Perform on-demand orchestration from the Security Incident list

  • Release version: Xanadu
  • Updated August 1, 2024
  • 1 minute to read

    • On-demand orchestration can be invoked from the Security Incident list, as well as from related lists in Security Incident Response.

    Before you begin

    Role required: sn_si.write

    Procedure

    1. Navigate to All > Security Incident > Incidents > Show Open Incidents.
    2. Select the check box next to the security incident for which you want to run a workflow.
    3. Click the Actions on selected rows choice list at the bottom of the screen, and click Run Orchestration.
      The Run Orchestration dialog box opens. The appearance of the dialog box depends on the setting of the sn_sec_cmn.use_on_demand_tbl_as_whitelist property in Security Support Common.
      Run Orchestration
    4. Click the lookup icon and select the workflow you want to run.
      The selected workflow runs. For details, see Security Incident Response Orchestration flows and actions.