Create an Incident - Administrator Guide - 8 - Cortex XSOAR - Cortex - Security Operations

Cortex XSOAR Administrator Guide
Product
Cortex XSOAR
Version
8
Creation date
2024-04-17
Last date published
2024-09-19
Category
Administrator Guide
Solution
Cloud
Retire_Doc
Retiring
Link_to_new_Doc
/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation
Abstract

Create a new incident in , manually, through a feed, or by importing a JSON file.

Cortex XSOAR incidents can be created manually, from a JSON file, or from an integration feed.

Note

The import JSON feature enables you to import event data from third-party software and use it to create new incidents in Cortex XSOAR. These incidents can be used to build and troubleshoot playbooks for integrations that have not yet been installed or configured.

  • Create an incident manually.

    Go to the Incidents page, click New Incident and enter relevant data, including custom fields if needed.

  • Create an incident from a JSON file.

    1. Go to Settings & Info → Settings → Object Setup → Incidents → Classification & Mapping and click the mapper you want to use.

    2. From the Get Data drop-down, choose Upload JSON then click the paper clip icon and browse to and select the JSON file you want to upload.

    3. Map the fields.

    4. From the market-gear.png menu, select + Create Incident from JSON. Select the incident type and Create Incident.

  • Fetch Incidents From an Integration Instance.