topic Put alerts of the same type in just a single one daily. in Cortex XSOAR Discussions

Put alerts of the same type in just a single one daily.

Josep — Wed, 01 Feb 2023 13:40:27 GMT

Hello,

I receive many alerts of the same type each day creating an incident for each.

I would like to put together all them in an incident and avoid creating incidents individually. So it will be solved just once.

Re: Put alerts of the same type in just a single one daily.

MBeauchamp2 — Wed, 01 Feb 2023 15:06:13 GMT

Sounds like you need a preprocessing rule or more likely a script. Checkout the training video on Preprocessing:

https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-customer-success-engineering-training-video/ta-p/484604

Alternatively you could use the Dedup - Generic v4 playbook as one of the first steps in the playbook, and have it search for an existing Incident and link & close the new one to that.

Re: Put alerts of the same type in just a single one daily.

Josep — Thu, 02 Feb 2023 07:16:31 GMT

Thanks for the reply,

Yes, a preproccessing rule which saves in a list the daily data with a daily job creating an incident with all the data.