topic Re: Playbook Creates Incidents from Table. in Cortex XSOAR Discussions

Playbook Creates Incidents from Table.

king_penson — Mon, 24 Oct 2022 15:39:00 GMT

I'm trying to create incidents from a SIEM integration. The integration allows me to list alerts and I'm trying to create an incident for each one. When I run the playbook, the list alerts command returned multiple entries, but the create incident task is only creating 2 incidents opposed to 10 alerts.

I want to ensure that we're generating an incident for every SIEM alert.

Re: Playbook Creates Incidents from Table.

jfernandes1 — Mon, 24 Oct 2022 23:26:39 GMT

Hi @king_penson, What SIEM integration are using? Most if not all our SIEM integration can be configured to fetch incidents. The example below is from Splunk.

If you have the list of incidents inside the context, could provide screenshot as an example. Also, a screehshot of playbook task would help.

Re: Playbook Creates Incidents from Table.

king_penson — Mon, 31 Oct 2022 21:09:14 GMT

Hello, sorry for late response. I was able to figure it out. The Securonix integration has a command that fetches a list of violations aka alerts, which are different from incidents.

I was able to create a script to pull that data and format them into xsoar incidents. This might be a thing worth adding to the integration considering some customers want to look at each violation separately.

Re: Playbook Creates Incidents from Table.

jfernandes1 — Tue, 01 Nov 2022 00:40:38 GMT

Hi @king_penson, the Securonix integration is developed and managed by the vendor. Please contact support@securonix.com.

Re: Playbook Creates Incidents from Table.

king_penson — Tue, 01 Nov 2022 15:15:59 GMT

Will do, thank you!