I’m new to using InsightConnect, and looking to see if there’s a way (or how to) either take action on a ticket via ChatOps such as either closing it out or leaving a comment on it.
An example: we have InsightIDR set to send all investigation alerts to Slack via ICON using the default template. Is there a way to respond to these investigations via Slack bot to update them without having to go into IDR itself?
We don’t use Slack, but that is what the ChatOps feature sounds like it does, you would have a decision step waiting for the response like a human decision
Slack has interactive buttons that can appear to users that are tied to a decision tree in ICON, but you cannot provide text input back into ICON from slack using those buttons. You would need to hard-code comments back to an investigation or use workflow variables for each part of the tree based on what you wanted to submit.