I have a use case where I want to automatically enrich IoC data from event in FortiSIEM and build Dashboards. An API call should be made to third-party threat intelligence platform to enrich data and store info into Lookup tables.
Can Automation Policy triggered by a rule is feasible in this scenario?
I am considering using one of these 2 actions:
1. Run Remediation/ Script
2. Invoke an Integration Policy (Create Custom Integration)
I had few questions:
1. Would the events be passed to this actions?
2. Can I do API calls on event fields using any of above actions and store those into Lookup tables?
3. Can i build Dashboards on this enriched data? If Yes, any example or reference would be helpful.
