Skip to main content
Kunj
New Member
January 7, 2025
Question

Choosing action for Automation Policy for IoC enrichment

  • January 7, 2025
  • 0 replies
  • 360 views

I have a use case where I want to automatically enrich IoC data from event in FortiSIEM and build Dashboards. An API call should be made to third-party threat intelligence platform to enrich data and store info into Lookup tables.
Can Automation Policy triggered by a rule is feasible in this scenario?

 

I am considering using one of these 2 actions:

1. Run Remediation/ Script

2. Invoke an Integration Policy (Create Custom Integration)

 

I had few questions:

1. Would the events be passed to this actions?

2. Can I do API calls on event fields using any of above actions and store those into Lookup tables? 
3. Can i build Dashboards on this enriched data? If Yes, any example or reference would be helpful.