Reco: fix fetch-incidents failing silently with Minimum risk level below Critical by yanivblumReco · Pull Request #46289 · demisto/content

yanivblumReco · 2026-10-18T11:17:19Z

Status

In Progress
Ready
In Hold - (Reason for hold)

Description

Fixes a regression in Reco 1.8.1 where fetch-incidents stopped returning alerts, with no error in XSOAR, whenever Minimum risk level was set below Critical.

Root cause: with a minimum risk level below Critical, the severity filter was sent to the Reco External API using the SCIM in operator, which the API rejects with HTTP 500. RecoClient.get_alerts() swallowed every exception and returned [], so the failure looked like "no new alerts". The Test button passed because it called alerts/list without a filter.
Filter: multiple severities are now sent as parenthesised eq clauses joined with or.
Error visibility: get_alerts() no longer swallows API errors, so a failed fetch is reported in XSOAR.
Test button: test-module now queries alerts with the same filter fetch-incidents uses (Preview exclusion + configured minimum risk level), so a rejected filter fails at configuration time.
Pack bumped to 1.8.2 with release notes.

Must have

Tests
Documentation

Added unit tests for the or filter, error propagation from get_alerts and fetch_incidents, and the Test button using the fetch filter. The Reco unit tests pass locally; demisto-sdk pre-commit could not be run in Docker locally, so CI is the first run.

🤖 Generated with Claude Code

relates: https://jira-dc.paloaltonetworks.com/browse/CIAC-18782

CLAassistant · 2026-10-18T11:17:27Z

Thank you for your submission! We really appreciate it. Like many open source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution.
1 out of 2 committers have signed the CLA.

✅ yanivblumReco
❌ yasta5
_{You have signed the CLA already but the status is still pending? Let us recheck it.}

content-bot · 2026-10-18T11:19:47Z

Thank you for your contribution. Your generosity and caring are unrivaled! Make sure to register your contribution by filling the Contribution Registration form, so our content wizard @kamalq97 will know the proposed changes are ready to be reviewed.
For your convenience, here is a link to the contributions SLAs document.

content-bot · 2026-10-18T11:19:49Z

Hi @yanivblumReco, thanks for contributing to the XSOAR marketplace. To receive credit for your generous contribution please follow this link.

content-bot · 2026-10-18T11:19:51Z

🤖 AI-Powered Code Review Available

Hi @kamalq97, you can leverage AI-powered code review to assist with this PR!

Available Commands:

@marketplace-ai-reviewer start review - Initiate a full AI code review
@marketplace-ai-reviewer re-review - Incremental review for new commits

yanivblumReco · 2026-10-20T12:36:39Z

Hi @ilappe @lironcohen272
Any update on the review here?

content-bot · 2026-10-21T21:06:35Z

For the Reviewer: Trigger build request has been accepted for this contribution PR.

content-bot · 2026-10-21T21:06:41Z

For the Reviewer: Successfully created a pipeline in GitLab with url: https://gitlab.xdr.pan.local/xdr/cortex-content/content/-/pipelines/13996993

marketplace-ai-reviewer · 2026-10-21T21:11:01Z

🤖 Analysis started. Please wait for results...

marketplace-ai-reviewer · 2026-10-21T21:17:03Z

🤖 AI Review Disclaimer

This review was generated by an AI-powered tool and may contain inaccuracies. Please be advised, and we extend our sincere apologies for any inconvenience this may cause.

marketplace-ai-reviewer

Thank you for your contribution! No issues found. Great work! 👍

@lironcohen272, @kamalq97 please review and approve the results generated by the AI Reviewer by responding 👍 on this comment.

lironcohen272 · 2026-10-22T07:24:16Z

Hi @yanivblumReco ,
Thank you for your contribution..

To proceed with the review process, please:

Sync your branch with the latest changes from master.
Register your contribution by filling the contribution registration form in - https://forms.gle/XDfxU4E61ZwEESSMA
Ask the partner to review the code and add the "Partner-Approvd"label after his approval.
Update docker image:
Packs/Reco/Integrations/Reco/Reco.yml: [DO106] - docker image demisto/python3:3.12.13.10404775's tag 3.12.13.10404775 is outdated. The latest tag is 3.12.14.13919218

Please let me know if you have any questions. Thank you!

* Removed unnecessary arraymap from modeling rule * Added RN

…low Critical - Send multiple severities as `eq` clauses joined with `or`; the External API returns HTTP 500 on the SCIM `in` operator. - Raise API errors from get_alerts instead of returning [], so failures are visible in XSOAR rather than looking like "no new alerts". - Make the Test button query alerts with the same filter fetch-incidents uses. - Bump pack to 1.8.2 with release notes. Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

yanivblumReco · 2026-10-23T12:53:22Z

Hi @lironcohen272, thanks for the review. Update on your points:

Sync with master - done, the branch is rebased on the latest master.
Filled the form
I approve the code changes
Docker image - done, updated to demisto/python3:3.12.14.13919218 (release notes updated as well).

content-bot added Contribution Thank you! Contributions are always welcome! External PR Partner Support Level Indicates that the contribution is for Partner supported pack labels Oct 18, 2026

content-bot changed the base branch from master to contrib/RecoLabs_reco-fetch-incidents-pagination October 18, 2026 11:19

content-bot assigned kamalq97 Oct 18, 2026

content-bot requested a review from kamalq97 October 18, 2026 11:19

ilappe requested a review from lironcohen272 October 19, 2026 09:28

ilappe assigned lironcohen272 and unassigned kamalq97 Oct 19, 2026

lironcohen272 added ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. labels Oct 21, 2026

content-bot removed the ready-for-instance-test In contribution PRs, this label will cause a trigger of a build with a modified pack from the PR. label Oct 21, 2026

marketplace-ai-reviewer removed the ready-for-ai-review The PR is ready for reviewing the PR with the AI Reviewer. label Oct 21, 2026

marketplace-ai-reviewer reviewed Oct 21, 2026

View reviewed changes

lironcohen272 added the pending-contributor The PR is pending the response of its creator label Oct 22, 2026

yasta5 and others added 3 commits October 23, 2026 11:21

Crtx 291372 Genesys Cloud modeling modification (demisto#46368)

767c807

* Removed unnecessary arraymap from modeling rule * Added RN

Reco: update Docker image to 3.12.14.13919218

e307a76

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

yanivblumReco force-pushed the reco-fetch-incidents-pagination branch from 87b6ff9 to e307a76 Compare October 23, 2026 12:39

content-bot added Partner-Approved Contribution Form Filled Whether contribution form filled or not. Partner labels Oct 23, 2026

Navigation Menu

Repository navigation

Reco: fix fetch-incidents failing silently with Minimum risk level below Critical - #46289

Reco: fix fetch-incidents failing silently with Minimum risk level below Critical#46289
yanivblumReco wants to merge 3 commits into
demisto:contrib/RecoLabs_reco-fetch-incidents-paginationfrom
RecoLabs:reco-fetch-incidents-pagination

yanivblumReco commented Oct 18, 2026 •

edited by marketplace-content-sync

Loading

Uh oh!

CLAassistant commented Oct 18, 2026 •

edited

Loading

Uh oh!

content-bot commented Oct 18, 2026

Uh oh!

content-bot commented Oct 18, 2026

Uh oh!

content-bot commented Oct 18, 2026

Uh oh!

yanivblumReco commented Oct 20, 2026

Uh oh!

content-bot commented Oct 21, 2026

Uh oh!

content-bot commented Oct 21, 2026

Uh oh!

marketplace-ai-reviewer commented Oct 21, 2026

Uh oh!

marketplace-ai-reviewer commented Oct 21, 2026

Uh oh!

marketplace-ai-reviewer left a comment

Uh oh!

lironcohen272 commented Oct 22, 2026

Uh oh!

yanivblumReco commented Oct 23, 2026 •

edited

Loading

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

Conversation

yanivblumReco commented Oct 18, 2026 • edited by marketplace-content-sync Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Status

Description

Must have

Uh oh!

CLAassistant commented Oct 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

content-bot commented Oct 18, 2026

Uh oh!

content-bot commented Oct 18, 2026

Uh oh!

content-bot commented Oct 18, 2026

🤖 AI-Powered Code Review Available

Uh oh!

yanivblumReco commented Oct 20, 2026

Uh oh!

content-bot commented Oct 21, 2026

Uh oh!

content-bot commented Oct 21, 2026

Uh oh!

marketplace-ai-reviewer commented Oct 21, 2026

Uh oh!

marketplace-ai-reviewer commented Oct 21, 2026

Uh oh!

marketplace-ai-reviewer left a comment

Choose a reason for hiding this comment

Uh oh!

lironcohen272 commented Oct 22, 2026

Uh oh!

yanivblumReco commented Oct 23, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This branch has not been deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

7 participants

yanivblumReco commented Oct 18, 2026 •

edited by marketplace-content-sync

Loading

CLAassistant commented Oct 18, 2026 •

edited

Loading

yanivblumReco commented Oct 23, 2026 •

edited

Loading