topic Re: How to find incidents with a particular key present in context ? in Cortex XSOAR Discussions

How to find incidents with a particular key present in context ?

bhargav_11 — Wed, 18 Jan 2023 19:15:34 GMT

whenever there is an email thread involved in the incident, a field in the context is created as EmailThreads: [{email1 values}, {email 2 values}]

I want to find all the incidents which have this email thread involved.

Re: How to find incidents with a particular key present in context ?

amontminy — Wed, 18 Jan 2023 21:06:57 GMT

To find all incidents that have a value assigned to EmailThreads, you can use this filter:

-emailthreads:""

This shows all incidents where the EmailThreads fields is not empty. This relies on the machine name of the field so if it is not emailthreads you will need to adjust it. Hope this helps!

Re: How to find incidents with a particular key present in context ?

bhargav_11 — Thu, 19 Jan 2023 06:32:11 GMT

This is my context I have ExtractedFields as a dictionary with several values in it.

When i do -ExtractedFields: "" its not showing the incident.
@amontminy

Re: How to find incidents with a particular key present in context ?

amontminy — Thu, 19 Jan 2023 16:46:34 GMT

In that screenshot, ExtractedFields is in the context of the incident but is not being used as a field in the incident. Only incident fields are indexed and are filterable since the amount of data in context can be overwhelming. Only the subset of data under incident can be used to filter. In its current state you can't filter based on ExtractedFields, you would need to create it as an incident field first, then it would be filterable.

Re: How to find incidents with a particular key present in context ?

bhargav_11 — Thu, 19 Jan 2023 19:47:31 GMT

But its only getting created in the context and not in the incident.
There is already automation in place that created this in the context and if i create a custom field as well it won't create a duplicate entry in the incident right ?

@amontminy

Re: How to find incidents with a particular key present in context ?

amontminy — Thu, 19 Jan 2023 21:01:07 GMT

It would duplicate the item in context to an incident field. Which automation are you using?

Re: How to find incidents with a particular key present in context ?

chrking — Tue, 24 Jan 2023 07:05:24 GMT

You can use the mapping options in the task configuration in the playbook editor or a separate setIncident task to write the data to a custom field on the incident.

Re: How to find incidents with a particular key present in context ?

SanDev — Fri, 27 Jan 2023 22:47:35 GMT

The one in incident context subset will be called "incident.ExtractedFields" in case you want to keep the original name.