Arcsight - Get events related to the Case
ArcSight ESM Pack.#This Playbook is part of the
Gets the case's Arcsight
ResourceID from the
FetchID field, or the "ID" label. If neither are there, it will ask the user for the ID.
Uses the resource ID to get full data for the case, the correlated/aggregate events underneath it, and all base events underneath them.
This playbook uses the following sub-playbooks, integrations, and scripts.
This playbook does not use any sub-playbooks.
There are no inputs for this playbook.
There are no outputs for this playbook.