topic Linked incident offense close in Cortex XSOAR Discussions

Linked incident offense close

MKececioglu — Fri, 10 Jun 2022 06:11:04 GMT

Hi,

A pre-process rule tests some condition and "link-close" incident into a previous one, and this works great. But i need to close related offense in qradar as well as the xsoar itself, with a sole preprocess rule deployed incident is closed in xsoar but offense in qradar remains open , any suggestion about how to close offense after incident-link process.

Regards.

Re: Linked incident offense close

MKececioglu — Mon, 13 Jun 2022 11:59:32 GMT

Hi all,

Still cant find a way to select incident.linkedincident.offenseid kind of information. To link incident between them really makes it faster and simple to analyse . I dont want to rollback unlinked state , and trying to find a way to close offenses in qradar when they linked into another incident in xsoar. Any idea would be great.

Regards.

Re: Linked incident offense close

nkazinets — Tue, 14 Jun 2022 13:51:29 GMT

Hey @MKececioglu, indeed performing actions like mirroring and closing offenses in third party tools is not possible when you have link&close as a pre-processing rule.

I would suggest a slightly different approach here instead:

1. When creating the pre-processing rule, only link the incident instead of link and close.

2. In the playbook used for these incidents, create a conditional task as the first task of the playbook, which will divide into the following two branches:

3. You'll want to check if the new incident was linked to a previous one, so you'll check that its' linkedCount field is greater than zero, or equals 1 (since it was just created now and linked to a previous incident, the count will be 1). If this incident isn't linked to a previous one (meaning the rule doesn't apply to it), the count will remain zero.

4. The branch for yes (count = 1) will have the needed actions for closing the offense in QRadar (easiest if you're using mirroring), and will close the incident.

The branch for else (this is an incident that the rule didn't apply to) will simply have all the logic that you had until now for newly created incidents.

Note: If for any reason you need to re-run the playbook for an older incident which will already have newer incidents that were linked to it, the selected branch will be "yes" - as it does have incidents linked to it.

Re: Linked incident offense close

Sbanerjee6 — Wed, 29 Jun 2022 09:30:31 GMT

can we not use a script and once the condition set in preprocess are met then instead of link and close , it will run the script which will have the capacity to close it both in xsoar and in qradar ? I dont see any tag of preprocess and so when I select run a script in preprocess , it doesnot reflect any script there.

Re: Linked incident offense close

nkazinets — Tue, 19 Jul 2022 11:00:37 GMT

Hey @Sbanerjee6, I'm not sure I fully understood the question, but are you asking how can you use preprocessing scripts?

When you create the script, add this tag: preProcessing

If you don't have any preprocessing scripts yet then you won't see the tag in the dropdown menu for tags, but once you add it the first time it will be created and you'll see scripts tagged with it in the rules editor.

Re: Linked incident offense close

Sbanerjee6 — Tue, 19 Jul 2022 11:47:42 GMT

Yes I eventually figured that out. Thanks