Create CFTR Incident using Rules
You can use Rules to create incidents in Respond (CFTR).
You can create CFTR incidents for the following intent types:
Reports
Campaigns
To automate creating incidents for reports and campaigns using Rules, follow these steps:
In Condition, select Report or Campaign as the Intent Type.
Select the Select Object for Actioning option to add threat data objects to the incident. By default, this option is enabled.
Note
If the threat data objects are mapped in CFTR, they will appear in the Threat Intel section of the incident in CFTR. Unmapped threat objects will be displayed in the incident description. For details on mapping threat data objects in CFTR, see Integrate CTIX.
In Action, select Create CFTR Incident.