[Cortex XDR - IR] Fix multiple incidents pulled (#35811)

* init * init * RN
demisto · Aug 9, 2024 · 1243a19 · 1243a19
1 parent 0f5d065
commit 1243a19
Show file tree

Hide file tree

Showing 4 changed files with 10 additions and 4 deletions.
diff --git a/Packs/CortexXDR/Integrations/CortexXDRIR/CortexXDRIR.py b/Packs/CortexXDR/Integrations/CortexXDRIR/CortexXDRIR.py
@@ -1161,7 +1161,7 @@ def fetch_incidents(client, first_fetch_time, integration_instance, exclude_arti
         next_run['incidents_from_previous_run'] = []
 
     next_run['time'] = last_fetch
-    next_run['incidents_at_last_timestamp'] = new_incidents_at_last_timestamp
+    next_run['incidents_at_last_timestamp'] = new_incidents_at_last_timestamp or last_run.get('incidents_at_last_timestamp', [])
 
     return next_run, incidents
 

diff --git a/Packs/CortexXDR/Integrations/CortexXDRIR/CortexXDRIR_test.py b/Packs/CortexXDR/Integrations/CortexXDRIR/CortexXDRIR_test.py
@@ -1639,7 +1639,7 @@ def get_multiple_incidents_extra_data(self, gte_creation_time_milliseconds=0, li
     assert 'XDR Incident 4' in result_2[1]['name']
     assert last_run['incidents_at_last_timestamp'] == ['4']
 
-    # run empty test and assert last_run['incidents_at_last_timestamp'] is empty
+    # run empty test and assert last_run['incidents_at_last_timestamp'] stays the same
     last_run, result_2 = fetch_incidents(
         client=mock_client,
         first_fetch_time='3 days',
@@ -1649,4 +1649,4 @@ def get_multiple_incidents_extra_data(self, gte_creation_time_milliseconds=0, li
         max_fetch=0,
     )
 
-    assert last_run['incidents_at_last_timestamp'] == []
+    assert last_run['incidents_at_last_timestamp'] == ['4']
diff --git a/Packs/CortexXDR/ReleaseNotes/6_1_62.md b/Packs/CortexXDR/ReleaseNotes/6_1_62.md
@@ -0,0 +1,6 @@
+
+#### Integrations
+
+##### Palo Alto Networks Cortex XDR - Investigation and Response
+
+- Fixed an issue in which an incident was fetched multiple times.
diff --git a/Packs/CortexXDR/pack_metadata.json b/Packs/CortexXDR/pack_metadata.json
@@ -2,7 +2,7 @@
     "name": "Cortex XDR by Palo Alto Networks",
     "description": "Automates Cortex XDR incident response, and includes custom Cortex XDR incident views and layouts to aid analyst investigations.",
     "support": "xsoar",
-    "currentVersion": "6.1.61",
+    "currentVersion": "6.1.62",
     "author": "Cortex XSOAR",
     "url": "https://www.paloaltonetworks.com/cortex",
     "email": "",