Is it possible to trigger a playbook whenever a user logs in the SOAR

[kaashif_m]

Hi Community, 

Is it possible to trigger a playbook whenever a user logs in the SOAR 

If yes requesting to share the api call 

trying to create session management 

if the user is logged in he should not be able to login from any other session

Regards,

Kaashif Mohideen K

[anarula]

Unfortunately no. We don't have that kind of event and ability to tap into it.. but thanks for providing the use case. We can consider this in the future.

[cichelson]

Work around would be to send the Fortisoar Syslog to a SIEM, then create a SIEM rule to fire when based on your data set, then from there, pull it back into the Alert DB / Incident DB depending on your setup and initiate your next step playbook... :)

I can check logs tomorrow and see if the user logs are there... I thought the system tracked logins...

[SpencerBenedict]

Yes, use an event-driven playbook triggered by login API calls.