Update incident fields - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation
Product
Cortex XSIAM
Creation date
2024-03-06
Last date published
2024-09-12
Category
Administrator Guide
Abstract

Use a playbook, script, or command to update incident fields.

Sometimes you need to update incident fields based on a change in an alert. For example, after starting an investigation an analyst might want to change the name of an incident, star an incident, or change the status of an incident.

You can update the following incident fields through a playbook, script, or command:

  • manual_severity

  • starred

  • assigned_user_email

  • status

  • score

  • incident_name

  • description

The following sections explain how to update incident fields by running a command in the CLI, and running a script, and running a playbook.

Use the CLI

Run the !setParentIncidentFields command in the alert War Room or the Incident War Room.

When you start typing the CLI provides the available options. If you select an enum field the CLI provides the available values.

Examples

  • To change the name of the incident to Malware, run

    !setParentIncidentFields incident_name=Malware

  • To change the name of the incident to Malware and star the incident, run

    !setParentIncidentFields incident_name=Malware starred=true
Use a script

When a script runs in an alert, the data from the script is added to the alert context data and the alert fields. If you want to update incident fields, in a Json file, add the setParentIncidentFields to the demisto.executeCommand function.

Example

To update the incident status to resolved, run

demisto.executeCommand("setParentIncidentFields", {"status":"resolved_other"})

Note

Ensure that you have the required RBAC permission to write scripts.

Use a playbook

When running a playbook, by default the data is added to the alert context data and alert fields. You can additionally add this data to incident context data and incident fields by configuring tasks in a playbook.

The following example explains how to add tasks to a playbook that update the incident fields to star an incident, and add the key starred: true to the incident context data.

  1. Add the following tasks to a new or existing playbook.

    1. Create a Conditional task to check whether the parent incident fields are starred using the ${parentIncidentFields.starred} key.

      parent-incident-task.png

    2. Create a standard task using the setParentIncidentFields script to update the starred field.

      parent-incident-task2.png

    3. Create a standard task to print the value to the War Room.

      parent-incident-task3.png

  2. Run the playbook.

    In the incident context data, you can see the key starred: true. If running in an alert or an incident, after refreshing the incident, the incident is now starred.