Abstract
Configure incident fields for related incidents by adding a server configuration for an allow or ignore list in Cortex XSOAR.
You can configure an allow list or an ignore list for which incident fields to use for related incidents. If you define an allow list, related incidents only use specified fields for calculation. If you define an ignore list, related incidents are calculated without the specified fields.
Select → → → .
Add the following keys and values:
List type
Key
Value
Allow list
incident.metadata.whitelist
A comma-separated list of fields to add to the allow list.
Ignore list
incident.metadata.ignore.list
A comma-separated list to exclude from related incidents.