Got the response from another user in the group i.e below
I have a client who has TrendMicro integrated, but the flow is TrendMicro->QRadar SIEM->SOAR.When creating the incident in SOAR, we have the Workbench ID - WB-xxx-xxxx. Then we have a playbook, which enriches the incident with data from the workbench, via REST API functions.