Drop and Update but NOT Create (Pre-Processing)

AFamera — Wed, 01 Nov 2023 23:52:19 GMT

Hi,

I am trying to write some preprocessing rules to report on and update BitSight incidents. I only want to create incidents that have a grade of 'BAD' or 'WARN'. I do want to capture, however, when a given incident's grade is updated within BitSight to 'GOOD', because that will let me know the issue is resolved. I wrote my pre-processing rules in the following order:

1. Drop and Update incidents with the same rolled up id

2. Drop incidents that do not affect the BitSight rating

3. Drop incidents that are not BAD/WARN

My thought process was that, if an incident already exists in Xsoar, and it's grade is updated in BitSight, I want to capture the new grade in the Xsoar incident when the integration fetches it. If it does not exits Xsoar, then I only want to create incidents that affect our score and have a poor grade. The "Drop and Update" function, however, will create an incident if the criteria is not met (unlike the "Drop" function, which just skips to the next rule). Is there a way to do a "Drop and Update" in the pre-processing step without having it create an incident if the criteria isn't met?

Thank you!

Re: Drop and Update but NOT Create (Pre-Processing)

AbelSantamarina — Wed, 13 Dec 2023 17:45:18 GMT

@AFamera,

Drop and Update by design creates an incident from the incoming event if the comparison criteria with the existing incident is not met.

For a complex logic like this, I would recommend using a script to cover all the options. You can take a look at some out of the box sample scripts by navigating to Automations and searching for tags: preProcessing. Please note that pre-processing script should always return True (if the incident will be created based on matching criteria) or False (if the incident will be dropped).
From within the script, you can access your incoming event details to create your logic and make the decision and also update your existing incidents (Bitsight grade changes).

topic Re: Drop and Update but NOT Create (Pre-Processing) in Cortex XSOAR Discussions

Drop and Update but NOT Create (Pre-Processing)

Re: Drop and Update but NOT Create (Pre-Processing)