Skip to main content

Case ManagerCase Manager Documentation

Known Issues

SOAR-12695

If you upgrade from Case Manager i53.5 or earlier, custom parsers don't work correctly and you can't ingest data from your incident feeds.

Starting with parsers in i53.5, all hyphens, colons, or semicolons in incident type names were replaced with underscores. If your custom parser refers to a custom incident type with hyphens, colons, or semicolons, the Case Manager Parsing Engine can't parse logs for that incident type.

To resolve this issue:

  1. Before you upgrade Case Manager, navigate to /opt/exabeam/config/custom/soar-lemon/soar_parsers.conf, then identify parsers where IncidentType includes hyphens, colons, or semicolons.

  2. After you upgrade Case Manager, navigate to /opt/exabeam/config/custom/soar-lemon/soar_parsers.conf, search for the parsers you previously identified, then for IncidentType, manually replace all hyphens, colons, and semicolons with underscores.

SOAR-12718

When you manually run the Send Template Email action from an incident's workbench, you encounter a Failed to send email error because the action was incorrectly deprecated. To resolve this issue, use the Notify by Email action instead.