02-14-2025 12:56 PM
I see the classify, map and playbook logic in XSOAR and I see that a playbook can ask/pull/poll for info *from* and external tool, which might be done through an integration. But is there a way for an external tool to aynchronously *send/push* an *alert* (not incident) to XSOAR and have XSOAR receive the alert in real time? I can send new *incidents* to XSOAR at the /incident endpoint, but it looks like the external tool must send the JSON that the endpoint expects, and that the classification and mapping logic is bypassed in that case. It appears that the integrations I have looked at will pull/poll the external tool, so the potential efficiency of a push architecture is lost, and the opportunity for real-time reaction is also lost. I'm not sure if the /incident/json endpoint helps.
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
