topic Re: Storing Incident Notes in Context Data in Cortex XSOAR Discussions

Storing Incident Notes in Context Data

michaelsysec242 — Tue, 12 Dec 2023 15:25:10 GMT

Hello all,

I am working on a use-case in which I need to store text based comments (Including MD) to context data for report generation. I have tried to create a script for this yet I have not succeeded. Is there a way to access the comment section in order to pull comments dynamically ?

Re: Storing Incident Notes in Context Data

AbelSantamarina — Tue, 12 Dec 2023 16:40:19 GMT

@michaelsysec242,

To get a specific comment from your incident you can use the built-in automation commentsToContext which takes as arguments the entryId of the comment and contextKey, which defines where to store the result in context. This works for individual comments, but not for all the comments in your investigation.

To pull all the comments from your investigation, you can use in your automation the built-in command getEntries to get all the entries in your war-room in combination with a category filter for chat entries (see the documentation here.)

res = execute_command("getEntries", {"filter": {"categories": ["chats"]}})

Once you have all your chat entries (comments), you can save them to context and/or output them as a table.
Find below a simple script to get all the comments and save them to your context data.

Re: Storing Incident Notes in Context Data

michaelsysec242 — Wed, 13 Dec 2023 09:18:12 GMT

@AbelSantamarina ,

thanks this works very well.

Cheers!