XSOAR 8 + Export Data to On-premise for Retention Compliance

Hello all, 

I have an XSOAR 8.+ tenant and need to store my incidents from up to two years ago. I understand that by default XSOAR retention policy retains incidents based on license etc. Is there a way to export the data that is half a year old to a

Customize System Emails

I see there is documentation on customizing system emails: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Administrator-Guide/Customize-System-Emails

I'm seeing placeholders such as {{ .username}} and  {{ .invName}}. Where i

Automating the regression testing of the Playbook

Hi.

I am considering automating the regression testing of the Playbook.

For instance, it would be ideal if we could confirm whether the existing paths can still transition smoothly when a user adds one more branch to the ConditionalTask in the Playb

Whats is the best MFA (and free) to combine with GlobalProtect in Palo?

Hello Team,

I am looking to configure MFA in GlobalProtect. Could somebody helps me?

Thanks so much

Regards

Azure Active Directory users - Incorrect padding

I am trying to connect an Azure AD (EntraID) to Cortex XSOAR  so that I can use the user-disable playbooks. However, each time I try to authenticate i get the below error

Error in Microsoft authorization: Incorrect padding Please check authentication

Custom Logs / Path Monitor Alert

Hello!

I may be trying to do something impossible, but it seems like the configuration elements are all there.  We have a static default route to our ISP that is set with path monitoring so that we failover to a backup route when the gateway is unr

April 2025 Fuel Workshop - Register Now: GlobalProtect with SAML Authentication

2 min read

Please join us on April 29 from 9 a.m. to to 11:30 p.m. Singapore Standard Time (GMT+8) for Fuel's next Workshop! Register now to learn about GlobalProtect with SAML Authentication from Siddhant Chawla.

Register now for the April 29 Fuel Worksho

Options to onboard Microsoft Message trace logs into XSIAM

As we have an option in Splunk to see the all the message tracking logs through Microsoft message trace app, do we have any similar app to integrate?

Cortex XSIAM 

PAN-DB cloud list loading failed (ERROR:SSL connect error

The active firewall is connected while the passive is not connected. In that case sometimes we getting, 

PAN-DB cloud list loading failed (ERROR:SSL connect error

I believe we can ignore this error message if it's getting the error once in awhile sinc

IPSec intermittent disconnection issue

Hi,

Is there a command to check if a tunnel went down on a specific time and why it happened.

I have a tunnel set-up to a 3rd party where they keep monitoring some of their servers. They inform me that they receive alarms every hour that the endpoi

Panorama SDWAN - only_local_prefixes error

Hello all,

I'm working to setup Panorama SDWAN and so far it's going well.  I have tunnels auto-configured and traffic is passing; however, when I commit i receive this warning:

In virtual-router VR-Static, BGP export policy only_local_prefixes is en

Extract Incident context data using 'set' script

Hi All

very simple task running the 'set' script in a very basic playbook in xsiam

i am trying to pull the 'xsiam url link to the incident' from the incident context data ${parentIncidentFields.xdr_url} into a set task.. but it keeps showing as empty

Global Protect ARM64 Webview2 Issue

I've been working with a Snapdragon ARM64 processor and can't get 6.2.8.1-183 ARM64 to install properly. I've repaired webview2, uninstalled and reinstalled GP and still a no go. Error message is still: "cannot found the webview2 component" and when

GlobalProtect Authentication SAML plus certificate (backup mode)

I would like to know if it is possible to configure SAML to authenticate and in case something in the SAML part is not working, certificate authentication is used. This is for GP authentication.

So SAML + certificate auth (backup option).

I underst