Pre Processing Rules Logs

[Syedhkt]

Dear Experts,

I have configured Cortex XSOAR to ingest cases/alerts, but for certain conditions, I want to prevent these from becoming incidents or triggering playbooks. I’ve created a script to drop alerts that meet specific criteria. However, I need to maintain a record of which alerts were dropped and, if possible, send notifications about them. Currently, the only method I’ve found to check dropped alerts is through the "Fetch History" in XSOAR. Please share your valuable insights on how to track and notify about dropped alerts effectively.

#preprocess #drop

Cortex XSOAR 

[asawyer · Accepted solution]

Hi @Syedhkt, if you are already using a custom preprocessing script, the most flexible way to log and send notifications for dropped incidents will be to add this functionality to your script. demisto.debug() can be used for logging, and the send-mail command to send out notifications via email.

Additionally, if you are using XSOAR 6, dropped incidents are logged in the server.log file in the log bundle. If you are using XSOAR 8, dropped incidents are logged in the Management Audit Logs: filter for subtype "NotCreated - Incident". 

[JBoehm · Accepted solution]

We have developed our own wrapper arround the demisto.log,demisto.debug and demsto.error functions within an custom docker image. (We are still using 6.14 OnPrem as an MSSP)

With that wrapper we ensure that the log message always has certain informations init and that they are key=value pairs for easy field extraction ins Splunk/Elastic. Then you can build beatuifull dashboards which shows you each run of an automation/pre-processing script. 

def log(inc_id: str, subject: str, msg: str, func: Callable[[str], None]) -> None:
    """
    Log a message with incident ID and subject.
    Args:
        inc_id (str): The ID of the incident.
        subject (str): The subject of the incident.
        msg (str): The message to log.
        func (function): The logging function to use. This should be a function that takes a string as input and logs it in some way.
    Example:
        >>> log('123', 'My Incident', "This is a tes message", demisto.log)
        will execute :
          demisto.log(F'subject="My Incident" incident="123" This is a test message').

    Note: This function does not perform any error handling. It assumes that the input functions are correct and will not fail.
    """
    msg = msg.replace('"', "'")
    subject = subject.replace('"', "'")
    func(f'subject="{subject}" incident="{inc_id}" msg="{msg}"')

We had the same issue and came up with this.