Fix PhishER fetch-incidents missed messages / EIR-14074

[marcom-kb4]

Contributing to Cortex XSOAR Content

Make sure to register your contribution by filling the contribution registration form

The Pull Request will be reviewed only after the contribution registration form is filled.

Status

• In Progress
• Ready
• In Hold - (Reason for hold)

Related Issues

EIR-14207

Description

PhishER indexes messages asynchronously; reported_at can lag by hours. Messages with reported_at below the last-run cursor were permanently lost.

• Added look_back parameter (default 15 min) to widen the fetch window
• Adopted XSOAR SDK lookback helpers for built-in dedup (found_incident_ids)
• Migrated legacy {last_fetch} lastRun shape transparently on first run
• Closed fetch window to reported_at:{start TO end} to bound each query
• Bumped pack to 1.0.20

Must have

• Tests
• Documentation

relates: https://jira-dc.paloaltonetworks.com/browse/CIAC-16776

[content-bot]

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @kamalq97 will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

[content-bot]

Hi @marcom-kb4, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link.

[content-bot]

🤖 AI-Powered Code Review Available

Hi @kamalq97, you can leverage AI-powered code review to assist with this PR!

Available Commands:

• @marketplace-ai-reviewer start review - Initiate a full AI code review
• @marketplace-ai-reviewer re-review - Incremental review for new commits

[kamalq97]

Hi @marcom-kb4,

This PR does not yet have partner approval.

If you are a developer from the partner organization:

• Please ensure the Partner ID is provided when filling the the Contribution Registration form.
  • To find your Partner ID, log into the partner portal and locate the Account ID displayed at the top of the homepage; if you cannot access the portal or find the ID, please contact techpartnerportal@paloaltonetworks.com

If you are a member of our XSOAR Content development community:

• Please confirm by commenting here or contacting me via the Cortex DFIR Community Slack.
  • We will reach out to the partner and ask for their approval of the changes in this PR.

[marcom-kb4]

Hi @marcom-kb4,

This PR does not yet have partner approval.

If you are a developer from the partner organization:

• Please ensure the Partner ID is provided when filling the the Contribution Registration form.

  • To find your Partner ID, log into the partner portal and locate the Account ID displayed at the top of the homepage; if you cannot access the portal or find the ID, please contact techpartnerportal@paloaltonetworks.com

If you are a member of our XSOAR Content development community:

• Please confirm by commenting here or contacting me via the Cortex DFIR Community Slack.

  • We will reach out to the partner and ask for their approval of the changes in this PR.

done!

[kamalq97]

Hi @marcom-kb4

Thank you for filling the contribution registration form. This PR still missing partner approval unfortunately.
Please ensure the Partner ID is provided when filling the form (re-submitting the form if needed).