Create alert fields - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation
Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2024-10-13
Category
Administrator Guide
Abstract

Use the setAlert script to set and update all system alert fields.

Creating alert fields is an iterative process in which you create fields as you better understand your needs and the information available in the third-party integrations you use. You initially define alert fields after the planning stage, with mapping and classification for how the alerts will be ingested from third-party integrations into Cortex XSIAM. However, during the investigation you can also set and update alert fields using the setAlert script in a playbook task.

xsiam-setalert-script.png

Note

  • The setAlert script includes all available fields; use the scroll bar to see all the fields.

  • The name field has a limit of 600 characters. If there are more than 600 characters, you can shorten the name field to under 600 characters and then include the full information in a long text field such as the description field.

  • There are many fields already available as part of the Common Type content pack. Before creating a new alert field, check if there is an existing field that matches your needs.