Hi everyone! 👋 First post here, so please bear with me if this is a basic question.
We're evaluating Trend Micro Vision One for our SOC, and I'm really impressed by the XDR features so far. One thing our team keeps bringing up is how to better connect it to our existing workflows. Right now, when Vision One flags a serious incident, someone has to manually create a ticket in Jira Service Desk so the right IT support group gets notified and can track it.
I know automation is a big selling point for these platforms, but I'm a bit lost on where to start. We don't have a dedicated security automation person, so I'm hoping to set up something straightforward.
Could anyone share how they've set up automatic Jira ticket creation from Vision One incidents? I'm especially curious about:
- Is this done directly within Vision One, or do you use a middleman like Zapier/Make?
- What kind of info do you map over from the incident to the Jira ticket (summary, description, severity)?
- Are there any common pitfalls or things that didn't work as expected?
Any examples or pointers to documentation would be incredibly helpful. Thanks in advance for sharing your knowledge!