topic Re: Finding suppressed incidents in Cortex XSOAR Discussions

Finding suppressed incidents

ftmnr0428 — Mon, 31 Jan 2022 20:56:50 GMT

Hello,

I need to make an HTTP request to get suppressed incidents from the main account. Is anyone has an idea how can a filter those incidents? Thanks!

Re: Finding suppressed incidents

gfilippov — Thu, 03 Feb 2022 16:49:02 GMT

Hi, What are suppressed incidents?

Re: Finding suppressed incidents

ABurt — Fri, 04 Feb 2022 10:09:33 GMT

Are you referring to "restricted" incidents? In a recent update (I believe 6.2) the option for the admin account to view all incidents that are also marked as "restricted" was removed. From my understanding, if the incident is marked as "restricted" and the admin account is not an explicit team member of the incident, then the search will not return the restricted incidents.

You could use something such as Team Management Pack to add the admin account to each incident that is restricted.

Re: Finding suppressed incidents

ftmnr0428 — Fri, 04 Feb 2022 17:43:51 GMT

I just start learning XSOAR. I don't have much of an idea on this either. I couldn't find any information in the documentation but I read that If not required to take any direct action on an event you can suppress it. I don't know might be setting alerts or creating a playbook to achieve this. My focus is to find if there is any.

Re: Finding suppressed incidents

ftmnr0428 — Fri, 04 Feb 2022 18:02:11 GMT

Thanks for your response. I will take a look but I think it's more about the access control. I am looking for filtering incidents. For example, I can filter the closed incidents by status:Closed.

Re: Finding suppressed incidents

gfilippov — Sat, 19 Feb 2022 20:25:12 GMT

Please review:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-5/cortex-xsoar-admin/cortex-xsoar-overview/how-to-search-in-cortex-xsoar