XSOAR Mirroring

Facilitates mirroring of Cortex XSOAR incidents between different Cortex XSOAR tenants.

Utilities · XSOAR Mirroring

Configuration parameters

  • incidentType — Incident type
  • url — XSOAR Server URL (required)
  • apikey — API Key
  • credentials_api_key — API Key ID (for XSOAR 8.x only)
  • isFetch — Fetch incidents
  • max_fetch — Maximum number of incidents to pull per fetch
  • query — Fetch only incidents that match the query
  • first_fetch — First fetch time
  • categories — Entry Categories
  • tags — Incoming Entry tags
  • mirror_tag — Outgoing Entry Tags
  • mirror_direction — Incident Mirroring Direction
  • disable_from_same_integration — Disable fetching for incidents that came from this integration
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • debug_mode — Debug mode (will print debug logs to info)
  • mirror_playbook_id — Mirror Playbook ID
  • fetch_incident_history — Fetch incident history

Commands (4)

  • get-mapping-fields

    Retrieves the mapping schema from a remote incident.

  • get-remote-data

    Get remote data from a remote incident. Note that this method will not update the current incident. It is used for debugging purposes only.

  • xsoar-get-incident

    Retrieve incident and entries from the remote Cortex XSOAR server.

  • xsoar-search-incidents

    Search remote Cortex XSOAR for incidents.