Generate Casebook with Flow Links

This workflow generates a Cisco SecureX casebook with links to investigate the IP address in Cisco Secure Cloud Analytics (SCA). Supported observable: ip

GitHub

---

Change Log

See the Important Notes page for more information about updating workflows

---

Requirements

• The following system atomics are used by this workflow:
  • Threat Response - Create Casebook
  • Threat Response - Generate Access Token
• The following atomic actions must be imported before you can import this workflow:
  • None
• The targets and account keys listed at the bottom of the page
• Cisco Secure Cloud Analytics (SCA)

---

Workflow Steps

1. Calculate date 7 days ago
2. Format 7 days ago date to Secure Cloud Analytics format
3. Format today’s date to Secure Cloud Analytics format
4. Generate Threat Response access token
5. Create casebook with investigation links

---

Configuration

• Set your Secure Cloud Analytics instance URL in the SCA Instance URL local variable
• If you want to change the name of this workflow in the pivot menu, change its display name

---

Targets

Target Group: Default TargetGroup

---

Account Keys

---