topic Re: Problem to whitelist internal domains and IP's in Cortex XSOAR Discussions

Problem to whitelist internal domains and IP's

tlmarques — Thu, 01 Feb 2024 11:32:25 GMT

Need help, as in , I'm having issues adding my domains and internal networks to a whitelist
In the settings, I have two options for this, but I can't edit them.
Anyone else experiencing the same issue? My objective was to insert and exclude internal domains and IPs from external feed analysis.

Re: Problem to whitelist internal domains and IP's

yuki_sato — Thu, 01 Feb 2024 15:57:24 GMT

Hi @tlmarques

Those are OOTB lists so you will need to detach to unlock the list to be editable. Once you are done editing, you can reattach to lock the list again.

Re: Problem to whitelist internal domains and IP's

usahitya1 — Thu, 01 Feb 2024 16:35:09 GMT

Detach, Add new data and lock it.

Re: Problem to whitelist internal domains and IP's

tlmarques — Thu, 01 Feb 2024 18:03:52 GMT

on my machines, I can't do that... even with the admin user

Re: Problem to whitelist internal domains and IP's

tlmarques — Thu, 01 Feb 2024 18:04:31 GMT

on my machines, I can't do that... even with the admin user, see image bellow.

Re: Problem to whitelist internal domains and IP's

usahitya1 — Mon, 05 Feb 2024 07:13:04 GMT

I think you need to contact the support

Re: Problem to whitelist internal domains and IP's

yuki_sato — Thu, 08 Feb 2024 21:40:30 GMT

@tlmarques

This might be due to the list being pushed from dev to prod. You won't be able to edit lists that were pushed from dev. Although this list is OOTB, if you push it from dev, it's going to behave like that.

Another way to find out is run !addToList listName="InternalDomains" listData="test". If you see any error message related to "remote repository", then the list was pushed from dev.

Re: Problem to whitelist internal domains and IP's

tlmarques — Mon, 04 Mar 2024 13:20:32 GMT

The list is default...

i try run and system give error:

Re: Problem to whitelist internal domains and IP's

Santuli — Mon, 04 Mar 2024 16:47:38 GMT

I noticed that if you are on version 6.10 it does not allow you to "detach" even if you have all the permissions enabled, however if you have version 6.12 it does allow you. At least that's the difference I noticed.