About Harsh-Panchal

When we change the incident from Active state to Close state, we get "closeReason", "closingUserId", and "closeNotes" in the delta of "UpdateRemoteSystemArgs". But when the incident is changed from Pending state to Active state, we do not get anything in delta, and due to which I am not able to determine whether something else has changed or the Incident state has been changed from Pending to Active.   Because, updating the remote system by checking if the incident status equals to IncidentStatus.ACTIVE, will result in marking it again and again every time something will change in this incident after it was changed to Active, which is not the wanted behaviour.   ... View more

When the get-remote-data is being called, I am getting below errors when returning entries to the GetRemoteDataResonse. The command is executes successfully, but I do not get entries in the XSOAR incident which I have passed to the GetRemoteDataResponse. Even the incident is not getting closed though I have returned an entry with "dbotIncidentClose": true . I have attached both the screenshots below.     ... View more

Is it necessary to add a tag to the entry or comment in XSOAR to get it mirrored on remote incident? Suppose, I do not add a tag to a note/war room entry, then do I get that entry in the "UpdateRemoteSystemArgs"?   Currently, I am not getting that entry in the "UpdateRemoteSystemArgs". Is it so that I have done something wrong in configuration.     ... View more

I've a couple of questions regarding mirroring in Cortex XSOAR which are listed below. 1. Is it possible to change the status of the XSOAR incident from Pending to Active in the get-remote-data command? I have checked couple of mirroring integration (e.g. ServiceNow v2, XSOAR Mirroring) and they are only closing the XSOAR incident once the remote incident is closed. But I did not find any logic to change the state of XSOAR incident from Pending to Active. So, is it not possible in XSOAR? 2. After the incident creation, when I see the value of dbotMirrorLastSync , it is something in past like 0001-01-01T00:00:00Z. But when the first time get-remote-data command is called the value I'm getting is not this one (Mostly looks like the incident creation time), and due to that I'm not able to add the previous entries. Is this expected behavior. Or I should get the 0001-01-01T00:00:00Z for the first time in get-remote-data command as a value for lastUpdate? 3. The another issue I am facing is, when I add a note in the XSOAR incident, the update-remote-system command is not getting triggered, and if it gets triggered then I do not see the entry which I have added in the UpdateRemoteSyatemArgs . Is it so, that I am doing something wrong? 4. The last one is, I want to know about the mirroring tags. I have referred the official XSOAR documentation about mirroring, but did not find anything which can explain the importance of mirror tags. If you could explain that in brief, that would be very helpful. ... View more