fix(cortex-xdr): give a full incident its own title (1.9.0)

Browse Source

Title and description both read the incident's description, so every
ticket showed the same sentence twice. The title is now the rule that
fired, with "(+N other alerts)" when several are folded in, or the
incident's console name; the description adds what each distinct rule
means.

network_artifacts[0] no longer overwrites the alert's own flow: the
artifacts are the fallback, and the destination country comes from the
artifact matching the alert's remote IP. Also maps the rule description
and id, and the XDR assignee.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

...

This commit is contained in:

Guillaume BOURGEOIS

2026-10-05 14:25:22 +00:00

parent 0f5f4a900e

commit 91f6b8158b

2 changed files with 34 additions and 13 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

integrations/cortex-xdr/manifest.yaml

+2 -2

File diff suppressed because one or more lines are too long