About RahulVijaydev

Hello @haicd    Could you elaborate on what you mean by context overlapping, please?   Thanks, Rahul   ... View more

Hello,   In your payload, the incident id is passed as a filter, which is incorrect. Here is an example of the correct payload format,   !core-api-post uri=uri=`/incident/batchDelete` body=`{"ids":["260906"]}`   Additionally, the filter parameter accepts a query if you need to delete all incidents before a certain date. You can view the payload format on developer tools, by monitoring the request to delete an incident.   Please let me know if you have further questions.   Thanks, Rahul ... View more

Sounds good. Let us know if you have any further issues!   Thanks, Rahul ... View more

Hi Regish,   The token may have expired. Hence the 401 error. Could you send me the email address that was used to request the community edition?   Thanks, Rahul ... View more

I see the problem. The list template should be the name of the list only and not part of the ${} notation. for ex. !CreateEmailHTMLBody listTemplate=DefenseStormAlertTemplate ...     ... View more

Hello,   What problems are you currently experiencing with the integration setup? Can you share some context around the issue/error you are seeing?   Thanks, Rahul Vijaydev   ... View more

@CodyReavis Is it possible that the HTML template has a context key variable in ${} notation and the key is not present in the context? Please upload some screenshots if possible.   Thanks, Rahul Vijaydev ... View more

Hello,   Labels constitute all the unmapped data, meaning, if a field in the alert JSON is not mapped to an XSOAR field, the value ends up as a label. You can use filters and transformers to extract fields from _raw and map them to XSOAR fields in the mapper.   Thanks, Rahul Vijaydev  ... View more

Hello,   Are you able to share the code snippet where you set the HTML field? I can review it and provide feedback.   Thanks, Rahul Vijaydev ... View more

Hello,    The output of GetIndicatorsByQuery is a file, so I'm not sure if that format is convenient. You can use SearchIndicators to retrieve additional fields into context for ex. !SearchIndicator query=`8.8.8.8` add_fields_to_context=firstSeen,lastSeen   Thanks, Rahul Vijaydev ... View more

Hi Francesco,   - Could you clarify what you mean by restricting permission to execute only upon field change, please? - The command is meant to return commands that any user has executed in a particular investigation, hence its results are exclusive to the incident that the command is executed in. It is not meant to return a global list of commands and users - Upon field change, the script runs with limited permissions. Can you try changing the 'Run as' configuration within the script settings to 'DBot' or 'Administrator' and perform your test again?   Thanks, Rahul Vijaydev       ... View more

Hi Bar,    If the alert has the technique ID, mapping can be done automatically, however, in the absence of the technique ID, mapping is not straightforward since alerts normally come in unstandardized. We rely on the tool to provide the technique ID.   Thanks,  Rahul ... View more

That makes sense. If the field did not map to one of the incident types, is it possible that that key does not exist for that particular alert, or stored in a different location that the mapper does not read? Happy to jump on a call and take a look, but I would start by doing the following,   * Add the server configuration - ingestion.samples.save-mapped and value would be true. This ensures that the raw data from the alert is captured in the incident for us to review. * Ingest a few QRadar alerts. After adding the above config, you should see the ${incident.rawJSON} field populate for every incident you ingest(not limited to one type) * REMOVE the server config after a few QRadar samples have been collected. If not removed, it can have serious implications for storage and performance * Review alert samples to see if data exists in just a subset of the types   ... View more