Child Incident Evidence In Parent

[nickvus0]

Hello!

I need to mark some child incident entries as notes and evidence in the parent incident.

I have found ways in which you can pass the entries to the parent and then mark them as note/evidence in the parent. However, I would like to have an automation in the child incident playbook which would automatically mark the entries as note/evidence in the parent. 

I can't seem to find any way in which I could do this. If I try commands such as "markAsEvidence" in my automation, they don't work because they want to run on the child, not on the parent.

[BharathwajTiruputkuzhi]

Hello! There are no direct ways to do this. However, you can use developer tools on the browser to observe the API endpoint on your xsoar server to mark entries as evidence and then replicate it using an automation script.