FortiSOAR Knowledge Base
FortiSOAR: Security Orchestration and Response software provides innovative case management, automation, and orchestration. It pulls together all of an organization's tools, helps unify operations, and reduce alert fatigue, context switching, and the mean time to respond to incidents.
ycho
Staff
Staff
Article Id 288724
Description This article describes how to resolve the issue of not updating the 'Modified On' field even after running a PB with a Create Record with some values modified.
Scope FortiSOAR v7.4.0.
Solution

The Playbook below is designed to simply show the symptom:

 

Uniqueness conflict settings: Update existing records (all fields).

The playbook updates the existing record with the new values that you have specified in this step.

 

1-1211.png

 

When the above PB is executed, the following alert record is created by CREATE RECORD.

It is possible to see Priority Weight is 1.

 

2-1211.png

 

Next, the priority Weight value of the Create Record was changed to 2 and ran the same PB again.

 

3-1211.png

 

It is possible to see that it was run at intervals of 1 minute.

 

4-1211.png

 

 If the Alert Record is checked after running PB, it is possible to see that the Priority Weight has been changed to 2, but the value of the Modified On field has not been updated.

 

5-1211.png

 

This issue symptom was identified up to v7.4.0 and has been resolved since v7.4.1.

 

Note:

Unlike UPDATE REORD, in the case of CREATE RECORD, if the 'Record Uniqueness' field of the module selected in the Create Record step is not set to Name, but is specified as a Source ID or other unique value, a new record is created for each PB run, and 'Created On' and 'Modified On' are output the same as at the time of creation.

To check the change history of the created record, it is possible to specify the unique value of 'Record Uniqueness' before upgrading, and then create a new record and check the time of change with Created On, rather than updating the existing record.

 

Contributors