Enhanced Security Measures in Place:   To ensure a safer experience, we’ve implemented additional, temporary security measures for all users.

XSOAR keeps firing the same incident

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements

XSOAR keeps firing the same incident

L0 Member

Hi All,

 

My XSOAR instance is a cloud hosted environment running on the latest version 8 build.

 

I have a playbook that sends a notification email to a user in response to a change in their account settings to confirm if recognized. The user is requested to respond via the webform link that the data collection task generates in the email that gets sent. The webform expires after an hour if the user fails to respond.

 

If a user does not respond within the hour, the playbook flow stops there and updates the XSOAR case with a custom message I defined. This has always been the case for the past few months since this playbook was created. 

 

However, since the beginning of this week (21-Oct-2024), XSOAR keeps creating cases on the same detection until a user responds to the email. This has resulted in hundreds of notification emails being sent to each user.

 

I have created a TAC case for investigation and have had to stop the auto-run of the playbook to stop the email spam until this gets resolved. 

 

Has anyone else in the community come across the same issue in their environment recently ?

1 REPLY 1

L3 Networker

Hello @PWJ2020, Can you please share the TAC case number that you created so that I can track it internally? 

Also, would it be possible for you to share a screenshot of the section in your playbook that implements this functionality? 

 

Thank you.

  • 166 Views
  • 1 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!