all incidents are missing

Hi everyone

All incidents from our cortex xsoar instance are missing or are not shown, but we don't have any filter. The info is still on the server because we can see all the .db files, we tried to re-index the database but this didn't solve the i

Fetching CrowdStrike Next-Gen SIEM Alerts into SOAR

Hi everyone,

How can I fetch Next-Gen SIEM alerts from CrowdStrike into XSOAR? I have already set up my Falcon integration, and I can fetch categories like endpoint detection.

As seen in the image, there is a query section available to fetch differen

Playbook Task - Filters and Transformers help needed

Hi All, 

i have a playbook task that runs a XQL query against a dataset to take info from the alert context data, do a search against a specific dataset, then take the output of the '_broker_device_name' field and then this is written to my parentinc

xsoar Custom script widget

Hi all,

im new to xsoar dashboarding

 can anyone guide me how to create a widget to get playbook execution count with playbook name and playbook tag

specific playbooks

Hello,

Are there specific playbooks or automation features that have significantly improved SOC workflows?

While True Condigtional

Hello Everyone,
I want to ask about the while loop condition in XSOAR, is it possible to do that? for example i want to check condition the agent status to see whether it is connected or not, if it is not connected set 10minutes delay and then check t

XSOAR Community Download

Where do I go to download the community edition of XSOAR?

Cortex XSOAR Installation In personal laptop

Hi folks, can anyone help me with how to install the community edition of SOAR on my personal laptop? Also, will the database server be installed automatically, or do we need to install it separately along with SOAR?

Defining a Known User Object List for Automated Playbook Logic in XSOAR

I need to define a known user list as an Object List so that the playbook can automatically check it. If the username involved in the incident is found in this known list, the condition should pass and the incident should move forward toward automati

Creating a custom command for XSOAR marketplace integration

Hello Everyone,

I wanted to create a custom command in additional to the existing commands present for one of the integrations we have configured in XSOAR from the marketplace.

How can I achieve this? I checked the documentation, but it refers to s

map incident data

Hello,

How can Cortex XSOAR be leveraged to map incident data, playbook actions, and adversary techniques to the MITRE ATT&CK Framework?

Enriching context data with info from datasets

Hi,

Is anyone able to guide me on how to achieve this perhaps?

I want to ran a task in a playbook that will do a custom query in a dataset and pull information and add it to the alert context data.. is this possible and if so guidelines would be appr

XSOAR IP Forwarding requirement

For Cortex XSOAR 6.X On-premises deployment, in server deployment / system requirements describes that IPv4 IP forwarding is required (System Requirements • Cortex XSOAR Administrator Guide • Palo Alto Networks documentation portal ). Security team i

Any.run Cloud Sandbox Integration - Instructions not Clear

Hello LiveComm,

I am attempting to establish the Any.run integration on my XSOAR. I am using the latest version and have an issue with the instance properties. Firstly, there is no "Use system proxy settings" and the instance requires URL, User, Pass