Incident classification considering multiple fields

OZamir — Sun, 07 Feb 2021 12:31:32 GMT

How can I classify an incident while taking multiple fields into consideration?

Let's say I have a list of numbers. Whenever an incident is registered I would like to check whether the value of Field A is in that list, if Yes, then classify by Field A, if Not then classify by other Field B.

Re: Incident classification considering multiple fields

gfilippov — Tue, 15 Jun 2021 08:59:32 GMT

Hi,
By design the classification is done by a single field,
please submit a feature request for it.
As a workaround you can create a new transformer script that gets the whole incoming incident json as an input and takes into consideration any fields you want, then returns the desired incident type based on the script logic, that will be mapped to the right incident type in the classification wizard,
thanks.

topic Re: Incident classification considering multiple fields in Cortex XSOAR Discussions

Incident classification considering multiple fields

Re: Incident classification considering multiple fields