topic Pre Processing Rules Logs in Cortex XSOAR Discussions

Pre Processing Rules Logs

Syedhkt — Thu, 03 Jul 2025 08:36:34 GMT

Dear Experts,

I have configured Cortex XSOAR to ingest cases/alerts, but for certain conditions, I want to prevent these from becoming incidents or triggering playbooks. I’ve created a script to drop alerts that meet specific criteria. However, I need to maintain a record of which alerts were dropped and, if possible, send notifications about them. Currently, the only method I’ve found to check dropped alerts is through the "Fetch History" in XSOAR. Please share your valuable insights on how to track and notify about dropped alerts effectively.

#preprocess #drop

Re: Pre Processing Rules Logs

asawyer — Mon, 07 Jul 2025 19:48:12 GMT

Hi @Syedhkt, if you are already using a custom preprocessing script, the most flexible way to log and send notifications for dropped incidents will be to add this functionality to your script. demisto.debug() can be used for logging, and the send-mail command to send out notifications via email.

Additionally, if you are using XSOAR 6, dropped incidents are logged in the server.log file in the log bundle. If you are using XSOAR 8, dropped incidents are logged in the Management Audit Logs: filter for subtype "NotCreated - Incident".

Re: Pre Processing Rules Logs

JBoehm — Fri, 25 Jul 2025 11:14:51 GMT

We have developed our own wrapper arround the demisto.log,demisto.debug and demsto.error functions within an custom docker image. (We are still using 6.14 OnPrem as an MSSP)

With that wrapper we ensure that the log message always has certain informations init and that they are key=value pairs for easy field extraction ins Splunk/Elastic. Then you can build beatuifull dashboards which shows you each run of an automation/pre-processing script.

def log(inc_id: str, subject: str, msg: str, func: Callable[[str], None]) -> None: """ Log a message with incident ID and subject. Args: inc_id (str): The ID of the incident. subject (str): The subject of the incident. msg (str): The message to log. func (function): The logging function to use. This should be a function that takes a string as input and logs it in some way. Example: >>> log('123', 'My Incident', "This is a tes message", demisto.log) will execute : demisto.log(F'subject="My Incident" incident="123" This is a test message'). Note: This function does not perform any error handling. It assumes that the input functions are correct and will not fail. """ msg = msg.replace('"', "'") subject = subject.replace('"', "'") func(f'subject="{subject}" incident="{inc_id}" msg="{msg}"')

We had the same issue and came up with this.