Closing an incident on CortexXDR with pre-processing.

[YilmazDincer]

Hi all,

I want to mark the Cortex XDR incident coming into XSOAR as TP or FP with preprocessing. Does preprocessing allow this (run a script)? Or does it only do drop processing?

[gyldz]

Hi @YilmazDincer ,

The script will only drop processing if it returns false. What do you mean by marking them?  

[YilmazDincer]

Hi @gyldz ,

For example, there will be a condition and if it matches that condition, it will execute the command I show below. This command closes the incident in xdr (marked FP or TP)
pseudo code:
     

def condition():
    "pseudo"

if condition:
    demisto.executeCommand('xdr-update-incident', {'incidentid': x, 'status': 'TP'})
else:
    demisto.result(True) ## if it doesn't match, don't it.
'This code is pseudo'

[gyldz]

Hi,

You can do that. You do not have to return a False results. I tested the below one and it works fine. so you can change according to your needs. 

try:
    result = "FP"
    if results == "FP":
        demisto.executeCommand("send-notification", {"channel" :"xsoar-implementation", "message" : "FP alert"})
    else:
        demise.results(True)
except:
    demise.results(True)