After Actions Report

After Actions Report is a platform for generating structured, comprehensive reports documenting incident responses and findings.

After Actions Report enables organizations to generate comprehensive incident documentation, capturing all critical details and findings following a security event. This connector allows Swimlane Turbine users to automate the creation of detailed After Action Reports directly from their playbooks, leveraging customizable templates and dynamic data fields. By integrating After Actions Report with Turbine, security teams can streamline post-incident reporting, ensure consistency in documentation, and accelerate compliance and knowledge sharing across the organization.

Prerequisites

To use the After Actions Report connector, ensure you have the following prerequisites:

Personal Access Token authentication using these parameters:

Swimlane URL: The base URL of your Swimlane instance.

Swimlane API PAT: A valid Personal Access Token for authenticating API requests.

Capabilities

This Connector provides the following capabilities:

Create After Actions Report

Configurations

Asset

Authenticates using an Personal Access Token

Configuration Parameters

Parameter	Description	Type	Required
swimlane_url	Internal URL of your Swimlane Instance, i.e. 'sw-web:443', 'sw-web:4443' or FQDN of Load Balancer	string	Required
swimlane_api_pat	Personal Access Token (PAT) used when accessing the Swimlane API.	string	Required
default_timeout	Connection timeout in seconds. Defaults to 60 seconds	number	Optional
verify_ssl	Enable SSL certificate verification. Ignored for non-SSL connection	boolean	Optional
verbose_errors	HTTP errors will contain more detail about the request and response if selected.	boolean	Optional

Actions

Create After Action Report

Generate a comprehensive After Action Report for an incident, documenting all relevant details and findings.

Endpoint

Method: GET

Input

Argument Name	Type	Required	Description
event_source	string	Optional	Parameter for Create After Action Report
tracking_id	string	Optional	Unique identifier
case_summary	string	Optional	Parameter for Create After Action Report
soc_analysis	string	Optional	Parameter for Create After Action Report
event_occurred_on	string	Optional	Parameter for Create After Action Report
event_received_on	string	Optional	Parameter for Create After Action Report
case_created_on	string	Optional	Parameter for Create After Action Report
case_claimed_on	string	Optional	Parameter for Create After Action Report
case_closed_on	string	Optional	Parameter for Create After Action Report
case_tt_closed_min	string	Optional	Parameter for Create After Action Report
case_current_owner	string	Optional	Parameter for Create After Action Report
analyst_phone	string	Optional	Parameter for Create After Action Report
user_account	string	Optional	Count value
hostname	string	Optional	Name of the resource
email_address	string	Optional	Parameter for Create After Action Report
ticket_details	string	Optional	Parameter for Create After Action Report
oob_recipient	string	Optional	Parameter for Create After Action Report
base64_template	string	Optional	Base64 encoded template
custom_fields	string	Optional	Custom fields to be added to the report. The template must have the exact key name. It needs to be a json string where the key is the field name and the value is the value to be added to that field.

Input Example

{"event_source":"string","tracking_id":"string","case_summary":"string","soc_analysis":"string","event_occurred_on":"string","event_received_on":"string","case_created_on":"string","case_claimed_on":"string","case_closed_on":"string","case_tt_closed_min":"string","case_current_owner":"string","analyst_phone":"string","user_account":"string","hostname":"Example Name","email_address":"string","ticket_details":"string","oob_recipient":"string","base64_template":"string","custom_fields":"string"}

Output

Parameter	Type	Description
report	object	Output field: report

Output Example

{"report":{}}

Response Headers

Header	Description	Example
Content-Type	The media type of the resource	application/json
Date	The date and time at which the message was originated	Thu, 01 Jan 2024 00:00:00 GMT