Create script to close XDR alerts from XSOAR.

Josep — Tue, 27 Sep 2022 16:23:51 GMT

Hello,

XSOAR and XDR are used with mirroring, when an incident is closed from XSOAR it's closed in XDR too. However, the alerts in XDR are not. So an script is needed in XSOAR to close those XDR alerts. How is this is script done? where should be set? How to sync all up?
Thanks

Re: Create script to close XDR alerts from XSOAR.

jfernandes1 — Wed, 28 Sep 2022 01:18:24 GMT

Hi @Josep,

The current XDR integration does not have a command to update alerts. I would suggest raising a Feature Request at https://xsoar.ideas.aha.io/ideas. You can also write the additional API call yourself if required, refer https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/incident-management/update-an-alert

Once you have the API call and the command added to the integration, you can configure a post-processing script to run when the XSOAR incident is closed. This script can be configured to close all related XDR alerts.

topic Re: Create script to close XDR alerts from XSOAR. in Cortex XSOAR Discussions

Create script to close XDR alerts from XSOAR.

Re: Create script to close XDR alerts from XSOAR.