Monitor Workflow Runs for Trellix NDR alerts

Prev Next

The Hyperautomation Workspace displays a list of workflow runs executed by Hyperautomation in response to security events detected by NDR. This functionality enables you to monitor the automated and manual response actions triggered for NDR alerts, streamlining the review of response activities and allowing you to audit the status and details of workflow run responses from within the NDR.

View the workflow-runs

Click the Main_menu.png and under HYPERAUTOMATION select Workspace. The Hyperautomation Workspace displays the latest list of workflow-runs.

Note

The workflow-run displays the following information for each run:

  • Execution Name

  • Executed By

  • Workflow Name

  • Started On

  • Complete On

  • Status

Filter and sort the Workflows list

You can use the filtering and sorting tools to quickly locate specific workflows for analysis.

  • Text Filter: Filters the list by entering text contained in the workflow name.

  • Sorting: Sorts the list using the columns Execution Name, Started On, Completed On, Status.

  • Filtering Results: Filters the workflow-runs based on workflow Name and status.

  • Refresh: Refresh to manually reload the latest workflow-runs.

View Workflow Execution details

You can drill down and view comprehensive details about a specific workflow execution.

Select a workflow-run to open its details .The workflow execution details opens in the Trellix Hyperautomation console in a new browser tab. NDR uses Single Sign-On (SSO) to login into the Trellix Hyperautomation console.