topic How are Context Variables Maintained when Upgrading to 3.2 ? in Cortex XSIAM Discussions

How are Context Variables Maintained when Upgrading to 3.2 ?

michaelsysec242 — Sun, 19 Oct 2025 12:52:29 GMT

Hello Live Comm,

I am currently working on XSIAM 2.7 and I want to know what happens to context variables when upgrading the platform to 3.2.

2.7 has the incident and alert convention for variables such as alert.id or alert.hostname. If we have used these variables in a playbook or an automation what happens when the convention becomes issues and cases ? I can see that on the 3.2 version the variables become issue.id or parentIncidentFields.hostname. Does this mean that in order to upgrade smoothly we will need to review and rework all our playbooks and automations?

many thanks,

MSysec

Re: How are Context Variables Maintained when Upgrading to 3.2 ?

PA_nts — Mon, 20 Oct 2025 09:34:39 GMT

Interesting question.. we have playbooks developed in 2.7 with alert and incident fields.. and have migrated these to clients running 3.2 without any issue where they still reference ${alert.xxxx} and ${incident.xxxx).

From what I can see, in v3.2 it is still able to pull data ie ${alert.name} even though the context data shows ${issue.name} - so i think it does an auto rename in the backend - will check and confirm with our PAN SME this week when i meet with them.

but not sure how long this will be for.. so probably not a bad idea to amend playbooks to change alert > issue and incidents > cases

not sure why PAN decided to rename these in 3.x :- (