Preprocess rule - link & run a script in the same rule

jakub_gawinkowski — Thu, 02 Feb 2023 10:59:05 GMT

Hi,

Is there a way to configure pre-process rule to link and run preprocess script? I have to link incidents with few identical fields and set some fields values using script. I thought to make preprocess script which will do both, but I ran into a problem. As I see during preprocess the incident doesn't have ID assigned yet, so I can't use command linkIncidents, because it requires ID of this incident.

Re: Preprocess rule - link & run a script in the same rule

asawyer — Wed, 08 Feb 2023 00:33:56 GMT

Hi @jakub_gawinkowski – The pre-process rule actions are one-or-the-other: you can either have the pre-process rule Link/Link and close or Run a script, but not both. Custom pre-process scripts give you a lot of flexibility, but they can also be more difficult to troubleshoot than a playbook. For your use case, the best approach may be to handle the needed actions within the playbook rather than in a pre-process script.

That being said, the only way I've found to get the incident linking behavior you're looking for within a pre-process script is to have the script actually create the incident, by running createNewIncident, in place of the incoming incident, because that way you can get the incident ID from the result of createNewIncident. I am attaching a proof-of-concept script that shows how this works for your reference. Please be sure to read the warning in the description carefully and test this out in dev first, because the script can send your server into an infinite loop if the pre-process rule is not filtered correctly.

topic Preprocess rule - link & run a script in the same rule in Cortex XSOAR Discussions

Preprocess rule - link & run a script in the same rule

Re: Preprocess rule - link & run a script in the same rule