Add SOAR playbooks to Trellix ESM

From the Trellix ESM dashboard, click and select More Settings.

On the system navigation tree, select Trellix ESM and click .

From System Properties, click SOAR Integration.

Select SOAR Playbook and click Add.

In the Name option, enter a name for the SOAR playbook.

In the Endpoint Name option, select an endpoint.

In the External Playbook Name option, select a playbook.

To map the event field to the playbook parameters:

1. Click and select Event Fields → Network → Destination IP.

2. Click OK.

   Note

   Map the event field based on the playbook parameters.

Select Permission and enable the required permission for the users and groups, then click OK.