As USM Anywhere surfaces events, alarms, and vulnerabilities, your team determines which items require the opening of a new Salesforce case. Rather than manually opening each case in the Salesforce user interface (UI) and entering the relevant alarm, event, or vulnerability information, you can use the AlienApp for Salesforce response actions to automatically create a Salesforce case with the short description and description fields pre-populated with content from your USM Anywhere environment. The following table lists the available actions from the AlienApp.
Create a Salesforce Case
Run this action to generate a new Salesforce case from an alarm, event, response action, or vulnerability.
Upon execution of a response action, USM Anywhere generates the Salesforce case and passes the associated information to that new incident case.
Note: Before launching a Salesforce response action or creating a Salesforce response action rule, the AlienApp for Salesforce must be enabled and connected to your Salesforce instance. See Configuring the AlienApp for Salesforce for more information.
To view information about these actions in USM Anywhere
- In USM Anywhere, go to Data Sources > AlienApps.
- Click the Available Apps tab.
- Search for the AlienApp, and then click the tile.
- Click the Actions tab to display information for the supported actions.
- Click the History tab to display information about the executed orchestration actions.
Launch Actions from Alarms
You can launch an action directly from alarms, events, or vulnerabilities. If you want to apply an action to similar events that occur in the future, you can also create orchestration rules directly from the action applied to an alarm, event, or vulnerability.
To launch a Salesforce response action for an alarm, event, or vulnerability
- Go to Activity > Alarms, Activity > Events, or Environment > Vulnerabilities.
- Click the alarm, event, or vulnerability to open the details.
- Click Select Action.
In the Select Action dialog box, select Run Salesforce Action.
Modify the information for the new incident for the following fields:
- Type of Request
- Case Reason
- Case Subject
- Case Priority
- Case Status
After USM Anywhere initiates the action for an alarm or event, it displays a confirmation dialog box.
If you want to create a rule to apply the action to similar items that occur in the future, click Create rule for similar alarms or Create rule for similar events and define the new rule. If not, click OK.