User High-Severity Investigation
A 3-step recipe with Varonis. We can help you get access.
Recipe · 3 steps
User High-Severity Investigation
with Varonis · Threat Detection & Response Management
Investigate a user's high-severity alerts and annotate the top one.
- Retrieve high-severity alerts attributed to the supplied user name in descending time order.
- Load the forensic events for the user's highest-priority alert to understand the activity that triggered it.
- Record an investigation note on the user's top alert to document that the insider-threat review has started.
What you'll need to have ready
- apiKey: Varonis DatAlert API key sent in the X-API-Key header.
- userName: The user name whose high-severity alerts are being investigated.
- lastDays: How many days back to search for alerts.
- note: Annotation recorded against the investigated alert.
For your developer
Arazzo workflow varonis:user-high-severity-investigation, 3 operations: getAlerts → getAlertedEvents → addAlertNote. Specs on APIs.io.