Trackme, how to change default priorities based on a tag

[lmcgchr]

Hi,

is it possible to change the default priority of  data source(s) in the TrackMe app using a tag which is defined in TrackMe?

Thanks

[guilmxm]

Hi @lmcgchr 

See the following issue:

https://github.com/guilhemmarchand/trackme/issues/281

In a nutshell you could easily create your own workflow, with a scheduled report handling this:

Example:

| inputlookup trackme_data_source_monitoring | eval keyid=_key
| search data_name="firewall:pan:traffic"
| eval tags_expanded=tags
| makemv delim="," tags_expanded
| eval priority=if(tags_expanded="CIM", "high", priority)
| fields - tags_expanded
| outputlookup append=t key_field=keyid trackme_data_source_monitoring

--> Create a report using a similar logic
--> schedule this report to run on a regular basis, daily for example

What it does is loading the collection, creating an expanded version of the tags, defining the priority, and updating the values.
Everything else will be preserved y the outputlookup.

Guilhem