topic Incident creation not working good at the moment in Cortex XDR Discussions

Incident creation not working good at the moment

Cyber1985 — Fri, 27 May 2022 22:19:24 GMT

Hello dear Cortex XDR Community,

I tested today some incident creations. In summary I can say, from about 10 executions, 3 Incidents were created under severity high.

Under severity critical none.

This is my BIOC:

No of alerts

Exections when I execute the BIOC manually :

How can this be?

I can reproduce it.

There is no incident creation.

What am I doing wrong?

Rob

Re: Incident creation not working good at the moment

Cyber1985 — Fri, 27 May 2022 22:21:54 GMT

Here the information about the agent version and content version

Re: Incident creation not working good at the moment

Fowler69 — Sat, 28 May 2022 12:10:59 GMT

01 Sys_trigger job "Event Management - Evaluate Alert Manage" is stuck
Find the sys_trigger job:
/sys_trigger_list.do?sysparm_query=nameSTARTSWITHEvent%20Management%20-%20Evaluate%20Alert%20Manage&sysparm_view=
Add columns "Claimed by" and "System ID"
Get thread dumps from the running job
Review node logs to look for reasons that the job could be stuck and provide resolution