Actions
Update Incident
Updates a Forcepoint DLP incident.
Parameters
| Parameter | Description |
|---|---|
| Action Type | The action to be performed on the incidents. |
| Action Value | Additional value per action type:- STATUS: One of NEW, INPROCESS, CLOSE, FALSEPOSITIVE, ESCALATED or a custom status. |
- SEVERITY: One of HIGH, MEDIUM or LOW.
- ASSIGN_TO: The admin name which will be assigned.
- TAG: The name of the tag (maximum 100 characters).
- FALSE_POSITIVE: either 1 (ignore) or 0 (include). | | Comment | A comment for the performed action. Supported only for the following action types:- ADD_COMMENT
- ASSIGN_TO
- TAG
- RELEASE (not supported for DISCOVERY incident type)
- FALSE_POSITIVE | | Incident ID | The ID of the incident to be updated. | | Incident Type | The incident type. |
Workflow Library Example
Update Incident with Forcepoint Dlp and Send Results Via Email
Preview this Workflow on desktop
Was this page helpful?