topic Re: How to prevent incidents from creating from every alerts in Integration in Cortex XSOAR Discussions

How to prevent incidents from creating from every alerts in Integration

pottapitot — Sat, 12 Nov 2022 14:56:39 GMT

Hi All,

I configured an MSSP integration which polls the same for alerts created on that platform and creates an incident out of them if present.

The thing is I want to create an incident for one type of alert (it has a keyword category). For the other alerts, I do not wish to create an incident on the XSOAR platform. How can I do the same or drop them?

Re: How to prevent incidents from creating from every alerts in Integration

chrking — Mon, 14 Nov 2022 02:35:04 GMT

Some integrations have options to filter which alerts/events to create incidents from, so I'd check your integration configuration settings if you haven't already.

Failing that, you could set up a pre-processing rule to drop them on the Settings > Integrations > Pre-process Rules page.