topic Re: XSOAR integration fetching incidents past the set time. in Cortex XSOAR Discussions

XSOAR integration fetching incidents past the set time.

AChhetri2 — Mon, 24 Jul 2023 10:46:55 GMT

We're only running one instance of the integration and we've set the first fetch timestamp to be 3 days.
When we run the integration, initially it only fetches incidents in the past three days and then after a while it starts fetching incidents as old as 3 years ago.

Has anyone observed this issue and if so, what could be the issue here?

Re: XSOAR integration fetching incidents past the set time.

bhmurali — Mon, 24 Jul 2023 18:17:01 GMT

Can you provide context regarding what integration this is? And any applicable query/filters that is part of the integration?

Re: XSOAR integration fetching incidents past the set time.

AChhetri2 — Tue, 25 Jul 2023 06:43:20 GMT

We're trying to add the integration of ThreatConnect (v3) into our environment. No changes were made to the yml file. We only added the 3 day limit to the fetch incident limit in the integration while setting it up.

Re: XSOAR integration fetching incidents past the set time.

bhmurali — Tue, 25 Jul 2023 14:51:39 GMT

I would recommend ensuring you are on the latest marketplace version of the content pack. Create a brand new instance and set the instance log level to debug mode (as in the screenshot attached) and also set the log level under settings -> about-> troubleshooting to debug. Try fetching again. If the issue persists, open a support case so that it can be looked at.