Fix PhishER fetch-incidents missed messages / EIR-14074#44296
Conversation
PhishER indexes messages asynchronously; reported_at can lag by hours.
Messages with reported_at below the last-run cursor were permanently lost.
- Added look_back parameter (default 15 min) to widen the fetch window
- Adopted XSOAR SDK lookback helpers for built-in dedup (found_incident_ids)
- Migrated legacy {last_fetch} lastRun shape transparently on first run
- Closed fetch window to reported_at:{start TO end} to bound each query
- Bumped pack to 1.0.20
content-bot
added
Contribution
content-bot
changed the base branch from
master
to
contrib/marcom-kb4_contrib/knowbe4-phisher-fetch-lookback
|
Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @kamalq97 will know the proposed changes are ready to be reviewed. |
|
Hi @marcom-kb4, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link. |
🤖 AI-Powered Code Review AvailableHi @kamalq97, you can leverage AI-powered code review to assist with this PR! Available Commands:
|
|
Hi @marcom-kb4, This PR does not yet have partner approval. If you are a developer from the partner organization:
If you are a member of our XSOAR Content development community:
|
kamalq97
added
pending-contributor
content-bot
added
Community
Contribution Form Filled
done! |
|
Hi @marcom-kb4 Thank you for filling the contribution registration form. This PR still missing partner approval unfortunately. |
3 participants
Contributing to Cortex XSOAR Content
Make sure to register your contribution by filling the contribution registration form
The Pull Request will be reviewed only after the contribution registration form is filled.
Status
Related Issues
EIR-14207
Description
PhishER indexes messages asynchronously; reported_at can lag by hours. Messages with reported_at below the last-run cursor were permanently lost.
Must have
relates: https://jira-dc.paloaltonetworks.com/browse/CIAC-16776