The XSOAR event-to-incident pipeline is clearly defined in the admin documentation:Ingestion → Classification → Pre-Processing → Incident Creation → Playbook Execution. Classification must occurbeforepre-process rules because the system must determine an incident type (or classification result) before evaluating any pre-process logic that may drop, merge, link, or modify the incoming incident.
Pre-process rules use fields created during the classification stage—including incident type, normalized values, and extracted fields—to determine whether an incident should be suppressed, modified, or related to an existing incident. Without classification completing first, the rule engine would not have the necessary structured data.
Mapping, which transforms raw event fields into incident fields, occursafterclassification but during incident creation, meaning it also precedes playbook execution but not pre-process evaluation.
Therefore, optionD (Classification)is the only correct prerequisite. Pre-process rules cannot run at ingestion time (option C). Playbook execution (option B) happensafterthe incident is created. Mapping (option A) is not a prerequisite for pre-process rules.
