topic Re: How can I surely say that incident is changed from Pending state to Active state during outgoing mirroring? in Cortex XSOAR Discussions

How can I surely say that incident is changed from Pending state to Active state during outgoing mirroring?

Harsh-Panchal — Tue, 31 Jan 2023 11:25:39 GMT

When we change the incident from Active state to Close state, we get "closeReason", "closingUserId", and "closeNotes" in the delta of "UpdateRemoteSystemArgs". But when the incident is changed from Pending state to Active state, we do not get anything in delta, and due to which I am not able to determine whether something else has changed or the Incident state has been changed from Pending to Active.

Because, updating the remote system by checking if the incident status equals to IncidentStatus.ACTIVE, will result in marking it again and again every time something will change in this incident after it was changed to Active, which is not the wanted behaviour.

Re: How can I surely say that incident is changed from Pending state to Active state during outgoing mirroring?

amontminy — Fri, 28 Apr 2023 21:37:50 GMT

You may be able to create a field change script on the status field that generates a change that will then be mirrored in Jira. That way, when the status goes from Pending to Active, there is a record of it in Jira.

Another option could be to add a task to the beginning of the playbook for that incident type that makes the update or prints a comment to the war room that the mirroring integration would pick up as well. The playbook will only start once the incident moves from Pending to Active as long as you leave the Run playbook automatically box unchecked for that incident type.