Detailed Explanation of Recovery Workflows
Both workflows are available as On-Demand workflows, but they can also be Scheduled to fully automate the recovery process.
This Workflow enriches observables that have not been enriched before. It does not re-enrich observables that are already enriched.
This workflow attempts to reprocess alerts that were not fully processed, such as those affected by missing or incorrect templates. It is intended to be used as a recovery step if alert processing fails or after a missing or broken template has been added.