topic Re: How to mirror XSOAR severity incident field with an integrations severity in Cortex XSOAR Discussions

How to mirror XSOAR severity incident field with an integrations severity

king_penson — Fri, 19 Aug 2022 18:21:28 GMT

What is the best path to change XSOARs incident severity to match the severity another tool is pulling in?

Ex. PhishER (KnowBe4) has it's own severity field called "PhishER" Severity, I want XSOAR's severity to mirror the incoming PhisihER severity

Re: How to mirror XSOAR severity incident field with an integrations severity

asawyer — Tue, 23 Aug 2022 20:33:05 GMT

Hi @king_penson – The best way to set incident severity in this case would be to add it to the incoming mapper, so the severity field gets set for incoming incidents as they are ingested by the PhishER integration.

XSOAR support using either a (case-insensitive) string or corresponding integer to set the severity of an incident. The supported Severity values are:

Unknown (0)
Informational (0.5)
Low (1)
Medium (2)
High (3)
Critical (4)

If this corresponds with the severity values PhishER uses, you can map the PhishER severity with no modifications. If not, you may need to use transformers such as Replace to change the PhishER severity to an XSOAR-compatible value for the mapper. Please give that a try and let us know if you run into any issues.

Re: How to mirror XSOAR severity incident field with an integrations severity

king_penson — Wed, 24 Aug 2022 15:54:52 GMT

It was as easy as just mapping it, I was definitely overthinking it. Thank you!

Re: How to mirror XSOAR severity incident field with an integrations severity

ArthurCircus — Wed, 25 Jan 2023 09:36:06 GMT

@king_penson what field did you map this data to?

I am trying to configure the elasticsearch incoming mapper to set the Incident Severity but it does not work.

Re: How to mirror XSOAR severity incident field with an integrations severity

king_penson — Tue, 07 Feb 2023 15:43:02 GMT

What data type is the data coming in as? (Integer, string)