All Apps and Add-ons

Trackme, how to change default priorities based on a tag

lmcgchr
New Member

Hi,

is it possible to change the default priority of  data source(s) in the TrackMe app using a tag which is defined in TrackMe?

 

Thanks

Labels (2)
Tags (1)
0 Karma

guilmxm
Influencer

Hi @lmcgchr 

See the following issue:

https://github.com/guilhemmarchand/trackme/issues/281

In a nutshell you could easily create your own workflow, with a scheduled report handling this:

Example:

| inputlookup trackme_data_source_monitoring | eval keyid=_key
| search data_name="firewall:pan:traffic"
| eval tags_expanded=tags
| makemv delim="," tags_expanded
| eval priority=if(tags_expanded="CIM", "high", priority)
| fields - tags_expanded
| outputlookup append=t key_field=keyid trackme_data_source_monitoring



--> Create a report using a similar logic
--> schedule this report to run on a regular basis, daily for example

What it does is loading the collection, creating an expanded version of the tags, defining the priority, and updating the values.
Everything else will be preserved y the outputlookup.

Guilhem


0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!