Incident Management - Incidents Extradata

Overview

Get the extradata associated to all the incidents within a time range defined by the time window.

• The response is concatenated using AND condition (OR is not supported).

• The maximum result set size is >100.

• Offset is the zero-based number of incidents from the start of the result set.

Configuration

Parameters

Name - domain

Value - CortexXdrDomain

Secrets

• CortexXDRAuthorization will reference the Cortex XDR Authorization token.

• CortexXDRAuthId will reference the Cortex XDR Authorization ID.

To add a Secret, open the Secret fields and click New secret:

• Give the secret a Name.

• Turn off the Expiration date option.

• Click Add new value and paste the secret corresponding to the value.

• Click Save.

Learn more about secrets in Onum in this article.

You can now select the secret you just created in the corresponding fields.

After entering the required parameters and secrets, you can choose to manually enter the Cortex incident Management fields, or simply paste the given YAML:

Config as YAML

Toggle this ON to enable a free text field where you can paste your Cortex XDR multi alerts YAML.

withTemporalWindow: true
temporalWindow:
  duration: 5m
  offset: 5m
  tz: UTC
  format: Epoch
withAuthentication: false
withEnumerationPhase: true
enumerationPhase:
  paginationType: "fromTo"
  limit: 100
  request:
    responseType: json
    method: "POST"
    url: "https://${parameters.CortexXdrDomain}/public_api/v1/incidents/get_incidents"
    headers:
      - name: Accept
        value: "application/json"
      - name: Content-Type
        value: "application/json"
      - name: Authorization
        value: "${secrets.CortexXdrAuthorization}"
      - name: x-xdr-auth-id
        value: ${secrets.CortexXdrAuthId}
    bodyType: raw
    bodyRaw: |
      {
        "request_data": {
          "search_from": ${pagination.from},
          "search_to": ${pagination.to},
          "filters": [
            {
              "field": "creation_time",
              "operator": "gte",
              "value": ${temporalWindow.from}000
            },
            {
              "field": "creation_time",
              "operator": "lte",
              "value": ${temporalWindow.to}000
            }
          ]
        }
      }
  output:
    select: '.reply.incidents'
    map: "."
    outputMode: element
collectionPhase:
  variables:
    - source: input
      name: incident_id
      expression: ".incident_id"
      default: "0"
  paginationType: none
  request:
    responseType: json
    method: "POST"
    url: "https://${parameters.CortexXdrDomain}/public_api/v1/incidents/get_incident_extra_data"
    headers:
      - name: Accept
        value: "application/json"
      - name: Content-Type
        value: "application/json"
      - name: Authorization
        value: "${secrets.CortexXdrAuthorization}"
      - name: x-xdr-auth-id
        value: ${secrets.CortexXdrAuthId}
    bodyType: raw
    bodyRaw: |
      {
          "request_data":{
              "incident_id":"${inputs.incident_id}",
              "alerts_limit":100
          }
      }
  output:
    select: ".reply"
    map: "."
    outputMode: "element"

Manually configure

This HTTP Pull Listener now uses the data export API to extract events.

Click Create labels to move on to the next step and define the required Labels if needed.