I've a couple of questions regarding mirroring in Cortex XSOAR which are listed below.
1. Is it possible to change the status of the XSOAR incident from Pending to Active in the get-remote-data command? I have checked couple of mirroring integration (e.g. ServiceNow v2, XSOAR Mirroring) and they are only closing the XSOAR incident once the remote incident is closed. But I did not find any logic to change the state of XSOAR incident from Pending to Active. So, is it not possible in XSOAR?
2. After the incident creation, when I see the value of dbotMirrorLastSync , it is something in past like 0001-01-01T00:00:00Z. But when the first time get-remote-data command is called the value I'm getting is not this one (Mostly looks like the incident creation time), and due to that I'm not able to add the previous entries. Is this expected behavior. Or I should get the 0001-01-01T00:00:00Z for the first time in get-remote-data command as a value for lastUpdate?
3. The another issue I am facing is, when I add a note in the XSOAR incident, the update-remote-system command is not getting triggered, and if it gets triggered then I do not see the entry which I have added in the UpdateRemoteSyatemArgs . Is it so, that I am doing something wrong?
4. The last one is, I want to know about the mirroring tags. I have referred the official XSOAR documentation about mirroring, but did not find anything which can explain the importance of mirror tags. If you could explain that in brief, that would be very helpful.
... View more