The Search operator allows a workflow to query and retrieve data related to a specific Artifact from connected Trellix applications. This operator is crucial for obtaining contextual information and performing initial investigation steps as part of an automated workflow.
Perform these steps to configure the Search operator in your workflow:
Drag and drop the Search operator onto the workflow canvas.
Click the operator to open the properties pane.
In the Name field, enter a descriptive name for the search operator.
In the (Optional) Description field, add details about the search operation's goal.
Under Parameters, select the relevant artifact (example: file hash, IP address) that you want to search within.
Under Conditions, specify the rules for the search:
Select a condition type from the available options.
Enter a value manually or use $ for suggestions derived from previous workflow steps.
To include multiple search rules, click Add Condition.
For Mark Pass When All Apps Succeed, select True or False:
True: Marks the search as successful only if all connected applications or apps return a successful response.
False: Marks the search as successful if at least one connected application returns a successful response.
In the (Optional) Action field, select an optional follow-up action to perform if applicable.
Click Save.