Hi there,
The PDF-file attached to the post provides detailed explanation of the security events management template. Do not copy/past the template from the file, it may not work. Download the template attached to this post. The templates are provided “as-is”, please check them in you Lab environment and modify for your needs before implementing them in production.
FS_RemediateOnEvent extensible attribute is required to trigger a policy on ForeScout side. WAPI credentials are required to update extensible attributes and retrieve “_ref” field.
Any feedback and/or questions are appreciated and very welcome.
BR,
Vadim Pavlov
