Getting Enriched Events (SOAR Action in ServiceNow)

Use this SOAR action to get the enriched events from selected alerts on the Security Incident related alert list.

• This action can be run from an alert.
• This action is only available for alerts of type CB_ANALYTICS.
• This action stores the enriched events data of selected alerts in a table named Events at the bottom of the Alert record page.
• A list field is added in the Enriched Events table that stores the Alert IDs of the associated alerts.