update-remote-system command not getting triggered

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

update-remote-system command not getting triggered

L1 Bithead

Is it necessary to add a tag to the entry or comment in XSOAR to get it mirrored on remote incident?

Suppose, I do not add a tag to a note/war room entry, then do I get that entry in the "UpdateRemoteSystemArgs"?

 

Currently, I am not getting that entry in the "UpdateRemoteSystemArgs". Is it so that I have done something wrong in configuration.
 

 

2 REPLIES 2

L3 Networker

When configuring the integration instance, there should be a few fields relating to tags that are required to mirror the data between instances. If the integration instance is set up correctly with the required tags, then you will need to apply those tags to the data you are trying to mirror.

So, without the tags, it is impossible to mirror the notes/entries to the
remote system. Is that you're trying to say, right?

Adding the tags to the entries/notes would be a manual task. An SOC Analyst
has to carefully add those tags to the entries he/she wants to mirror to
the remote incident. Isn't there any other way I can get the entries/notes
added to the incident in the UpdateRemoteSystemArgs parameter when the
update-remote-system command is called, so that I can mirror those entries
to the remote system without the intervention of the SOC Analyst adding
those tags to the entries?
  • 1229 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!