The action should not fail nor stop a playbook execution:

If successful:

Print "Successfully connected to the Vectra server with the provided connection parameters!"

The action should fail and stop a playbook execution:
If not successful:

Print "Failed to connect to the Vectra server! Error is {0}".format(exception.stacktrace)

The action should not fail nor stop a playbook execution:

If successfuland at least one of the provided entities were enriched (is_success = true):

Print "Successfully enriched the following endpoints from Vectra: \n {0}".format(entity.identifier list)

If action found multiple matches in Vectra for some Google SecOps entities, first match was taken to enrich endpoint:

Print "Multiple matches were found in Vectra, taking first match for the following entities:/n {0}".format(entity.identifiers list)

If Ifail to enrich specific entities(is_success = true):

Print "No entities were enriched."

The action should fail and stop a playbook execution:
If fatal error, like wrong credentials, no connection to server, other:

Print "Error executing action "Enrich Endpoint". Reason: {0}''.format(error.Stacktrace)

Endpoint

Possible values:
Endpoint

Detection

The action should not fail nor stop a playbook execution:

If detection/endpoint is found and tags were successfully updated (is_success = true):

Print "Successfully added tags {0} to {1} with ID {2}.format(tags, Item Type, Item ID)

If detection/endpoint was found, but tags were not added (is_success=False):

Print "Action wasn't able to add tags {0} to {1} with ID {2}. Reason: {3}. format(tags, Item Type, Item ID, tags parameter from response)".

If detection/endpoint was not found (is_success=False):

Print "{0} with ID {1} was not found.format(Item Type, Item ID)."

II is_success=false without a specific situation and it's not a critical error:

Print "Action wasn't able to add tags to {0} with ID {1}.format(Item Type, Item ID)":

The action should fail and stop a playbook execution:
If fatal error (wrong credentials, connection error, action crashes):

Print "Error executing action "Add Tags". Reason: {0}''.format(error.Stacktrace)

Endpoint

Possible values:
Endpoint

Detection

The action should not fail nor stop a playbook execution:

If detection/endpoint is found and tags were successfully updated (is_success = true):

Print "Successfully removed tags {0} from {1} with ID {2}.format(tags, Item Type, Item ID)

If detection/endpoint was not found (is_success=False):

Print "{0} with ID {1} was not found.".format(Item Type, Item ID)."

If detection/endpoint was found, but tag is not found (is_success=False):

Print "Tags {0} don't exist in {1} with ID {2}.".format(list of tags that were not found separated by comma, Item Type, Item ID)."

If is_success=false without a specific situation and it's not a critical error:

Print "Action wasn't able to remove tags from {0} with ID {1}.format(Item Type, Item ID)":

The action should fail and stop a playbook execution:
If fatal error (wrong credentials, connection error, action crashes):

Print "Error executing action "Remove Tags". Reason: {0}''.format(error.Stacktrace)

Endpoint

Possible values:
Endpoint

Detection

The action should not fail nor stop a playbook execution:

If detection/endpoint is found and note was successfully updated (is_success = true):

Print "Successfully updated note on {1} with ID {2}.format(Item Type, Item ID)

If detection/endpoint was not found (is_success=False):

Print "{0} with ID {1} was not found.".format(Item Type, Item ID)."

If is_success=false without a specific situation and it's not a critical error:

Print "Action wasn't able to update note on {0} with ID {1}.format(Item Type, Item ID)":

The action should fail and stop a playbook execution:
If fatal error (wrong credentials, connection error, action crashes):

Print "Error executing action "Update Note". Reason: {0}''.format(error.Stacktrace)

Fixed

Possible Values:

Fixed

Active

The action should not fail nor stop a playbook execution:

If detection is found and status was successfully updated (is_success = true):

Print "Successfully updated status to '{0}' on detection with ID {1}.format(Status, Detection ID)

If detection was not found (is_success=False):

Print "Detection with ID {1} was not found.".format(Detection ID)."

If is_success=false without a specific situation and it's not a critical error:

Print "Action wasn't able to update status on detection with ID {1}.format(detection ID)":

The action should fail and stop a playbook execution:
If fatal error (wrong credentials, connection error, action crashes):

Print "Error executing action "Update Detection Status". Reason: {0}''.format(error.Stacktrace)

The action should not fail nor stop a playbook execution:

If successful and at least one of the provided rule ids were enriched (is_success = true):

Print "Successfully retrieved information about the following triage rules from Vectra: \n {0}".format(processed rule ids)

If fail to enrich specific entities(is_success = true):

Print "Action was not able to retrieve information about the following triage rules\n: {0}".format(not processed rule ids)

If fail to enrich for all entities (is_success = false):

Print "No information was retrieved about the triage rules."

The action should fail and stop a playbook execution:
If fatal error (wrong credentials, connection error, action crashes):

Print "Error executing action "Get Triage Rule Details". Reason: {0}''.format(error.Stacktrace)

Table Name: Triage Rules Details

Table Columns:

ID (mapped as id)

Enabled (mapped as enabled)

Detection Category (mapped as detection_category)

Triage Category (mapped as triage_category)

Detection (mapped as detection)

Whitelist (mapped as is_whitelist)

Priority (mapped as priority)

Created At (mapped as created_timestamp)

Environment Field Name

Describes the name of the field where the environment name is stored.

If the environment field isn't found, the environment is the default environment.

Environment Regex Pattern

A regex pattern to run on the value found in the "Environment Field Name" field.

Default is .* to catch all and return the value unchanged.

Used to allow the user to manipulate the environment field via regex logic.

If the regex pattern is null or empty, or the environment value is null, the final environment result is the default environment.

Lowest threat score that will be used to fetch detections.

Min: 0

Max: 100

Lowest certainty score that will be used to fetch detections.

Min: 0

Max: 100

Specify which categories of detections to ingest into Google SecOps.

Possible values:

Command and Control

Botnet

Reconnaissance

Lateral Movement

Exfiltration

Info