CSOAR Pre processing rule with scheduled jobs

[assubramania]

How can we set the preprocess rule to drop any incidents created by schedule jobs?

For example: any incident category=job and some incident field like description contains "False". The playbook in schedule Job, will run some tasks and condition and will mark the incident description with "False" if that incident is False and need to be dropped by pre-process rule.

Thank you

[james598keen]

---

@assubramania wrote:

How can we set the preprocess rule to drop any incidents created by schedule jobs?

For example: any incident category=job and some incident field like description contains "False". The playbook in schedule Job, will run some tasks and condition and will mark the incident description with "False" if that incident is False and need to be dropped by pre-process rule.

Thank you

---

Hello,
To set a preprocess rule in ADF V2 to drop incidents created by scheduled jobs, you can create a rule that checks the incident category and description fields. Here's a concise comment:

"Create a preprocess rule to drop incidents where category='job' and description contains 'False'."

Best Regards,
James Keen

[AbelSantamarina]

Hello @assubramania, 

This is not possible and it is by design, based on the definition of the incident lifecycle in XSOAR, as described here.
Pre-processing rules are intended to perform certain actions and validations before incidents are ingested or created in XSOAR, with the purpose of controlling whether they will be dropped, linked or closed, depending on these validations. 

Incidents created from jobs, whether they are time-triggered or feed-triggered, are purposedly created and therefore pre-processing rules don't apply to them.

If you're looking to delete incidents created from jobs, you can create a clean-up job that runs every 3 or 6 months, and that job will go back in time and retrieve all incidents created by jobs with description "False" or any other condition. The playbook for this clean-up job can be very simple, with just a few tasks, including a task with the command DeleteIncidentsByQuery, which will delete past incidents based on a query.  This automation requires to have an instance of Core Rest API integration enabled. 

Let me know if you have any questions.