Pre-process rule doesn't work

aborgoENGIE — Thu, 14 Jan 2021 10:40:08 GMT

Hello all,

We want to create a pre-process rule to drop all Phishing incident without [Phish Alert] inside the email subject.

We're creating the following rule

type equals Phishing AND emailto equals test@test.ts AND emailsubject contains [Phish Alert]

Testing with the following JSON:

{
"type":"Phishing",
"emailsubject":"[Phish Alert] test preprocess rule",
"emailto":"test@test.ts"
}

It doesn't work:

With only "type equals Phishing" it works. But if we had anything else it stops working.

For example only with:

type equals Phishing AND firstname equals Alexandre

And the following JSON:

{
"type":"Phishing",
"firstname":"Alexandre",
"emailsubject":"[Pish Alert] test preprocess rule",
"emailto":"test@test.ts"
}

It doesn't work.

Can you help us please? Am I missing somehing or is there a problem ?

Thanks for all help.

Best regards,

Alexandre Borgo

Re: Pre-process rule doesn't work

gfilippov — Tue, 15 Jun 2021 09:12:43 GMT

Hi,
Please submit a support case,
I think that the issue may be only in the pre-proc rules test functionality, and the rule will work as expected with real incidents, please try to test with existing incidents as well,
thanks.

topic Pre-process rule doesn't work in Cortex XSOAR Discussions

Pre-process rule doesn't work

Re: Pre-process rule doesn't work