Configure incident fields for related
incidents by adding a server configuration for an allow or ignore
list in Cortex XSOAR.
You can configure an allow list or an ignore
list for which incident fields to use for related incidents. If
you define an allow list, related incidents only use specified fields
for calculation. If you define an ignore list, related incidents
are calculated without the specified fields.
Select
Settings
About
Troubleshooting
Add Server Configuration
.
Add the following
keys and values:
List type
Key
Value
Allow list
incident.metadata.whitelist
A comma-separated list of fields to add to the
allow list.
Ignore list
incident.metadata.ignore.list
A comma-separated list to exclude from related
incidents.
