topic Multiple Instances fetching VS. One instance and then claasify and post a new incident in Cortex XSOAR Discussions

Multiple Instances fetching VS. One instance and then claasify and post a new incident

foteromartinez — Mon, 13 Nov 2023 16:05:56 GMT

Hi,

We've got an scenario where we are fetching mails from a mail server. When an email is received in the mail server, it applies some ruling and send it to a folder, then with XSOAR we've got N instances, one per folder and this is how we are classifying incidents and Use Cases.

While there we few folders, it seemed to be the right choice. But recently we've been growing on folders and thus on instances so we've been discussing which would be the approach.

Should we keep creating instances, one per folder? Oi isntead create one mail fetcher and the make the classification in XSOAR?

BR,

Fernando Otero

#aws #fetching

Re: Multiple Instances fetching VS. One instance and then claasify and post a new incident

MBeauchamp2 — Thu, 16 Nov 2023 15:46:24 GMT

Most of the email fetching integrations, for example this one for EWS (https://xsoar.pan.dev/docs/reference/integrations/ewso365) require the folder that you want to fetch from.

So in your case, you're doing it the right way where you have multiple instances, each pointing at their own folder.

If you were using gmail (https://xsoar.pan.dev/docs/reference/integrations/gmail#configure-gmail-in-cortex-xsoar), then it uses a query instead of folders, so classification may apply there.

Re: Multiple Instances fetching VS. One instance and then claasify and post a new incident

foteromartinez — Fri, 17 Nov 2023 09:09:40 GMT

Hi!

First of all thanks a lot for your response! Is it the right choice even if we have more than 20 folders? Isn't it a bit high in computer usage?

BR!

Re: Multiple Instances fetching VS. One instance and then claasify and post a new incident

MBeauchamp2 — Fri, 17 Nov 2023 15:28:55 GMT

Well it's the same amount of emails being fetched regardless right? As I said depending on your integration, it might be the only way to do it.

Also consider the opportunity to streamline your folders on the other side if possible.

Re: Multiple Instances fetching VS. One instance and then claasify and post a new incident

gyldz — Mon, 20 Nov 2023 10:14:13 GMT

Hi @foteromartinez ,

I also want to add that depending on the integration and logic you apply while moving emails to different folders, you can also move the items to different folders using XSOAR. For example, EWS integration has the below command where you can use in a playbook. In this way, you would have less number of integration to maintain.

ews-move-item: Move an item to different folder in the mailbox.

ews-move-item-between-mailboxes: Moves an item from one mailbox to different mailbox.