topic Re: SearchIncidentsV2 not returning results in Cortex XSOAR Discussions

SearchIncidentsV2 not returning results

MMagdic — Tue, 18 Jul 2023 09:00:22 GMT

Hi, I am using SearchIncidentsV2 automation to loop through 2 IP addresses previously saved to IP incident key, to see if these IPs are showing in FireEye NX alerts. When I try to loop I receive empty foundIncidents key:

When I hardcode the IP addresses everything works as it should.
What I am missing?

Re: SearchIncidentsV2 not returning results

gyldz — Tue, 18 Jul 2023 09:20:27 GMT

Hi @MMagdic ,

Do you see any results when you use the same query in the incidents page search box?

Re: SearchIncidentsV2 not returning results

MMagdic — Tue, 18 Jul 2023 09:32:12 GMT

Yes, of course with hardcoded IP values.

Re: SearchIncidentsV2 not returning results

gyldz — Tue, 18 Jul 2023 09:40:07 GMT

But when I check your query, the IP is the same for the victim and target which does not sound right. Could you please copy and paste the same query in incidents search box to see if there is any alerts.

Re: SearchIncidentsV2 not returning results

MMagdic — Tue, 18 Jul 2023 12:36:01 GMT

Yes, the reason to have both (victim and target) is because sometimes FireEye NX is parsing incident fields not correctly, putting external (attacker IP) in target ip. But the query is working:

So the question is how to loop through a couple of IP addresses, e.g. at least 2 IP addresses in SearchIncidentsV2 automation using query as a filter.

Re: SearchIncidentsV2 not returning results

MMagdic — Tue, 18 Jul 2023 12:42:39 GMT

See here results when I try with 2 IP addresses:

Re: SearchIncidentsV2 not returning results

gyldz — Tue, 18 Jul 2023 13:01:48 GMT

Hi again, you need to use join transformer for that task. Before searching the incidents Set another field as below and then use it in the search incidents task.

Re: SearchIncidentsV2 not returning results

MMagdic — Tue, 18 Jul 2023 13:41:46 GMT

Thanks, but this should work only by adding space before&after "or" to " or " (in Join Transformer) as in cli:

!SearchIncidentsV2 query="type:FireEye NX Alert and fireeyenxalertvictimip:11.11.11.11 or 134.122.90.162"

Re: SearchIncidentsV2 not returning results

gyldz — Tue, 18 Jul 2023 14:15:46 GMT

Yes there was a space in the screenshot I shared 🙂