Finding suppressed incidents

[ftmnr0428]

Hello,

I need to make an HTTP request to get suppressed incidents from the main account. Is anyone has an idea how can a filter those incidents? Thanks!

[gfilippov]

Hi, What are suppressed incidents?

[ABurt]

Are you referring to "restricted" incidents? In a recent update (I believe 6.2) the option for the admin account to view all incidents that are also marked as "restricted" was removed. From my understanding, if the incident is marked as "restricted" and the admin account is not an explicit team member of the incident, then the search will not return the restricted incidents.

You could use something such as Team Management Pack to add the admin account to each incident that is restricted.

[ftmnr0428]

I just start learning XSOAR. I don't have much of an idea on this either. I couldn't find any information in the documentation but I read that  If not required to take any direct action on an event you can suppress it. I don't know might be setting alerts or creating a playbook to achieve this. My focus is to find if there is any.

[ftmnr0428]

Thanks for your response. I will take a look but I think it's more about the access control. I am looking for filtering incidents. For example, I can filter the closed incidents by status:Closed. 

[gfilippov]

Please review:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-5/cortex-xsoar-admin/cortex-xsoar-overview/h...