This website uses Cookies. Click Accept to agree to our website's cookie use as described in our Cookie Policy. Click Preferences to customize your cookie settings.
About Harsh-Panchal
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About Harsh-Panchal
01-31-2023
5Posts
1Like
0Solutions
Jan 31, 2023Last Visited
User
Activity
User
Profile
Latest posts by Harsh-Panchal
| Subject | Views | Posted |
|---|---|---|
| 155 | 01-31-2023 03:25 AM | |
| 169 | 01-27-2023 04:16 AM | |
| 224 | 01-25-2023 08:17 PM | |
| 274 | 01-25-2023 03:13 AM | |
| 317 | 01-20-2023 03:04 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 01-20-2023 03:04 AM |
User Badges
Community Statistics
| Member Since | 01-20-2023 02:56 AM |
| Date Last Visited | 01-31-2023 07:36 AM |
| Posts | 5 |
| Total Likes Received | 1 |
01-31-2023
03:25 AM
When we change the incident from Active state to Close state, we get "closeReason", "closingUserId", and "closeNotes" in the delta of "UpdateRemoteSystemArgs". But when the incident is changed from Pending state to Active state, we do not get anything in delta, and due to which I am not able to determine whether something else has changed or the Incident state has been changed from Pending to Active.
Because, updating the remote system by checking if the incident status equals to IncidentStatus.ACTIVE, will result in marking it again and again every time something will change in this incident after it was changed to Active, which is not the wanted behaviour.
... View more
01-27-2023
04:16 AM
When the get-remote-data is being called, I am getting below errors when returning entries to the GetRemoteDataResonse. The command is executes successfully, but I do not get entries in the XSOAR incident which I have passed to the GetRemoteDataResponse. Even the incident is not getting closed though I have returned an entry with "dbotIncidentClose": true . I have attached both the screenshots below.
... View more
01-25-2023
08:17 PM
So, without the tags, it is impossible to mirror the notes/entries to the remote system. Is that you're trying to say, right? Adding the tags to the entries/notes would be a manual task. An SOC Analyst has to carefully add those tags to the entries he/she wants to mirror to the remote incident. Isn't there any other way I can get the entries/notes added to the incident in the UpdateRemoteSystemArgs parameter when the update-remote-system command is called, so that I can mirror those entries to the remote system without the intervention of the SOC Analyst adding those tags to the entries?
... View more
01-23-2023
05:47 PM
Hi @Harsh-Panchal,
1. XSOAR's incident state field is used to signify different engagement states of the investigation. The field is not used inside the mapper and so is not affected by changes to the remote ticket. You can engage a dummy playbook in the incident type with the "Run playbook automatically" set true to ensure the state is changed from Pending to Active when the incident is created.
2. The 0001-01-01T00:00:00Z value means that the sync is not yet run or in some cases its run but failed. Not sure what you mean by "due to that I'm not able to add the previous entries".
3. Note that this feature is not supported for all mirroring integrations. For ServiceNow, you need to ensure that the note or entry is tagged correctly. You can configure which tags to pick-up inside the integration like below.
4. Not sure I understand. Does this refer to point 3?
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
01-31-2023
07:36 AM
|
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks