XSOAR integration fetching incidents past the set time.

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

XSOAR integration fetching incidents past the set time.

L0 Member

We're only running one instance of the integration and we've set the first fetch timestamp to be 3 days.
When we run the integration, initially it only fetches incidents in the past three days and then after a while it starts fetching incidents as old as 3 years ago.

Has anyone observed this issue and if so, what could be the issue here?

mens agitat molem
3 REPLIES 3

L2 Linker

Can you provide context regarding what integration this is? And any applicable query/filters that is part of the integration?

We're trying to add the integration of ThreatConnect (v3) into our environment. No changes were made to the yml file. We only added the 3 day limit to the fetch incident limit in the integration while setting it up.

mens agitat molem

I would recommend ensuring you are on the latest marketplace version of the content pack. Create a brand new instance and set the instance log level to debug mode (as in the screenshot attached) and also set the log level under settings -> about-> troubleshooting to debug. Try fetching again. If the issue persists, open a support case so that it can be looked at. 

  • 1189 Views
  • 3 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!