I have a use case to be implemented in FortiSIEM. I want to enrich my FortiSIEM events through APIs possibly via automation policy and then executing a custom Integration.
Let's consider I have configured a rule and an action for automation policy like 'Run script' or 'Invoke an integration policy'.
So, the questions are as below mentioned:
1. Are the events (which triggered the rule) passed by the automation policy as an action to my Integration/script?
2. Is Incident always created once rule is triggered? Is the incident's info are passed to the automation policy action?
