Content translations are temporarily unavailable due to site maintenance. We apologize for any inconvenience.
09-22-2023 04:13 AM
Hi @SanDev and @rafael-usano ,
In XDR we have several BIOCs configured that generate an incident.
We have XDR integrated with a third-party ticketing system where we receive all the information we need ("action_evtlog_data_fields" field), which my colleague Rafa comments on.
For some unknown reason, it seems that the information we need is not reaching XSOAR. In both the classifier and the mapper, we have tried to search for this field by field name and by value, but without success.
The only thing we can think of is that this information should not be sent to XSOAR, but it seems something quite strange, since in the third-party ticketing system we do receive all the information.
If we look at the JSON document in ticketing with the xdr info, the field that interests us is in the following structure:
original_alert_json -> edrData -> action_evtlog_data_fields
Any suggestion can be helpful to us.
Thank you so much
