asp-case-zh

You can automate ASP case management using an MCP server integration to list, review, and update security incidents. The workflow supports filtering cases by status, severity, or verdict, and viewing related alerts and playbook runs.

Review a specific security case by inputting the case ID to retrieve related alerts, playbook runs, and discussion threads. This centralizes triage information for security incident analysis and collaborative tracking.

Yes, an MCP server integration is required to execute ASP case-based operations. The MCP server enables listing cases, updating workflows, viewing discussions, and executing playbooks for SOC triage.

Yes, you can filter security cases by status, severity, or verdict during triage. This filtering capability helps SOC analysts prioritize incidents and focus on high-risk security events requiring immediate review.

Update AI analysis fields and enrichment data on a case using the update_case operation. This allows you to write structured analysis back to the case, driving subsequent automated workflows and investigations.

The best way to execute playbooks during incident triage is through the execute_playbook operation integrated within ASP case management. This automates response actions and links playbook runs directly to the active case.