+3Can this be updated
This job is failing as it is not taking into account alerts from insider risk policies for example or dlp
They are prefixed ir or dlp etc
additional.fields["provider_alert_id"]:"86954c42-15b0-4976-8fbf-9fcc9f52bec8" is actually ir86954c42-15b0-4976-8fbf-9fcc9f52bec8
[2026-08-18,14:36:50,000 INFO] Found 0 case ids to sync: []
Or am I missing something?
Thanks in advance
Best answer by MitchellR
Hey there,
From what you’ve shared, the issue may actually lay with the parser on the SIEM side. In the raw log, does the alert GUID contain the MS prefix for the source type (e.g. `ir` in your example)?
It’s likely the capture pattern is looking for a proper GUID, which wouldn’t include the prefix that MS prepends.
For the SOAR job itself, in my tenant on the latest version of the integration (last updated on Aug 11), the code for both that job + its associated manager checks out against the Graph API’s docs.
+3Hey there,
From what you’ve shared, the issue may actually lay with the parser on the SIEM side. In the raw log, does the alert GUID contain the MS prefix for the source type (e.g. `ir` in your example)?
It’s likely the capture pattern is looking for a proper GUID, which wouldn’t include the prefix that MS prepends.
For the SOAR job itself, in my tenant on the latest version of the integration (last updated on Aug 11), the code for both that job + its associated manager checks out against the Graph API’s docs.
+3Looked at the raw logs and found
metadata.product_log_id"ir5e7cb5ff-8a84-4d51-a473-21c52e45f9ee"
metadata.url_back_to_product"https://security.microsoft.com/alerts/ir5e7cb5ff-8a84-4d51-a473-21c52e45f9ee?tid=redacted"
additional.fields["provider_alert_id"]"5e7cb5ff-8a84-4d51-a473-21c52e45f9ee"
I have now created a parser extension to map the additional fields to alert_id
Thanks for the tip will post an update :)
+3Glad to hear! Since the `product_log_id` contains the prefix, I’d just find the associated parser capture for that field and update the additional field capture pattern to match.
+21
+3Thanks all got this sorted now, apologies for the delay in replying, trying to work this in around other priorities.
Was a case of properly getting the case id in, which I did with parser extension where needed.
Enter your E-mail address. We'll send you an e-mail with instructions to reset your password.
