Linked incident offense close

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Linked incident offense close

L2 Linker

Hi,

 

A pre-process rule tests some condition and "link-close" incident into a previous one, and this works great. But i need to close related offense in qradar as well as the xsoar itself, with a sole preprocess rule deployed incident is closed in xsoar but offense in qradar remains open , any suggestion about how to close offense after incident-link process.

 

Regards. 

1 ACCEPTED SOLUTION

Accepted Solutions

L2 Linker

Hey @MKececioglu, indeed performing actions like mirroring and closing offenses in third party tools is not possible when you have link&close as a pre-processing rule.

I would suggest a slightly different approach here instead:

1. When creating the pre-processing rule, only link the incident instead of link and close.

2. In the playbook used for these incidents, create a conditional task as the first task of the playbook, which will divide into the following two branches:

nkazinets_0-1655213776692.png

3. You'll want to check if the new incident was linked to a previous one, so you'll check that its' linkedCount field is greater than zero, or equals 1 (since it was just created now and linked to a previous incident, the count will be 1). If this incident isn't linked to a previous one (meaning the rule doesn't apply to it), the count will remain zero.

nkazinets_1-1655214114887.png

4. The branch for yes (count = 1) will have the needed actions for closing the offense in QRadar (easiest if you're using mirroring), and will close the incident.

The branch for else (this is an incident that the rule didn't apply to) will simply have all the logic that you had until now for newly created incidents.

 

Note: If for any reason you need to re-run the playbook for an older incident which will already have newer incidents that were linked to it, the selected branch will be "yes" - as it does have incidents linked to it.

View solution in original post

5 REPLIES 5

L2 Linker

Hi all,

 

Still cant find a way to select incident.linkedincident.offenseid kind of information. To link incident between them really makes it faster and simple to analyse . I dont want to rollback unlinked state , and trying to find a way to close offenses in qradar when they linked into another incident in xsoar. Any idea would be great.

 

Regards.

L2 Linker

Hey @MKececioglu, indeed performing actions like mirroring and closing offenses in third party tools is not possible when you have link&close as a pre-processing rule.

I would suggest a slightly different approach here instead:

1. When creating the pre-processing rule, only link the incident instead of link and close.

2. In the playbook used for these incidents, create a conditional task as the first task of the playbook, which will divide into the following two branches:

nkazinets_0-1655213776692.png

3. You'll want to check if the new incident was linked to a previous one, so you'll check that its' linkedCount field is greater than zero, or equals 1 (since it was just created now and linked to a previous incident, the count will be 1). If this incident isn't linked to a previous one (meaning the rule doesn't apply to it), the count will remain zero.

nkazinets_1-1655214114887.png

4. The branch for yes (count = 1) will have the needed actions for closing the offense in QRadar (easiest if you're using mirroring), and will close the incident.

The branch for else (this is an incident that the rule didn't apply to) will simply have all the logic that you had until now for newly created incidents.

 

Note: If for any reason you need to re-run the playbook for an older incident which will already have newer incidents that were linked to it, the selected branch will be "yes" - as it does have incidents linked to it.

L0 Member

can we not use a script and once the condition set in preprocess are met then instead of link and close , it will run the script which will have the capacity to close it both in xsoar and in qradar ?  I dont see any tag of preprocess and so when I select run a script in preprocess , it doesnot reflect any script there.

Hey @Sbanerjee6, I'm not sure I fully understood the question, but are you asking how can you use preprocessing scripts?

When you create the script, add this tag: preProcessing

If you don't have any preprocessing scripts yet then you won't see the tag in the dropdown menu for tags, but once you add it the first time it will be created and you'll see scripts tagged with it in the rules editor.

Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!