SearchIncidentsV2 not returning results

[MMagdic]

Hi, I am using SearchIncidentsV2 automation to loop through 2 IP addresses previously saved to IP incident key, to see if these IPs are showing in FireEye NX alerts. When I try to loop I receive empty foundIncidents key:  

When I hardcode the IP addresses everything works as it should. 
What I am missing?
Cortex XSOAR 

[gyldz]

Hi @MMagdic ,

Do you see any results when you use the same query in the incidents page search box?

[MMagdic]

Yes, of course with hardcoded IP values.

[gyldz]

But when I check your query, the IP is the same for the victim and target which does not sound right. Could you please copy and paste the same query in incidents search box to see if there is any alerts.

[MMagdic]

Yes, the reason to have both (victim and target) is because sometimes FireEye NX is parsing incident fields not correctly, putting external (attacker IP) in target ip. But the query is working:

So the question is how to loop through a couple of IP addresses, e.g. at least 2 IP addresses in SearchIncidentsV2 automation using query as a filter.

[MMagdic]

See here results when I try with 2 IP addresses:

[gyldz · Accepted solution]

Hi again, you need to use join transformer for that task. Before searching the incidents Set another field as below and then use it in the search incidents task.

[MMagdic]

Thanks, but this should work only by adding space before&after "or" to " or " (in Join Transformer) as in cli:

!SearchIncidentsV2 query="type:FireEye NX Alert and fireeyenxalertvictimip:11.11.11.11 or 134.122.90.162"

[gyldz]

Yes there was a space in the screenshot I shared 🙂