Perform on-demand orchestration from the Security Incident form

  • Release version: Xanadu
  • Updated August 1, 2024
  • 1 minute to read

    • On-demand orchestration can be invoked from a choice list at the bottom of the Security Incident form.

    Before you begin

    Role required: sn_si.write

    Procedure

    1. Navigate to All > Security Incident > Incidents > Show Open Incidents.
    2. Select the record (security incident, observable, or CI) for which you want to run a workflow.
    3. Click the Run Orchestration related link.
      The Run Orchestration dialog box opens. The appearance of the dialog box depends on the setting of the sn_sec_cmn.use_on_demand_tbl_as_whitelist property in Security Support Common.
      Run Orchestration
    4. Click the lookup icon and select the workflow you want to run.
      The selected workflow runs. For details, see Security Incident Response Orchestration flows and actions.