This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

Update Classifier from API

Hi,we have an issue regarding classifiers, and we would like to ask if it is possible to interact with them using an automation or from the API. Specifically, I am interested in understanding:- Whether XSOAR provides built-in capabilities or tools for automating classification based on incident data.- Whether it is possible to update the classif...

MViafora by • L0 Member
  • 1641 Views
  • 3 replies
  • 0 Likes

Prod to dev

I want to change my production environment XSOAR to DEV environment, and after that i will create new production environment. I want to know how to move the production to dev including changing the IP

Cortex XSOAR report blank page

Hey, we conducted a final test of the phishing playbook, and everything appeared to be functioning properly. Once the playbook completes, it is supposed to generate a report as usual. However, the report is being generated as a blank page, which wasn’t the case previously. I suspect this might be related to timeout settings. I referred to some d...

Issue with Nutanix VM Creation for XSOAR v8.7 - "Boot Device Not Found"

Hello XSOAR Community, I’m encountering an issue when deploying Cortex XSOAR v8.7 on a Nutanix environment. Every time I create a VM using the provided OVA file, the VM fails to boot and displays the error: “Boot device not found. Please install an operating system, or play 2048.” I’ve double-checked the deployment steps and ensured the OVA file...

userLoginName_0-1734439349102.png

SQL results into layout

Hi 😀, I’m running a playbook that generates multiple SQL results. What are the best practices for displaying these effectively in the incident layout? Should I use Markdown, custom sections, or widgets? Any tips for handling this? Thanks!

XSOAR Feature Request

Hello all xsoar enthusiasts, There is a FR that helps us to make xsoar a better place for MS Defender integration. Please upvote this FR here: Add Microsoft Sentinel | Cortex XSOAR Customer Feature RequestFR Description:Palo Alto offers a range of Microsoft integrations such as: Microsoft 365 Defender, Microsoft Graph Security, Microsoft Senti...

ServiceNow Developer looking for ideas

Hello all, I am a ServiceNow developer that is assisting a user that is using the XSOAR integration. The user is using the XSOAR application to run queries on my SN instance, but is not getting any results. I have checked his API account and it works fine in Postman. I shared the Postman information with my customer and it worked fine ...

Child Incident Evidence In Parent

Hello! I need to mark some child incident entries as notes and evidence in the parent incident. I have found ways in which you can pass the entries to the parent and then mark them as note/evidence in the parent. However, I would like to have an automation in the child incident playbook which would automatically mark the entries as note/evidence...

nickvus0 by • L0 Member
  • 1012 Views
  • 1 replies
  • 0 Likes

Resolved! How to Copy Incident Files from Linked Incidents

Hello Live Community, I am working on a use-case that requires me to copy incident files of any kind from within linked incidents and copy them to the main incident to be saved as evidence. I have tried the getentries command but an entryID does not suffice as the physical file is not copied t my incident. Does anyone have an idea on how to do t...

How to Automatically Send an Email When an Incident is Created in XSOAR?

Hello, I want to automatically send an email whenever an incident is created in XSOAR. I’ve created a playbook and written a simple script that sends an email for a specific incident when executed within the playbook. However, I’d like to automate this process so that an email is sent automatically for every incident without manually triggering ...

O.Isik by • L0 Member
  • 1661 Views
  • 1 replies
  • 0 Likes

Remove apps with Playbook XSOAR XDR

I would like to know about your experience. How do you handle uninstalling software on specific devices that are not allowed and need to be removed via Cortex XDR with Cortex XSOAR Playbooks without the user see the uninstall.

tlmarques by • L4 Transporter
  • 1021 Views
  • 1 replies
  • 0 Likes

Web File Repository Integration error "Failed to execute wfr-status command"

Hi, Anyone encountered the following error when executing "wfr-status"? Command: !wfr-status(Web File Repository) Reason Failed to execute wfr-status command. Error: Verify that the server URL parameter is correct and that you have access to the server from your host. Error Type: <requests.exceptions.ConnectionError> HTTPCo...

SerKuan by • L0 Member
  • 1329 Views
  • 2 replies
  • 0 Likes

Resolved! About XSOAR Free Edition Licenses

Dear All, I installed the free version of XSOAR.However, when I installed XSOAR after the 30-day free license period, the license was not applied properly when I applied the license file. Can I get the free license again by applying again from the following site? https://start.paloaltonetworks.com/sign-up-for-community-edition.html?hsCtaTrac...

Resolved! Field Change Script To System Fields

Hey CommunityDid anyone ever attach a field change trigger script to a system field? I guess it can't be done directly but is there a work around? Also, is there a way to run a script as soon as incident is created Cortex XSOAR

  • 1308 Posts
  • 46 Subscriptions
Top Solution Authors
View All
Top Liked Posts
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks