XSoar API Create Incident Mapping

OscarArmbruster — Tue, 03 Aug 2021 22:36:07 GMT

Looking for some help on create an API integration for creating incidents and mapping those fields to normalized fields.

I can create an incident just fine, I can assign the incident type, the issue I'm running into is the field normalization. IE lets take the following field called Souce IP in XSoar. The script that I'm using calls it OriginIp. Is there a way to create/set/define a mapper within the API request for an /incident creation?

Re: XSoar API Create Incident Mapping

gfilippov — Mon, 04 Oct 2021 21:52:59 GMT

Hi,
The Mapping part comes after the incident creation was executed,
Please read the following article and and its link to Classification & Mapping:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/incidents/incident-lifecycle
thanks.

topic XSoar API Create Incident Mapping in Cortex XSOAR Discussions

XSoar API Create Incident Mapping

Re: XSoar API Create Incident Mapping