This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

Publish List Integration Pulling Wrong List Data

Integration: Publish ListVersion: 1.1.11 7843807XOSAR Version: 8.14XSOAR Engine Version: 8.14Background: We have 1 instance of Publish List hosting 3 XSOAR Lists behind 1 shared port on an XSOAR Engine. This has been running for nearly 2 years without any issues like this. This is a Community created integration. We have a backup instance with t...

Resolved! Indicator Extraction Refresh

We're migrating from playbook task enrichment per incident to auto-extraction leveraging the TIM. One such example is a playbook !extractIndicators text=${incident.sourceip} auto-extract=inline Alternatively, I've also tried configuring the incident type to extract IP-recognized indicators automatically on Source IP field. Both options work fi...

Kevin-C1 by • L0 Member
  • 307 Views
  • 2 replies
  • 0 Likes

XSOAR 8 Commercial SaaS/ Govt Cloud to Microsoft Sentinel GCC High Integration

Hi everyone, I am evaluating the integration between Cortex XSOAR 8 (Commercial SaaS / Government Cloud) and Microsoft Sentinel, which is deployed within a GCC High environment. I have the following queries: 1. CONNECTIVITYI noticed that the Microsoft Sentinel integration in XSOAR provides a "US GCC-High" option under the Azure Cloud dropdow...

Playbook stuck after upgrade

Hi! I have a playbook that gets stuck in a very weird way. I seek for community help as after my last session with product support, i do not seem to go anywhere as there were no obvious platform errors, they blame the playbook. 😞 Since the upgrade to the latest 6.14 build, one popular custom playbook is stuck on specific conditional task. It ...

support.png
Antanas by • L2 Linker
  • 755 Views
  • 1 replies
  • 0 Likes

There is now a command: !setIncident tags="<tags to be added>", which by default adds the tags you specify. One can also add the option appendTags=Fal

There is now a command: !setIncident tags="&lt;tags to be added&gt;", which by default adds the tags you specify. One can also add the option appendTags=False so that the tags are overwritten.So, to remove a tag, we have to check the existing tags, remove them from the list, and then add them with appendTags=False.This is not an atomic operation...

Redirect URL for Cortex XSOAR integration with DocuSign

When configuring the DocuSign new App and Keys for the integration with Cortex, what Redirect URL should be used? The documentation states the below. Set Redirect URI# Navigate to Additional Settings. Set the Redirect URI to https://localhost. I do get the Allow Access But after clicking I get the error Site con not be reach localhost refu...

dwight_thomas_0-1779967469163.png
dwight_thomas_1-1779967587486.png

Fetching CrowdStrike Next-Gen SIEM Alerts into SOAR

Hi everyone, How can I fetch Next-Gen SIEM alerts from CrowdStrike into XSOAR? I have already set up my Falcon integration, and I can fetch categories like endpoint detection. As seen in the image, there is a query section available to fetch different detections. Additionally, in the fetch types section, there are detection options such as endpo...

O.Isik by • L0 Member
  • 6703 Views
  • 8 replies
  • 2 Likes

Install Link

Hi! I have a license for XSOAR in my CSP account, but I am unable to download the package to reinstall it. (I had to rebuild my environment). Is there somewhere that I can get this link? Thanks! Cortex XSOAR

XSOAR community or Trial Version

Hi All, From posts/discussions year or so ago it looks like there was a XSOAR community edition or trial edition available for people who want to evaluate or learn the platform. However, I cannot find any where to download the version or any other way to build PoC environment. Is there anything out there that I can use for PoC purposes? Thanks

hamza_b by • L0 Member
  • 343 Views
  • 0 replies
  • 0 Likes

playbook completely stuck on a simple condition

Hi, Playbook stucks immediately after a simple 1=1 check condition. The issue is not a condition itself, which actually is matched fine, however the YES branch is never executed. The issue happens only if an inactive ELSE branch is quite heavy with further tasks, but why would it care, if the ELSE is never matched/executed? Happens only on 6.1...

xsoar1.png
Antanas by • L2 Linker
  • 385 Views
  • 0 replies
  • 0 Likes

HealthCheckServerConfiguration fails with TypeError on XSOAR Cloud v8.13.0

Hi Community, We are migrating from XSOAR OnPrem v6 to XSOAR Cloud (SaaS) and hit an issue with the System Diagnostics and Health Check content pack (v3.1.2, build 7827247) on Cloud v8.13.0. The problem: After creating a manual incident of type System Diagnostics and Health Check, the HealthCheck playbook starts but crashes at Task #30 — !Health...

  • 1308 Posts
  • 46 Subscriptions
Top Solution Authors
View All
Top Liked Posts
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks