Set Incident values from Integration

JakubKostial — Wed, 06 Nov 2024 15:30:26 GMT

Hello all,

I have customized a ticketing integration to our image. The last part I'm struggling with is returning values from the integration to incident fields.

My usecase is that, SOC analyst will create a ticket inside our ServiceDesk application via button in Incident Layout. When this button is pressed, the command from the SD integration is executed, i will get bunch of data into context under custom key for SD integration, some human readable output to war room, but no data into incident fields.

The one i need to fill is my custom incident field called "sdurl", which is then displayed in incident layout. I need to somehow fill this field with value from the integration, but since it is {incident.sdurl}, I'm having troubles sending any values from Integration.

Can anybody please help me think of solution or a workaround for this issue? Thanks in advance.

Re: Set Incident values from Integration

asawyer — Fri, 15 Nov 2024 00:34:37 GMT

Hi @JakubKostial – You can achieve this by having the button run a custom wrapper script or playbook rather than just running the ServiceDesk integration command directly. The custom wrapper script or playbook will do 2 things:

Run the ServiceDesk integration command
Then run a setIncident to save the correct value from the output to your incident field

topic Re: Set Incident values from Integration in Cortex XSOAR Discussions

Set Incident values from Integration

Re: Set Incident values from Integration