You can execute the SOAR playbooks from Trellix ESM and view the executed playbook details in Trellix Security Orchestrator and respond to the incidents.
Make sure the Device Actions privilege is enabled from System Properties.
From the Trellix ESM dashboard, click
.png "menu.png")
and select More Settings.Select → , then select an event.
Click
.png "GUID-90CC508D-C258-41AB-9D9C-4E1D7DE5FBCB-low.png")
and select → ..png "GUID-766500D6-07FE-4F3F-B513-8A5E5DDBE4E7-low.png")
Select Prepare Playbook and click Execute.
In the SOAR Response pop-up window, click SOAR Response.
The SOAR playbook is executed successfully.