topic Re: how to get incident xdr my endpoint only in xsoar in Cortex XSOAR Discussions

how to get incident xdr my endpoint only in xsoar

Manikandan_sam — Sun, 01 May 2022 04:51:19 GMT

I successfully configured and integrated xdr into Xsoar

but in xsoar incidents page it gets all common incidents from XDR but i need to get only my own endpoint user incident

there is a filter option in the xdr incident to use and check your own end user, check the results, but what about xsoar?

How can i do this? Should I change the classification and mapping to use a manual filter to use my own endpoint username filter in xsoar?

or any other way to get my own endpoint incident in xosar?

Re: how to get incident xdr my endpoint only in xsoar

jfernandes1 — Mon, 02 May 2022 08:49:26 GMT

Hi @Manikandan_sam,

Since there is no query\filter option inside the integration. You can drop the unwanted incidents using a pre-processor.

Refer - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-6/cortex-xsoar-admin/incidents/incident-management/incident-de-duplication/creating-pre-process-rules-for-incidents

Thanks,

Jeremy.

Re: how to get incident xdr my endpoint only in xsoar

Manikandan_sam — Mon, 02 May 2022 08:55:36 GMT

the preprocessing rule using drop means it as a drop specific endpoint or details to drop
but how can i get a specific endpoint username incident that is only received in xsoar in the pre-process rule?