topic Re: Why is the severity became "unknown"? in Cortex XSOAR Discussions

Why is the severity became "unknown"?

awarman — Mon, 13 Nov 2023 07:18:57 GMT

Hello All,

I have a question, i have mapped an incident from qradar with the playbook i've created.

At first it's worked, the incident severity was "high". but later until now, the severity become "unknown".

What is the main cause of this issue?

Thank You

Re: Why is the severity became "unknown"?

MBeauchamp2 — Thu, 16 Nov 2023 15:47:42 GMT

Do you have the Calculate Severity sub-playbook or something similiar in your playbook? You can search the war room to find the task that is setting the severity to unknown and go from there.

Re: Why is the severity became "unknown"?

MBeauchamp2 — Thu, 16 Nov 2023 15:48:08 GMT

Alternatively check your mapper? Maybe the data from qradar changed or something?