Hello, I just wanted to confirm my understanding. Is it currently the case that there is no trigger which provides both the payload and the incident RRN together?
From what I can see, the options are either:
Trigger on the incident RRN and then correlate back to the payload, or
Trigger on the payload and then correlate back to the incident RRN.
If that is correct, are there any plans to change this in the future? Having both pieces of information available within the same trigger would make enrichment and automation significantly easier.
The Evidence payload and Detection Rule trigger contain the same underlying data. You can work backward from an investigation to retrieve the evidence, but with the current configuration, you cannot reliably work forward from a Detection Rule trigger to the investigation it will eventually create.
Detection Rule triggers are straightforward and useful, but the lack of a dependable way to associate them with their resulting investigation is a known issue. The team is aware of it, though I do not have a timeline for a resolution.
The available approach is to use the New Investigation trigger, list that investigation’s alerts, and then retrieve the evidence for each alert. Because every Detection Rule category uses a different evidence schema, the workflow should then route based on Detection Rule category. This ensures the fields used by downstream actions are actually present.
Without category-specific paths after retrieving the evidence, the workflow cannot reliably perform targeted actions—such as disabling a user or isolating an asset—because user and asset identifiers are named differently across the various schemas.