hey everyone chris walker your security doctor back again for another valuable sec byte session now in the previous video i demonstrated how easy it was to create a security tag group with a very basic security tag that enforced a policy to hide a specific security incident record now i showed you how to manually do that now what if we could automatically generate that security tag and apply it to the specific security incident record in question based on an assignment group pretty simple and i'm going to show you how we can do that right now all right so we are in the flow designer this is where we can make all the automation magic happen so i've gone ahead and already created the security tag workflow i'm going to go ahead and now select our trigger so the trigger we're going to be selecting here is the created or updated for the record and of course now we need to select the table in question we're going to be using the security incident table now if you're not aware of the specific one all you really need to do is just type in security incidents and you'll see right there our snsi incident this is the security incident table that we're going to be leveraging now as i mentioned before i want this to be triggered based on the assignment group and the assignment group is going to be vulnerability response so anytime it changes to vulnerability response i want to apply that specific security tag so let's go ahead and add that specific condition pretty simple we're going to go ahead and select the assignment group my operator is going to be changes 2 and then we're going to select the vulnerability response assignment group now for my run trigger i want this to happen for every update and just like that the trigger is done now i want the action to be executed so when this happens now this action is going to be taken now as i mentioned before out of the box functionality is everything it's such a time saver so let's save time let's go ahead and select our security incident response security tag default function so as we can see here we now have the capability to select our security incident record and the security tag now you'll notice when i drop this down it populates all the different security incident records but i want this to be applied for all security incident records that have been created or updated not just a specific one so what do i do i navigate over here to my handy dandy data pill security incident record and i drag and drop that here within the field next i'm going to select my security tag for this i want to select the crowdstrike falcon submission initiated so now when the condition is met and it's been assigned to the vulnerability response group it is going to automatically tag this as crowdstrike falcon submission initiated and just like that from frustration to automation celebration we're done now let's see it in real time how fast this is going to happen when we change an existing incident record from one's assignment group to the vulnerability response group so now we're going to go ahead and activate this which will save the flow and then we're going to go into our security incident record and test it so here we have our security incident record it's already up we can see the assignment group is security incident response team i'm going to go ahead and remove the assigned two and the assignment group and we're going to go ahead and type in vulnerability response and of course we're going to save this record now my flow is going to automatically execute and because the condition has been met we're going to see the security tag has now been applied for crowdstrike falcon submission initiated just like that so now we're saving more time because we've automated another mundane task that creates fatigue and frustration so using the automation components right out of the box you're able to save so much time and streamline your security policies and controls within your security incident records by leveraging the flow designer thank you so much for watching again please like and subscribe this video more content coming to you and as always stay safe