topic Alert when XSOAR doesn't fetch incidents for a certain integration. in Cortex XSOAR Discussions

Alert when XSOAR doesn't fetch incidents for a certain integration.

MarcoHersbach — Fri, 01 Nov 2024 11:41:34 GMT

Is there a way to receive an alert when no incidents are fetched in XSOAR for a certain integration for by example 24 hours. Not related to integration issues but if the integration works but nothing is fetched?

Would be beneficial to know if there is a issue with a log source.

Re: Alert when XSOAR doesn't fetch incidents for a certain integration.

JakubKostial — Tue, 12 Nov 2024 16:02:01 GMT

Hello,

i suggest doing JOB task. You can use task "GetIncidentsByQuery", set it to "1 day ago", put there your query, for example "sourceInstance: 'my SIEM instance'". Make a condition after it, if the response is defined, send a notification email to you. Set the job to run every 1 hour or so and you are good to go.

Hope this helps.