XSIAM Incidents notes and messenger

[geyciane.tavares]

Hi everyone,

I am trying to get all the information added to the Notepad or Messenger fields (Incident Discussion) from the incidents.
I do not need the information contained in the RESOLVE_COMMENT column of the incidents table.
Would it be possible to get this information using XQL?

[MDovirak]

By default you can't extract this via XQL. Messanger - I didn't see the history of messages in json_raw of the incident but for Notes it's available. 

So, what you can do - build python script "IncidentNoteExtraction" that will call API to get last 24 hours incident and will extract the notes. The script should push the results to the custom dataset "IncidentNotes" that you can create. The format can be IncidentId, Notes. And after, you can make join XQL to connect Incident Dataset with IncidentNotes.

The function to get incident should looks like:

def get_incidents(date, values):
data = execute_command("core-get-incidents", {"gte_modification_time": date})
for incident in data:
if incident.get('parentIncidentFields') is not None:
if incident['parentIncidentFields'].get('Notes') is not None:
values[incident['incident_id']] = incident['parentIncidentFields']['notes']
values[incident['incident_id']] += "-"
values[incident['incident_id']] += incident['severity']

Next function is to call XSIAM API with JSON request to pull data into dataset. https://cortex-panw.stoplight.io/docs/cortex-xsiam-1/lwa2otkysbkd9-add-dataset
If the script is ready, just configure the Job to run it.