Repost: Assign different Label with different use case within the same Asset

[AliMaher]

Hello SOARians,

I am thinking of a scenario where an external alert from a SIEM like qRadar or Elastic should trigger a playbook. For example, a bruteforce alert should trigger a bruteforce playbook, a portscan alert should trigger a portscan playbook, and so on. Unfortunately, it is only possible to assign the same labels to all incoming SIEM alerts. Based on these labels a playbook is then executed.

Is there any way to assign the labels based on the type (e.g. a field of the alarm) of the incoming alarm or to solve the difference between alarms in another way?

[phanTom · Accepted solution]

@AliMaher if you can't create a different label at the creation and time the container in SOAR is created, then the next best approach would be to have a "Landing Playbook" that all the alerts come into and are then sent down the correct path. 

This can be done either by simply connecting the right playbook to the output of a decision, or you can switch the label on the container which will then call the associated active playbook(s) that are set to use that label. 

-- Happy SOARing! If this helped please leave some karma. If it resolved the issue please mark as a solution for others to see. --