Dynamic Instances for same Environment

[ORBR]

Is there a way to automate it when there are multiple instances in one Environment? 

For example, 3 tenants with different AAD integrations. is there a way to automate the identification of the relevant instance? right now I`m creating a separate branch for each instance with the "Specify instance name"

[f3rz]

Hi @ORBR you can try to use Block with input (Instance name) to unify and replace part of playbook with separate branches (if the logic inside each branch is the same one), and instead of having 3 branches in a playbook you will have single block that will only require input based on your criteria (defined in playbook). 

https://cloud.google.com/chronicle/docs/soar/respond/working-with-playbooks/working-with-playbook-bl...

If you want some more extended logic you can open a Support Case to file a Feature Request.

[ORBR]

Hi @f3rz , Thank you, I will try to use Block instead.

But, how can I define the Instance name in the input?

Now I`m doing it with a playbook condition - if alert name starts with "X" (tenant name) than use the X branch.

[f3rz]

@ORBR I've made it work like this:

I have 2 integration instances in Shared instances AM_1 and MA_1 and block that I'm feeding with integration instance input and I've created a manual alert that starts with AM.

In a Playbook I use:
1. Action from Functions power-up (String Functions) to get first 2 characters from Alert Name knowing that it is a part of my Integration Instance name:

2. I'm calling block with input:

and inputting the next value: Shared_[Functions_String Functions_1.ScriptResult]_1
where:
Shared_ is Shared Instances (in case of environment it can be placeholder [Environment.Name])
[Functions...] is my first 2 symbols from alert name AM or MA
_1 is num of integration instance.

And here how it works:

Case Comment result:

[ORBR]

You are very helpful!

One last issue - I created the playbook and block as described. the strings function indeed works!

But when I use the input placeholder it says the following error: Message: The chosen fallback integration instance is missing / invalid in the request.

when manually writing the instance name this would work, but not when using the exact placholder.

I also tried it with the environment name, but still got an error.

[f3rz]

Hi @ORBR it is because you need to select Fallback Instance parameter, otherwise it will return "Message: The chosen fallback integration instance is missing / invalid in the request.". 

Fallback instance will be used in case if your input won't be valid.