Showing results for 
Show  only  | Search instead for 
Did you mean: 
Please sign in to see details of an important advisory in our Customer Advisories area.

Who rated this post

L0 Member

Hi @SanDev and @rafael-usano ,


In XDR we have several BIOCs configured that generate an incident.


We have XDR integrated with a third-party ticketing system where we receive all the information we need ("action_evtlog_data_fields" field), which my colleague Rafa comments on.


For some unknown reason, it seems that the information we need is not reaching XSOAR. In both the classifier and the mapper, we have tried to search for this field by field name and by value, but without success.


The only thing we can think of is that this information should not be sent to XSOAR, but it seems something quite strange, since in the third-party ticketing system we do receive all the information.


If we look at the JSON document in ticketing with the xdr info, the field that interests us is in the following structure:

original_alert_json -> edrData -> action_evtlog_data_fields


Any suggestion can be helpful to us.

Thank you so much

Who rated this post