Playbook triggers were not configured for those alerts.

Installation of the appropriate content pack was not completed.

Misconfiguration of the connector instance has occurred.

Playbook classifier was not configured for the alert type.

Graphic representation of an event Causality Instance (CI) with additional capabilities to enable further analysis

Sequence of events, alerts, rules, and other actions involved over the lifespan of an incident

Tab within an incident where analysts can collaborate and initiate further actions and automations

Detailed overview of behavior or activity that triggered an Analytics Alert, Analytics BIOC alert, or correlation rule

From XQL Search, locate the query to save to a personal Query Library
Right-click, and select "Save query to library"
Enable the "Share with others" option

From the Query Center, in the XQL query field, define the parameters of the query
Save as, and choose the "Query to Library" option
Enable the "Share with others" option

From XQL Search, in the XQL query field, define the parameters of the query
Save as, and choose the "Query to Library" option
Enable the "Share with others" option

From the Query Center, locate the query to save to a personal Query Library
Right-click, and select "Save query to library"
Enable the "Share with others" option

Sub-playbook

Job

Standard

Conditional

Revoke user access and conduct a user audit.

Allow list the processes to reduce alert noise.

Initiate the endpoint isolate action to contain the threat.

Prioritize blocking the source IP address to prevent further login attempts.