Skip to content

Commit

Permalink
Update mirroring.md (#1650)
Browse files Browse the repository at this point in the history
Added Classification and Mapping with Mirroring section for CRTXDOC-3771
  • Loading branch information
julieschwartz18 authored Nov 7, 2024
1 parent c9b2a6c commit b6f3ea8
Showing 1 changed file with 7 additions and 0 deletions.
7 changes: 7 additions & 0 deletions docs/integrations/mirroring.md
Original file line number Diff line number Diff line change
Expand Up @@ -234,6 +234,13 @@ def get_mapping_fields_command():
```

## Classification and Mapping with Mirroring
When incoming mirroring happens, the incident goes through both the classifier and the mapper. The classifier sets a specific value for the incident type, and the mapper updates the incident with this value, ensuring that the incident type matches what the classifier determined.
To prevent the incident type from changing during mirroring:
1. If your integration instance does not fetch incidents, do not set a default incident type, and remove the classifier.
2. Set up a second integration instance without classification that uses the same mapper.
3. Set the second integration as **Do not use by default** so playbook command executions use the first integration instance.

## Incident Fields on a Cortex XSOAR Incident
The following incident fields must be configured either in the integration or in the integration instance mapping:
* **dbotMirrorDirection**: Valid values are Both, In, or Out.
Expand Down

0 comments on commit b6f3ea8

Please sign in to comment.