topic Tanium Threat Response "tanium-tr-alert-update-state" command update all alert status rather than specified alert in Cortex XSOAR Discussions

Tanium Threat Response "tanium-tr-alert-update-state" command update all alert status rather than specified alert

JOng39 — Fri, 17 Jun 2022 08:45:26 GMT

We are experiencing the weird behavior, where the "tanium-tr-alert-update-state" command update all alert status.

The full command used is as below
!tanium-tr-alert-update-state alert_ids=2267 state=resolved

I have updated the Tanium Threat Response V2 to latest verison 2.0.15

Please help to look into it and let us know what is the solution.

Thank you.

Re: Tanium Threat Response "tanium-tr-alert-update-state" command update all alert status rather than specified alert

cstone — Fri, 17 Jun 2022 13:04:55 GMT

can you share a screenshot of the output in the playground after you trigger this command? Thanks

Re: Tanium Threat Response "tanium-tr-alert-update-state" command update all alert status rather than specified alert

JOng39 — Mon, 20 Jun 2022 01:25:31 GMT

Hi Cstone,

Attached the screenshot

Re: Tanium Threat Response "tanium-tr-alert-update-state" command update all alert status rather than specified alert

jfernandes1 — Mon, 20 Jun 2022 02:27:53 GMT

Hi @JOng39, I don't see any issue in the code. Looks like its calling the API like the documentation suggests. You might need to check this with your debug logs on Tanium Threat Response UI.

You can verify the same using Postman or similar. Refer - https://developer.tanium.com/site/global/docs/how_tos/tr_alert/index.gsp

If this is still an issue after verification, please contact support.