topic Re: integration mirroring vs post processing script mirroring in Cortex XSOAR Discussions

integration mirroring vs post processing script mirroring

EnesOzdemir — Mon, 06 Feb 2023 10:07:14 GMT

Our current setup mirrors incidents by post processing scripts. Bulk incident close makes too much noise in the system. It creates a container for each incident at the same time. It can overload the system from time to time. How does mirroring in the integration work? Does it mirror incidents one by one without creating a container for each?

Re: integration mirroring vs post processing script mirroring

jfernandes1 — Wed, 08 Feb 2023 01:35:38 GMT

Hi @EnesOzdemir, sounds like the post-processing script is not working properly. You might want to have a CSE review your script and make recommendation. Also do not use sleep commands inside post-processing scripts.

Integration incident mirroring is done at an interval for all objects in the queue. The queue could contains multiple incidents for mirroring across different integrations.

Re: integration mirroring vs post processing script mirroring

EnesOzdemir — Wed, 08 Feb 2023 11:08:53 GMT

My post processing script is simple .

https://gist.github.com/ennozdd/ff1d2c728858b7b0b38e4b7e313cea67

I implemented mirroring for the integration and tried closing 300 incidents at once. The process was so smooth. I think mirroring has a much lighter load on the system.

I also raised a case for the container problem

Case 02338961

XSUP-17893