Hello, I'm new to Splunk Enterprise Security and I'm building a flow where a finding triggers a playbook that simply starts an investigation. Once the investigation is created, I'd like another playbook to run automatically inside it, with no analyst interaction. As far as I can tell, Response Plans have to be run manually by an analyst, so they don't cover this case. Is there a way to trigger a playbook automatically when an investigation starts? For example, can I chain it from the first playbook, use an investigation event or trigger, or configure something similar? Any guidance or examples would be appreciated. Thanks in advance!
... View more