07-03-2025 01:36 AM
Dear Experts,
I have configured Cortex XSOAR to ingest cases/alerts, but for certain conditions, I want to prevent these from becoming incidents or triggering playbooks. I’ve created a script to drop alerts that meet specific criteria. However, I need to maintain a record of which alerts were dropped and, if possible, send notifications about them. Currently, the only method I’ve found to check dropped alerts is through the "Fetch History" in XSOAR. Please share your valuable insights on how to track and notify about dropped alerts effectively.
#preprocess #drop
07-07-2025 12:48 PM
Hi @Syedhkt, if you are already using a custom preprocessing script, the most flexible way to log and send notifications for dropped incidents will be to add this functionality to your script. demisto.debug() can be used for logging, and the send-mail command to send out notifications via email.
Additionally, if you are using XSOAR 6, dropped incidents are logged in the server.log file in the log bundle. If you are using XSOAR 8, dropped incidents are logged in the Management Audit Logs: filter for subtype "NotCreated - Incident".
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!
