About JesusAngel

Hi everyone,   I’m trying to test the email notifications configured in Cortex XSOAR to ensure they include the correct variables (like incident severity, name, and ID). Specifically, I want to verify the notification sent to an analyst when they are assigned an incident. Here are my main questions: Is there a built-in way to send test notifications using the notification templates in XSOAR? Can I send a test email using the !send-mail command? If so, how can I structure it to include variables like {{.severity}} or {{.incident.id}} ? What variables are available to customize notifications, particularly the ones sent when an incident is assigned to an analyst? Is there a reference list or documentation for these variables? I’ve already configured the SMTP Mail Sender integration, and the test from the integration settings works fine. However, I want to simulate a real notification to validate the content and variables in the email.   Any guidance on testing notifications and understanding the available variables would be greatly appreciated! ... View more

  Hi everyone,   I’m working on a QRadar integration (v2.5.7) in Cortex XSOAR (v6.12) and need to generate a JSON file for a specific offense to use in several scenarios, such as configuring an incident classifier. For example, in the classifier editor, you can upload a JSON file to analyze the data structure and map the fields correctly. Here’s the situation:   When I use the "Pull from instance" option with the QRadar v3 integration, XSOAR loads random incident data instead of the one I want. I want to export the JSON for a specific offense, such as #12 509 Impossible Travel Detected containing Primary Authentication Success . I’ve tried running !js script="return ${.}" in the War Room of the specific incident, but the JSON it returns contains significantly more fields than the one shown in the classifier editor when pulling data from QRadar. I’ve also considered using the command:   !get-remote-data id=<offense_id> lastUpdate=<date_str>   to fetch the JSON for this specific offense. Is this the right approach to generate the JSON, or is there a better method?   Additionally, is it possible to extract the exact JSON used by XSOAR when it pulls data for the incident directly from QRadar, without additional fields or transformations?   Thanks in advance for your help! ... View more