Getting data from multiple incident contexts?

Antanas — Thu, 16 Nov 2023 05:53:00 GMT

Hi!

I want to extract specific key data from context of multiple incidents. The context key I'm looking for is not under "incident". Specifically, I have many incidents of type "Phishing" and want to output the contents of "Recipient Selection.Answers.0" key from all of them.

I thought of using SearchIncidentsV2 but it does not seem to include specific context key.

Any suggestions on how to automatically get that data out?

Thanks,

Antanas

Re: Getting data from multiple incident contexts?

MBeauchamp2 — Thu, 16 Nov 2023 15:28:09 GMT

You can use the getContext method via a custom automation script to retrieve the context from a given Incident ID. Then you'll have to get the key you're looking for.

You'll need to know the ID of the incidents you want, because as you've said, context is not searchable. It would also not be very efficient to run the getContext across a large number of Incidents to "search" for the value, better to know the ones you're looking for.

For example, if you're playbook set a field that indicated that the user did indeed respond to the data collection task, then you could search for just those ones based on the field, and pass their IDs into the automation to loop through.

If you're not familiar with how to write automations, then check out video 15 here - https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-customer-success-engineering-training-video/ta-p/484604

topic Getting data from multiple incident contexts? in Cortex XSOAR Discussions

Getting data from multiple incident contexts?

Re: Getting data from multiple incident contexts?