Child Incident Evidence In Parent

nickvus0 — Thu, 12 Dec 2024 15:38:44 GMT

Hello!

I need to mark some child incident entries as notes and evidence in the parent incident.

I have found ways in which you can pass the entries to the parent and then mark them as note/evidence in the parent. However, I would like to have an automation in the child incident playbook which would automatically mark the entries as note/evidence in the parent.

I can't seem to find any way in which I could do this. If I try commands such as "markAsEvidence" in my automation, they don't work because they want to run on the child, not on the parent.

Re: Child Incident Evidence In Parent

BharathwajTiruputkuzhi — Fri, 13 Dec 2024 00:35:20 GMT

Hello! There are no direct ways to do this. However, you can use developer tools on the browser to observe the API endpoint on your xsoar server to mark entries as evidence and then replicate it using an automation script.

topic Re: Child Incident Evidence In Parent in Cortex XSOAR Discussions

Child Incident Evidence In Parent

Re: Child Incident Evidence In Parent