Triage Newest Alert
A 3-step recipe with Varonis. We can help you get access.
Recipe · 3 steps
Triage Newest Alert
with Varonis · Threat Detection & Response Management
Find the newest open alert, fetch its events, and mark it Under Investigation.
- Retrieve open alerts from the recent window in descending time order so the newest open alert is first in the response.
- Retrieve the forensic events behind the selected alert to understand the scope of the activity before investigating.
- Transition the alert into Under Investigation status and record a triage note so the rest of the team can see it is being worked.
What you'll need to have ready
- apiKey: Varonis DatAlert API key sent in the X-API-Key header.
- lastDays: How many days back to search for open alerts.
- maxResults: Maximum number of alerts to scan when selecting the newest.
- triageNote: Note documenting why the alert is being investigated.
For your developer
Arazzo workflow varonis:triage-newest-alert, 3 operations: getAlerts → getAlertedEvents → updateAlertStatus. Specs on APIs.io.