topic Re: CSOAR Pre processing rule with scheduled jobs in Cortex XSOAR Discussions

CSOAR Pre processing rule with scheduled jobs

assubramania — Thu, 21 Nov 2024 09:33:07 GMT

How can we set the preprocess rule to drop any incidents created by schedule jobs?

For example: any incident category=job and some incident field like description contains "False". The playbook in schedule Job, will run some tasks and condition and will mark the incident description with "False" if that incident is False and need to be dropped by pre-process rule.

Thank you

Re: CSOAR Pre processing rule with scheduled jobs

james598keen — Thu, 21 Nov 2024 09:47:45 GMT

@assubramania wrote:

How can we set the preprocess rule to drop any incidents created by schedule jobs?

For example: any incident category=job and some incident field like description contains "False". The playbook in schedule Job, will run some tasks and condition and will mark the incident description with "False" if that incident is False and need to be dropped by pre-process rule.

Thank you

Hello,
To set a preprocess rule in ADF V2 to drop incidents created by scheduled jobs, you can create a rule that checks the incident category and description fields. Here's a concise comment:

"Create a preprocess rule to drop incidents where category='job' and description contains 'False'."

Best Regards,
James Keen

Re: CSOAR Pre processing rule with scheduled jobs

AbelSantamarina — Thu, 21 Nov 2024 14:27:37 GMT

Hello @assubramania,

This is not possible and it is by design, based on the definition of the incident lifecycle in XSOAR, as described here.
Pre-processing rules are intended to perform certain actions and validations before incidents are ingested or created in XSOAR, with the purpose of controlling whether they will be dropped, linked or closed, depending on these validations.

Incidents created from jobs, whether they are time-triggered or feed-triggered, are purposedly created and therefore pre-processing rules don't apply to them.

If you're looking to delete incidents created from jobs, you can create a clean-up job that runs every 3 or 6 months, and that job will go back in time and retrieve all incidents created by jobs with description "False" or any other condition. The playbook for this clean-up job can be very simple, with just a few tasks, including a task with the command DeleteIncidentsByQuery, which will delete past incidents based on a query. This automation requires to have an instance of Core Rest API integration enabled.

Let me know if you have any questions.