Using Microsoft Authenticator MFA

Hello LiveComm,

I am working on using MFA for authentication to xsoar on a server that has Active Directory (On-Prem) SAML authentication already in use. The use case is to require the user to authenticate using the Microsoft Authenticator app. I hav

O365 mail Graph API Integration - Best Practices

Hey all,

I was exploring O365 graph API and wondering what are some of the best practices for this integration.

One thing we came up was to IP restriction (Palo alto IP) in Microsoft side.

Are there any other condition access policies that can

Unable to read the file via remoteaccess with service account Cortex XSOAR ID: 4893410215349833399

Unable to read the file via remote access with service account Cortex XSOAR ID: 4893410215349833399 We created a service account with /usr/sbin/nologin in /etc/passwd but was unable to read the file in /home directory. However, we managed to read it

Access to XSOAR Community edition

Hello everybody,

after reading through some of the threads here, most people run into a similar issue as I did. 

Not receiving the URL to download - has anyone found a suitable solution? 

I used a company email, I waited a week for it to come aft

Community Edition

Hello, I have signed up for the community edition, however I have never received the download URL. Also, I signed up for the DFIR, but cannot access the slack, as the link is expired when sent.

how can I get cortex Community Edition

Hi,

I filled out the form for the community edition at https://start.paloaltonetworks.com/sign-up-for-community-edition.html. I have received a confirmation email and an email for more information I have replied.

unfortunately I get no response to use

Creating a Queue on Slack Integration

Hello all, 

I am working with Slack from the playbook level where a message summarizing an incident is sent followed by Slackask automation to ask users on a channel to confirm the information with two interactive buttons. Take note that the flow has

Cortex XSOAR - Community Edition Support

Post here for all of your Community Edition support questions and one of our product experts will get back to you soon! 

XSOAR Incident Re Run

soemtimes for testing purpose we need to create similar incident again but I am stuck at this phase. I have exisiting incident and i want to re run it(either manually create, duplicate and re run it or just simply re run exisitng incident, or importi

XSOAR Upgradtion Issue

Cortex XSOAR 8 will have a new FQDN and IP Address in the new platform. May I know is there any existing playbook have pulled the XSOAR data, and export to third-party platform automatically? If yes, it may require to re-configure the IP Address.

C

Does demisto xsoar support automatically assign tickets to analyst based on a list

Need help

We have several analysts on schedule to perform ticket review bi-weekly.

I have used a demisto xsoar job to generate a ticket review ticket every 2 weeks.

However, how do i assign this ticket to the analyst automatically based on the shif

Creating a ServiceNow incident by taking the Slack user responses

Hi All,

We have a requirement to create a ServiceNow ticket by taking the slack user responses.

I have built a playbook which does send the SlackBlockBuilder to the specified Slack channel but the playbook runs only when an incident is attached to it

Pulling updated hash values of unwanted softwares from unit 42.

Hi Everyone,

Is there any possibility within Cortex XSOAR to pull updated hash values of unwanted software from unit42?

Scenario: If we have a list of hash values of unwanted software (like Team viewer for eg) and we enrich the hash indicators us

XSOAR - GET-GPO DisplayName

Hi,

I've created a playbook to analyze some alerts related to SOC and GPO, but the alerts come with ObjectGUID and I need to convert the GUID to DisplayName.

In PowerShell, the command is simple: (Get-GPO -Guid "$GUID").DisplayName.

I tried running

Issue in enabling the "content-repository" feature.

Hi Team, I have a customer who wants to enable the "content-repository" built-in feature.

They tried the below steps:
1. First, they have enabled the feature successfully in DEV.
2. Next, when they enabled the feature in PROD, they got an error (refer