Update case with output from Playbook

Yes there is - I couldn’t find a good example of it in the predefined Playbooks because they largely notify via email, but I think there might be one or two there too.

What you need is a sequence of a “Format” block and a “Case Item” block.

This is an example of a playbook that takes a trigger from a Mimecast log that contains a hash value among other things, sends that hash to Virustotal for analysis, and then updates a case with information from Mimecast (the log) and VirusTotal (how many engines found the hash/file malicious).

This is how the format block looks - it sets the variables to the values supplied via the trigger (i.e. the original Mimecast log), as well as the result from the Virustotal API action block (in the “engines” field), and substitutes them in the “Text”/Message field.

The output from the format block is then passed as a Case Item:

“Format_Results” is the “Action name” of the Format block, and “message” is the payload of the Format block, including all the variable substitutions.

In the end a case gets raised with information like this:

Obviously those steps should work similarly for anything else you might get returned by an API action block.