- Access exclusive content
- Connect with peers
- Share your expertise
- Find support resources
12-19-2024 12:56 AM
Hi,
we have an issue regarding classifiers, and we would like to ask if it is possible to interact with them using an automation or from the API.
Specifically, I am interested in understanding:
- Whether XSOAR provides built-in capabilities or tools for automating classification based on incident data.
- Whether it is possible to update the classifier without manually accessing it.
- Any recommended best practices or resources to implement such automation effectively.
The required Use Case would be to update a classifier whenever an "Unclassified" incident is categorized for the first time.
Let me know if additional details about our use case or configuration would be helpful.
Best regards,
12-19-2024 06:49 AM
I don't see any API or script that can be used to create/update classifier.
12-19-2024 07:46 AM - edited 12-20-2024 02:15 AM
XSOAR does allow interaction with classifiers via automation and API. You can script updates to classifiers using automation scripts or custom API calls, and use playbooks to reclassify incidents dynamically. For best practices, document workflows thoroughly to ensure smooth updates. If you need help drafting automation scripts or documentation, check out https://payforessay.net/. Good luck with your use case!
12-24-2024 12:56 AM
"You can script updates to classifiers using automation scripts or custom API calls"
Could you provide more information about this?
I can't seem to find the way to interact with classifiers using the REST API.
Cortex documentation does not provide any info about the /classifier endpoint.
Through some testing, I discovered that a POST to base_url/classifier allows to create a new empty entry in the Mappers/Classifiers section, and GET base_url/classifier/entry_id allows to retrieve a classifier.
Is there a complete documentation about the /classifier endpoint?
Click Accept as Solution to acknowledge that the answer to your question has been provided.
The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!
These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!
The LIVEcommunity thanks you for your participation!