Use Case Ingestion Best Practice

{
    "associatedToAll": false,
    "associatedTypes": [
        "Use Case Builder"
    ],
    "caseInsensitive": true,
    "cliName": "usecaseingestionbestpractice",
    "closeForm": false,
    "content": true,
    "editForm": true,
    "group": 0,
    "hidden": false,
    "id": "incident_usecaseingestionbestpractice",
    "isReadOnly": false,
    "locked": false,
    "name": "Use Case Ingestion Best Practice",
    "neverSetAsRequired": false,
    "openEnded": false,
    "ownerOnly": false,
    "required": false,
    "sla": 0,
    "system": false,
    "template": "# Performance Optimization and Avoiding Common Pitfalls\n### Classification and Mapping\nWhen creating incidents in XSOAR it is important to use **unique incident types** for each specific type of alert that is created/ingested. Do not create one incident type for a variety of alerts since that will cause performance issues and will make playbook development overly complex. Utilize Classifiers and Mappers wherever necessary to make your playbooks more efficient.\n\n### Database\nToo much data indexing of investigation tasks or entries can cause major database issues. Ensure the proper configurations are set (investigation.task.partial.index = 7). See the general troubleshooting guide for more details on checking the value. If no value is set, you are running the default recommended standard.\n\n### Pre-Processing Rules\nPre-processing rules enable you to perform certain actions on incidents as they are ingested into Cortex XSOAR. You can, for example, link an incoming incident to an existing incident, or under certain conditions, drop the incoming incident altogether.\n\n## Alert Filtering and Deduplication: [Cortex XSOAR 6.13 Pre-Processing Rules](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Create-Pre-Process-Rules-for-Incidents) or [Cortex XSOAR 8 Cloud Pre-Processing Rules](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Pre-process-rules) or [Cortex XSOAR 8.7 On-prem Pre-Processing Rules](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Pre-process-rules)\n## Performance Tuning For XSOAR: [General Troubleshooting](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Performance-Tuning-for-Cortex-XSOAR)\n## Classification and Mapping: [Best Practice (Cortex XSOAR 6.13)](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Classification-and-Mapping) or [Best Practice (Cortex XSOAR 8 Cloud)](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Cloud-Documentation/Classification-and-mapping) or [Best Practice (Cortex XSOAR 8.7 On-prem)](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.7/Cortex-XSOAR-On-prem-Documentation/Classification-and-mapping)\n\n",
    "threshold": 72,
    "type": "markdown",
    "unmapped": false,
    "unsearchable": true,
    "useAsKpi": false,
    "version": -1,
    "fromVersion": "6.8.0"
}