cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Who rated this post

L4 Transporter

Sounds like you need a preprocessing rule or more likely a script.   Checkout the training video on Preprocessing:

 

https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-how-to-customer-success...

 

Alternatively you could use the Dedup - Generic v4 playbook as one of the first steps in the playbook, and have it search for an existing Incident and link & close the new one to that.

Who rated this post