directly from their playbooks, leveraging customizable templates and dynamic data fields by integrating after actions report with turbine, security teams can streamline post incident reporting, ensure consistency in documentation, and accelerate compliance and knowledge sharing across the organization prerequisites to use the after actions report connector, ensure you have the following prerequisites personal access token authentication using these parameters swimlane url the base url of your swimlane instance swimlane api pat a valid personal access token for authenticating api requests capabilities this connector provides the following capabilities create after actions report configurations asset authenticates using an personal access token configuration parameters parameter description type required swimlane url internal url of your swimlane instance, i e 'sw web 443 ', 'sw web 4443 ' or fqdn of load balancer string required swimlane api pat personal access token (pat) used when accessing the swimlane api string required default timeout connection timeout in seconds defaults to 60 seconds number optional verify ssl enable ssl certificate verification ignored for non ssl connection boolean optional verbose errors http errors will contain more detail about the request and response if selected boolean optional actions create after action report generate a comprehensive after action report for an incident, documenting all relevant details and findings endpoint method get input argument name type required description event source string optional parameter for create after action report tracking id string optional unique identifier case summary string optional parameter for create after action report soc analysis string optional parameter for create after action report event occurred on string optional parameter for create after action report event received on string optional parameter for create after action report case created on string optional parameter for create after action report case claimed on string optional parameter for create after action report case closed on string optional parameter for create after action report case tt closed min string optional parameter for create after action report case current owner string optional parameter for create after action report analyst phone string optional parameter for create after action report user account string optional count value hostname string optional name of the resource email address string optional parameter for create after action report ticket details string optional parameter for create after action report oob recipient string optional parameter for create after action report base64 template string optional base64 encoded template custom fields string optional custom fields to be added to the report the template must have the exact key name it needs to be a json string where the key is the field name and the value is the value to be added to that field input example {"event source" "string","tracking id" "string","case summary" "string","soc analysis" "string","event occurred on" "string","event received on" "string","case created on" "string","case claimed on" "string","case closed on" "string","case tt closed min" "string","case current owner" "string","analyst phone" "string","user account" "string","hostname" "example name","email address" "string","ticket details" "string","oob recipient" "string","base64 template" "string","custom fields" "string"} output parameter type description report object output field report output example {"report" {}} response headers header description example content type the media type of the resource application/json date the date and time at which the message was originated thu, 01 jan 2024 00 00 00 gmt