Updating a Policy (SOAR Action in ServiceNow)

Use the Update Endpoint Policy SOAR action to update a policy.

• This action can be run from an alert or a device.
• Enter the Policy ID of the new Policy to apply to the endpoint.
• The updated Policy ID and Policy Name display in the selected alerts record.

To get the Policy ID in Carbon Black Cloud:

1. Log in to the Carbon Black Cloud console.
2. In the left navigation pane, click Enforce > Policies.
3. Select the policy from the list of policies.

   The Policy ID displays on the General tab.