topic XDR and XSOAR mirroring fails in Cortex XDR Discussions

XDR and XSOAR mirroring fails

tlmarques — Tue, 31 Oct 2023 20:33:51 GMT

Hi, I have XDR integrated with XSOAR for bidirectional incident mirroring...

The strange thing is that when I close incidents in XSOAR as false positives, they appear as 'Resolved other' in XDR via the API...
If I close incidents as false positives in XDR through an automation rule, they remain open in XSOAR...

Does anyone know what this might be?
Has anyone encountered the same issue?

I've already opened a support case, but so far, there's been no response from the engineering team... They are investigating... and I wanted to know if anyone has experienced the same issue

Re: XDR and XSOAR mirroring fails

dbahuguna — Wed, 01 Nov 2023 10:39:33 GMT

Hi @tlmarques ,

Thank you for writing to live community.

We have observed that whenever an incident is closed in XDR it takes some time to reflect in XSOAR. This may be the reason the incident was still showing open in XSOAR.

Could you please confirm if the incident is still open in XSOAR?

Re: XDR and XSOAR mirroring fails

tlmarques — Fri, 17 Nov 2023 16:28:09 GMT

I opened a case with support, and they said it's normal. All XDR cases, even if closed in XDR, will appear as open in XSOAR because the playbooks will run. That's how it's defined by default.