MENU
You want to automate a workflow on FortiSOAR so that whenever an incident is moved to the Aftermath phase, it is automatically set to status Resolved and assigned to a purple team specialist as incident lead to write an incident report. In addition, a manual task, assigned to the same specialist, will be created so they are aware of the pending work. Which three steps will accomplish this task? Choose three answers.
Exact Extract: ''FortiSOAR incident handling phases are closely aligned with NIST incident handling phases... The Post-Incident Activity phase is renamed Aftermath. Functionally, they are identical.''
Exact Extract: ''Use the Update Record step to update a record in a module within FortiSOAR. Use the Find Record step to find a record in a module within FortiSOAR.''
Exact Extract: ''Use the Manual Task step to pause the playbook's execution until you mark the task as skipped or completed.''
The correct answers are C, D, and E. The workflow must start when an existing incident is changed to the Aftermath phase, so the correct trigger is an On Update trigger with a condition that matches the incident phase. After the trigger fires, the incident already exists as the current playbook record, so a Find Record step is unnecessary. To set the incident status to Resolved and assign the purple team specialist as the incident lead, use an Update Record step. To create and assign the follow-up work item, use a Manual Task step assigned to the same specialist.
Option B is wrong because a Condition/Decision step evaluates logic; it does not assign records or create work. Option A is wrong because the playbook is already triggered by the updated incident record, so searching for matching incidents adds unnecessary complexity.
Currently there are no comments in this discussion, be the first to comment!