topic Re: Closing an incident on CortexXDR with pre-processing. in Cortex XSOAR Discussions

Closing an incident on CortexXDR with pre-processing.

YilmazDincer — Tue, 20 Jun 2023 09:22:02 GMT

Hi all,

I want to mark the Cortex XDR incident coming into XSOAR as TP or FP with preprocessing. Does preprocessing allow this (run a script)? Or does it only do drop processing?

Re: Closing an incident on CortexXDR with pre-processing.

gyldz — Tue, 20 Jun 2023 10:51:59 GMT

Hi @YilmazDincer ,

The script will only drop processing if it returns false. What do you mean by marking them?

Re: Closing an incident on CortexXDR with pre-processing.

YilmazDincer — Tue, 20 Jun 2023 10:59:06 GMT

Hi @gyldz ,

For example, there will be a condition and if it matches that condition, it will execute the command I show below. This command closes the incident in xdr (marked FP or TP)
pseudo code:

def condition(): "pseudo" if condition: demisto.executeCommand('xdr-update-incident', {'incidentid': x, 'status': 'TP'}) else: demisto.result(True) ## if it doesn't match, don't it. 'This code is pseudo'

Re: Closing an incident on CortexXDR with pre-processing.

gyldz — Tue, 20 Jun 2023 14:20:23 GMT

Hi,

You can do that. You do not have to return a False results. I tested the below one and it works fine. so you can change according to your needs.

try: result = "FP" if results == "FP": demisto.executeCommand("send-notification", {"channel" :"xsoar-implementation", "message" : "FP alert"}) else: demise.results(True) except: demise.results(True)