topic Re: update-remote-system command not getting triggered in Cortex XSOAR Discussions

update-remote-system command not getting triggered

Harsh-Panchal — Wed, 25 Jan 2023 11:13:05 GMT

Is it necessary to add a tag to the entry or comment in XSOAR to get it mirrored on remote incident?

Suppose, I do not add a tag to a note/war room entry, then do I get that entry in the "UpdateRemoteSystemArgs"?

Currently, I am not getting that entry in the "UpdateRemoteSystemArgs". Is it so that I have done something wrong in configuration.

Re: update-remote-system command not getting triggered

amontminy — Wed, 25 Jan 2023 20:28:36 GMT

When configuring the integration instance, there should be a few fields relating to tags that are required to mirror the data between instances. If the integration instance is set up correctly with the required tags, then you will need to apply those tags to the data you are trying to mirror.

Re: update-remote-system command not getting triggered

Harsh-Panchal — Thu, 26 Jan 2023 04:17:20 GMT

So, without the tags, it is impossible to mirror the notes/entries to the
remote system. Is that you're trying to say, right?

Adding the tags to the entries/notes would be a manual task. An SOC Analyst
has to carefully add those tags to the entries he/she wants to mirror to
the remote incident. Isn't there any other way I can get the entries/notes
added to the incident in the UpdateRemoteSystemArgs parameter when the
update-remote-system command is called, so that I can mirror those entries
to the remote system without the intervention of the SOC Analyst adding
those tags to the entries?