Issue with JIRA sync comments and sync closure jobs

[rahulgk-mettle]

Hi, I'm facing an issue with JIRA Sync Comments job in Chronicle SOAR. After a JIRA ticket is created from SOAR using Create Alert Issue action in the playbook, a JIRA ticket is created and a Jira tag is assigned to the case. But when running the Sync Comments job, it fails to sync the comments to and fro. When I did some troubleshooting I found, the sync from SOAR to JIRA is not happening because of the below line. When I checked the alert doesn't have the project name info popped in.

for alert in case.get('cyber_alerts', []):
                    issue_key = alert.get('additional_data') if alert.get('reporting_product') != PRODUCT \
                        else alert.get('additional_properties', {}).get('AlertName')
                    issue_project = alert.get("security_events", [])[0].get("additional_properties", {}).get("project_name")
                    if issue_project not in project_names:
                        siemplify.LOGGER.info(f"Alert with issue key {issue_key} of project {issue_project} is not in projects:"
                                              f" {', '.join(project_names)}")
                        #continue

So if I skip this if loop, it successfully add the comment in the JIRA ticket.Similarly when syncing the comment from JIRA to SOAR, it fails because of the below line

                # Find corresponding Siemplify cases to add comment
                cases_ids_for_issue = siemplify.get_cases_by_filter(ticked_ids_free_search=issue_key, tags=[JIRA_TAG],
                                                                    statuses=[CASE_STATUS_OPEN])

The above filter doesn't return any cases in SOAR, so it fails to add the comment. When I change ticked_ids_free_search to wall_data_free_search, the filter works and the comment gets added to the SOAR.Any idea if I was doing something wrong so that the default code doesn't work or if the code is to be patched?

[owosenio]

Thanks Rahulgk,

That was really helpful.....I appreciate