Test sample in the playbook

Antanas — Wed, 28 Dec 2022 05:36:26 GMT

Hi,

Is it possible to influence the sample data that is shown in playbook edit mode, when using Test to validate the data in any task? I find that in some playbooks it can give me to select the latest incident of that type, but on others - it only allows the incident data that was created e.g. 6 months ago at best for that incident type. Even though it is one of the most noisy incident types and we have it many through the day. Maybe we can clear up the suggestion database so it wouldn't propose really old incidents?

Alternatively, can I somehow manually export the full context of selected incident and paste the exact copy in test mode?

Thanks

Re: Test sample in the playbook

yuki_sato — Tue, 03 Jan 2023 21:25:52 GMT

Hi @Antanas

Only incidents that you have interacted with will show up during playbook edit mode.

In order to interact with an incident, you need to be the one who created, or have been assigned or mentioned by @[username] command.

Also, incidents cannot be in pending or deleted.

topic Test sample in the playbook in Cortex XSOAR Discussions

Test sample in the playbook

Re: Test sample in the playbook