SentinelOne v 3 2 12

[munna-metron]

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

• In Progress
• Ready
• In Hold - (Reason for hold)

Related Issues

fixes: link to the issue

Description

A few sentences describing the overall goals of the pull request's commits.

Must have

• Tests
• Documentation

[content-bot]

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @MosheEichler will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

[MosheEichler]

Hi @munna-metron,
Thank you for your contribution!
Good work :)

Plesae see my comments,
@melamedbn Please take a look on the Classifier changes.

Please feel free to reach out to me with any questions - I'm available here or on slack :)
Thanks again

[melamedbn]

Hi @munna-metron,

I couldn't understand how the changes you've made to the classifier effect the issue with using incident type with the phrase 'incident' in its name.
Please explain why you mapped both SentinelOne Incident and Incident, it doesn't seem like the right implementation.

We can schedule a short call if necessary.

Best regards,
Ben

[munna-metron]

Hi @melamedbn ,
I will try to explain the issue, what happened is when we created the mirroring feature for Sentinelone. some how we mapped some of the incidents to incident incident type, but our classifier only classifies the events which had the SentineloOne Incident as incident type. And we fixed this issue in code in V3.2.10 and corrected it with SentinelOne Incident so that our classifier identifies the incident. But some of the customers are still seeing some unclassified incidents in their Xsoar, the reason is they had some incident which pulled before 3.2.10 version. So in-order to this backward compatible we mapped this "incident" to our classifier. I hope this make sense.
if you think we need a call we can have it
Regards

[melamedbn]

Hi @melamedbn , I will try to explain the issue, what happened is when we created the mirroring feature for Sentinelone. some how we mapped some of the incidents to incident incident type, but our classifier only classifies the events which had the SentineloOne Incident as incident type. And we fixed this issue in code in V3.2.10 and corrected it with SentinelOne Incident so that our classifier identifies the incident. But some of the customers are still seeing some unclassified incidents in their Xsoar, the reason is they had some incident which pulled before 3.2.10 version. So in-order to this backward compatible we mapped this "incident" to our classifier. I hope this make sense. if you think we need a call we can have it Regards

Thanks for explaining the flow.
I would still appreciate a call to see it live.

Ben