Configure Incident Fields for Related Incidents

Configure related incident fields using server settings in Cortex XSOAR 6.12.

You can configure an allow list or an ignore list for which incident fields to use for related incidents. If you define an allow list, related incidents only use specified fields for calculation. If you define an ignore list, related incidents are calculated without the specified fields.

1. Select Settings → About → Troubleshooting → Add Server Configuration.
2. Add the following keys and values:

   List type	Key	Value
   Allow list	incident.metadata.whitelist	A comma-separated list of fields to add to the allow list.
   Ignore list	incident.metadata.ignore.list	A comma-separated list to exclude from related incidents.