In-Playbook Data Source Configuration

LAST UPDATED: JAN 7, 2024

At the beginning of every preprocessing playbook is a Data Source node.

The Data Source node defines the source of incoming data for the preprocessing playbook, which can originate from an integration or through a manual upload. Click on the button to open the data source creation pop-up window.

Fetch

Select the Fetch data intake option, then click on the Next button.
Locate an integration by using the search bar or scrolling through the list, then click on the Next button.
Select the site that will be allowed to use the integration connection, then click on the Next button.
Click on the connection field, then select a connection.

On-the-Fly Connection Setup

Click on the + Create Connection button.
Follow configuration instructions on D3’s integration documentation.

READER NOTE

Contact D3 to request an integration documentation for one that is not currently included.

Test the connection, then click on the + Add button.

Click on the Next button.
Input the integration-specific required Fetch Event command parameters, then click on the Next button.
Review the event source to ensure that all required fields for business needs are mapped, then click on the Review button.

Editing the Event Field Mapping

Click on the Edit button.
Modify the event field mapping as needed, within the popup.
1. Click on the Edit Event Source button to view and modify the main event JSON path.
2. Click on the + Add Event Source button to view and modify the event source name, search string and order priority.
3. Click on the + Add Field button to insert a new field, specifying its name, source field, source type, whether it should be displayed in an incident, and its artifact settings.

Review all entered information, then click on the Submit button.
Click on View All to see all submitted data sources.
Click on Edit to configure changes.

Manual Upload

Select the Manual Upload data intake option, then click on the Next button.
Select an integration, then click on the Next button.
Select a site, then click on the Next button.
Select a connection, then click on the Next button.
Enter JSON data, then click on the Next button.
Review the event source to ensure that all required fields for business needs are mapped, then click on the Review button.
Review all entered information, then click on the Submit button.
Click on the View All hyperlink on the Data Source node.
Click on Edit hyperlink to configure changes.