how to get incident xdr my endpoint only in xsoar

[Manikandan_sam]

I successfully configured and integrated xdr into Xsoar

but in xsoar incidents page it gets all common incidents from XDR but i need to get only my own endpoint user incident

there is a filter option in the xdr incident to use and check your own end user, check the results, but what about xsoar?

How can i do this? Should I change the classification and mapping to use a manual filter to use my own endpoint username filter in xsoar?

or any other way to get my own endpoint incident in xosar?

[jfernandes1]

Hi @Manikandan_sam,

Since there is no query\filter option inside the integration. You can drop the unwanted incidents using a pre-processor. 

Refer - https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-6/cortex-xsoar-admin/incidents/incident-mana...

Thanks,

Jeremy.

[Manikandan_sam]

the preprocessing rule using drop means it as a drop specific endpoint or details to drop
but how can i get a specific endpoint username incident that is only received in xsoar in the pre-process rule?