Configuring Detection Engineering Extension
Configuring Builder Mode
- Drag the Detection Library Feedback Applet into Title Section of the CIM application.
- From the FIELD PROPERTIES, select Hide section border checkbox.
- Drag the Section into the Applet and name it as Submit Feedback Playbook Button.
- Drag the Playbook Button and name it as Submit Feedback.
- Map the playbook button to Detection Engineering playbook and Save the CIM application.
- Drag the Playbook Button inside the section Supported Playbook Buttons and name it as Fetch Detection Library Tracking ID.
- Map the playbook button to Detection Engineering playbook and Save the CIM application.
- Drag the Playbook Button inside the section Supported Playbook Buttons and name it as Clear Fields.
- Map the playbook button to Detection Engineering playbook and Save the CIM application.
Configuring Workflow Mode
- Enable action Default Detection Feedback Applet Layout.
- Enable Condition If Status == Resolved and Signal Source == Alert. Select Status field from CIM Application and select value as Resolved. Select Signal Source field from CIM Application and select value as Alert.
- Replace Dummy Status field with Status field.
- Select Value as Resolved.
- Replace Dummy Signal Source with Signal Source.
- Select Value as Alert.
Configuring Playbook
- Open the Detection Engineering playbook. Four button triggers are seen. Ignore the Dummy Button and the remaining three are from Builder configurations.
- Search for the following actions and drag them to the three feedback playbook buttons:
- DE - Submit Feedback Workflow
- DE - Fetch Detection Feedback Reference ID
- DE - Clear Detection Feedback Fields
- Click on Configure for any of the Action.
- Map CIM Application Name to Playbook Property.
- Click + > Playbook property from the Dynamic value field.
- Click Button Trigger > Application > Name.
- Map Record Values to Playbook Property.
- Select Playbook Property and click the field.
- Click Button Trigger > Current Record Values.
- Repeat steps 3, 4, and 5 for all three button triggers.
- Save the playbook.