Setting IncidentName and IncidentSeverity with Incoming Mapper

Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Setting IncidentName and IncidentSeverity with Incoming Mapper

L1 Bithead



I am trying to set the IncidentName and IncidentSeverity of an XSoar incident with the incoming mapper but it does not work. Ive tried googling and reading up but I cant find how you are supposed to set these fields.


Has anyone done this before and can point me to the right documentation to follow?




L3 Networker

I've set the incident name before with a mapper - the field is just called "name" and it works as expected. I'd double check you're using the right fields and that the data format you're trying to set is correct. Also, I'd check that the incident type selector at the top of the mapping editor is set either to the correct incident type or "Common Mapping" when you configure the name/severity mappings.

Yeah, I realized I had gotten the wrong source document that I based my mapping on.. Thank you for your reply!

  • 2 replies
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!