topic Custom Data Storage in Cortex XSOAR Discussions

Custom Data Storage

NicolasTHOMAS — Tue, 25 Jul 2023 11:48:19 GMT

Hello,

Is there a way to store custom Data elsewhere than in incidents ? I suceeded in "Lists" but it appears than maximum list size is 209715 characters ==> https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.9/Cortex-XSOAR-Administrator-Guide/Lists

Does XSoar has a functionnality like Data Tables, or whatever wich could allow us to store any kind of custom data, outside of incidents ?

Many thanks in advance for your reply and Best Regards,
Thomas Nicolas

Re: Custom Data Storage

bhmurali — Tue, 25 Jul 2023 14:59:22 GMT

I am not sure I understand the reasoning behind the ask. Incident data if stored in incident fields are searchable by default. You can always generate reporting and other metrics based off those if the goal is reporting.

If you are looking to host indicator data, you have EDL as an option (look at generic export indicators service integration).

Just for storing generic white list stuff, lists is the option.

You can also store some long generic data or lookup table for stuff like inventory management, you can use other sources like Servicenow for example and query to fetch a specific record. It is hard to make a recommendation without knowing what you mean by "custom data" and what is it that you are trying to achieve.

Re: Custom Data Storage

NicolasTHOMAS — Tue, 25 Jul 2023 15:13:48 GMT

Hello,

Many thanks for your reply, Data I am trying to store into Xsoar, is reporting Data. I retrieve specific JSON for which I would like to share via Widget menu... It can be number of Endpoint available, Specific EDR Version...and so many more examples...

Let's say I want to store very specific custom data, I am just wondering if I would be able to store it elsewhere than incidents data, or "Lists".. Actually I am wondering if I could use Global Context Data to store any data, cause I do not want to use incident for that reporting data...

Regards,
Thomas Nicolas

Re: Custom Data Storage

bhmurali — Wed, 26 Jul 2023 02:30:25 GMT

Hi,

For global context, lists is the option in XSOAR. However for the examples you outlined, many of those can be done in widgets by using incident fields already and that’s a much more efficient way of doing it without having to create redundant data.

For example, if you want to generate widget based on incidents created by certain endpoints, version of EDRs etc, if you have those mapped to an incident field, you can simply do a query to fetch those incidents like type:”Endpoint alerts” and in the operations tab of widget builder, group by and choose the fields you want to group those by (endpoint hostname, edr version etc).

Re: Custom Data Storage

NicolasTHOMAS — Wed, 26 Jul 2023 07:31:45 GMT

Many Thanks for your reply and Kind Regards