Custom Fetch Incidents

MMagdic — Fri, 28 Jul 2023 07:14:05 GMT

Hi, I want to use Exabeam integration in XSOAR but not to fetch incidents (incident responder) as it is currently set in fetch-incidents command, that is in fetch_incidents function.

The plan would be to fetch with get-notable-users command, which produces this result (context-data), when using '!exabeam-get-notable-users time_period="1 month" limit="1"(Exabeam)' in CLI:

RiskScore:null
HighestRiskSession:{} 17 items
numOfAssets:11
riskScore:188
numOfAccounts:1
accounts:[] 1 item
0:someusername
zones:[] 4 items
0:servers_0
1:servers_1
3:servers_2
endTime:1688539545557
numOfZones:4
startTime:1688453145557
loginHost:somehost
sessionId:someusername-20230704064545
numOfReasons:46
label:
username:someusername
numOfSecurityEvents:0
numOfEvents:23583
riskTransferScore:39.370000000000005
initialRiskScore:12
UserFullName:Some Username
LastActivity:Account is active
EmployeeType:null
FirstSeen:2023-03-01T13:33:53.253000

Now, the plan is to use get-notable-users to create incidents in xsoar, then create custom classifier, etc..

Is there any tutorial explaining this case?

Attached is Exabeam original integration Python file.

Re: Custom Fetch Incidents

bhmurali — Fri, 28 Jul 2023 12:51:08 GMT

Hi,

Please refer to the developer docs or use other existing integrations for example.

https://xsoar.pan.dev/docs/integrations/fetching-incidents

topic Custom Fetch Incidents in Cortex XSOAR Discussions

Custom Fetch Incidents

Re: Custom Fetch Incidents