Setting a pre-processing rule

YilmazDincer — Wed, 14 Jun 2023 08:26:39 GMT

Hi all,

In a list field, I want to go through all indexes one by one and if there is *malware* in all indexes(malware execution, malware alert, malware), I want to drop it. However, I could not edit this in the "Conditions for Incoming Incident" field.
For example, how can I do it, considering that we have "tag" field?
"tag Contains malware" like that.

tag data is ['malware execution','malware alert', 'malware'].

Re: Setting a pre-processing rule

gyldz — Wed, 14 Jun 2023 11:29:46 GMT

Hi @YilmazDincer ,

Is that field not mapped and available in incident fields? If so, you can use filters. If you cannot use an incident field, you can achieve this by using a pre-processing script as below. If the script returns False, the incident will be dropped. This script assumes that the list is saved as a string. If it is already a list, you can eliminate the split part. The field name for the tags is assumed tags. Feel free to edit the script according to your environment.

try: tags = demisto.incidents()[0]["CustomFields"]["tags"].split(",") for tag in tags: count = 0 if "malware" in tag: count+=1 if count > 0: demisto.results(False) else: demise.results(True) except: demise.results(True)

I hope my answer helps.

topic Re: Setting a pre-processing rule in Cortex XSOAR Discussions

Setting a pre-processing rule

Re: Setting a pre-processing rule