XSOAR Mirroring
Facilitates mirroring of Cortex XSOAR incidents between different Cortex XSOAR tenants.
- Category
- Utilities
- Pack
- XSOARmirroring
Configuration parameters
- incidentType — Incident type
- incidentFetchInterval — Incidents Fetch Interval
- url — XSOAR Server URL (required)
- apikey — API Key
- credentials_api_key — API Key ID (for XSOAR 8.x only)
- isFetch — Fetch incidents
- max_fetch — Maximum number of incidents to pull per fetch
- query — Fetch only incidents that match the query
- first_fetch — First fetch time
- categories — Entry Categories
- tags — Incoming Entry tags
- mirror_tag — Outgoing Entry Tags
- mirror_direction — Incident Mirroring Direction
- disable_from_same_integration — Disable fetching for incidents that came from this integration
- insecure — Trust any certificate (not secure)
- proxy — Use system proxy settings
- debug_mode — Debug mode (will print debug logs to info)
- mirror_playbook_id — Mirror Playbook ID
- fetch_incident_history — Fetch incident history
Commands (5)
- get-mapping-fields — Retrieves the mapping schema from a remote incident.
- get-modified-remote-data — Returns a list of incident IDs that were modified since the last sync. Used to enable incremental mirroring and avoid full blind syncs.
- get-remote-data — Get remote data from a remote incident. Note that this method will not update the current incident. It is used for debugging purposes only.
- xsoar-get-incident — Retrieve incident and entries from the remote Cortex XSOAR server.
- xsoar-search-incidents — Search remote Cortex XSOAR for incidents.