commonfields:
  id: XSOAR Mirroring
  version: -1
fromversion: 6.0.0
name: XSOAR Mirroring
display: XSOAR Mirroring
category: Utilities
provider: Palo Alto Networks
description: Facilitates mirroring of Cortex XSOAR incidents between different Cortex XSOAR tenants.
sectionorder:
- Connect
- Collect
configuration:
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  required: false
  type: 19
  section: Collect
  advanced: true
- display: XSOAR Server URL
  name: url
  defaultvalue: https://host.docker.internal:443
  type: 0
  section: Connect
  required: true
  additionalinfo: The URL of the Cortex XSOAR server to which you are connecting.
- display: API Key
  name: apikey
  type: 4
  section: Connect
  additionalinfo: The API key to access the server. The key must be provided by the server to which you are connecting.
  hidden: true
  required: false
- name: credentials_api_key
  display: API Key ID (for XSOAR 8.x only)
  displaypassword: API Key
  additionalinfo: The API key to access the server. The key must be provided by the server to which you are connecting. When the target server is XSOAR 8.x, an API key ID is required as well (not relevant for XSOAR 6.x).
  type: 9
  section: Connect
  required: false
- display: Fetch incidents
  name: isFetch
  type: 8
  section: Collect
  required: false
- display: Maximum number of incidents to pull per fetch
  name: max_fetch
  defaultvalue: "100"
  type: 0
  section: Collect
  required: false
- display: Fetch only incidents that match the query
  name: query
  type: 0
  section: Collect
  additionalinfo: Don't add created time to the query as this field will be addressed in the "First fetch time".
  required: false
- display: First fetch time
  name: first_fetch
  defaultvalue: 3 days
  type: 0
  section: Collect
  additionalinfo: Date or relative timestamp to start fetching incidents from, in the format of <number> <time unit>. For example, 2 minutes, 12 hours, 6 days, 2 weeks, 3 months, 1 year, ISO timestamp. Default is 3 days.
  required: false
- display: Entry Categories
  name: categories
  defaultvalue: notes,chats,attachments
  type: 0
  section: Collect
  additionalinfo: Which entries to retrieve from the Cortex XSOAR server. The available options are notes, comments (chats), and files. (attachments).
  required: false
- display: Incoming Entry tags
  name: tags
  type: 0
  section: Collect
  additionalinfo: Only entries with these tags are retrieved from the Cortex XSOAR server. If no tags are listed, no entries are retrieved.
  required: false
- additionalinfo: Choose the tags to filter the entries you want to send to the other Cortex XSOAR instance. If no tags are listed, no entries will be sent.
  defaultvalue: ""
  display: Outgoing Entry Tags
  name: mirror_tag
  type: 0
  section: Collect
  required: false
- defaultvalue: Incoming And Outgoing
  display: Incident Mirroring Direction
  name: mirror_direction
  options:
  - None
  - Incoming
  - Outgoing
  - Incoming And Outgoing
  type: 15
  section: Collect
  required: false
- display: Disable fetching for incidents that came from this integration
  additionalinfo: Enable this option to disable mirroring of incidents that came from the integration of XSOAR Mirroring. This adds `-sourceBrand:"XSOAR Mirroring"` to your query.
  name: disable_from_same_integration
  defaultvalue: "true"
  type: 8
  section: Collect
  required: false
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  required: false
- display: Debug mode (will print debug logs to info)
  name: debug_mode
  type: 8
  section: Collect
  required: false
- display: Mirror Playbook ID
  name: mirror_playbook_id
  defaultvalue: "true"
  type: 8
  section: Collect
  additionalinfo: 'A parameter integration that removes the playbook ID field from incoming incidents. Note: When set to true (default), the instance will attempt to run a playbook according to the incoming ID. When set to false, the instance will run the default playbook for the incident type (if configured locally).'
  required: false
- display: Fetch incident history
  name: fetch_incident_history
  defaultvalue: "false"
  type: 8
  section: Collect
  additionalinfo: >
    Will mirror historical notes,tags and attachments in case their corresponding incidents were deleted.
    Notice can impact performance if combined with "Reset the "last run" timestamp" and multiple incidents in system.
  required: false
script:
  script: ''
  type: python
  commands:
  - name: xsoar-search-incidents
    arguments:
    - name: query
      description: Which incidents to retrieve.
      defaultValue: -status:closed -category:job
    - name: start_time
      description: From when to search.
      defaultValue: 3 days
    - name: max_results
      description: How many incidents to retrieve.
      defaultValue: "10"
    - defaultValue: id,name,type,status,severity,owner,occured
      description: Which columns to display. Default is 'id,name,type,status,severity,owner,occured'. To display all columns, insert 'all'.
      isArray: true
      name: columns
    description: Search remote Cortex XSOAR for incidents.
  - name: xsoar-get-incident
    arguments:
    - name: id
      required: true
      description: The remote incident ID.
    - name: from_date
      description: Retrieve entries that were created after the last update.
      defaultValue: 3 days
    - name: categories
      description: Retrieve only the entries from these categories.
      defaultValue: chats,notes
    - name: tags
      description: Only entries with these tags are retrieved from the Cortex XSOAR server. If no tags are listed, no entries are retrieved.
    - name: max_results
      description: Max number of entries to retrieve.
      defaultValue: "10"
    description: Retrieve incident and entries from the remote Cortex XSOAR server.
  - name: get-remote-data
    arguments:
    - name: id
      required: true
      description: The remote incident ID.
    - name: lastUpdate
      description: Retrieve entries that were created after the last update.
    description: Get remote data from a remote incident. Note that this method will not update the current incident. It is used for debugging purposes only.
  - name: get-modified-remote-data
    arguments:
    - name: lastUpdate
      description: ISO8601 timestamp of the last time the integration was synced. Only incidents modified after this time are returned.
      required: true
    description: Returns a list of incident IDs that were modified since the last sync. Used to enable incremental mirroring and avoid full blind syncs.
  - name: get-mapping-fields
    arguments: []
    description: Retrieves the mapping schema from a remote incident.
  dockerimage: demisto/python3:3.12.13.10230415
  isfetch: true
  subtype: python3
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
defaultmapperin: XSOAR-Incoming-Mapper
tests:
- No tests (auto formatted)