This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

Multiple XDR integrations in XSOAR

Hi team Where we have multiple XDR tenants integrated into XSOAR, how can a playbook determine which tenant they are working with? For e.g. by running "!xdr-update-incident", the incident identifier is the XDR incident ID ("incident_id") which the value can be the same across multiple tenants. Is there a way to tell a certain command that we a...

tmeksik by • L2 Linker
  • 805 Views
  • 1 replies
  • 0 Likes

Running a Task on Multiple Instances of an Integration - Playbook Optimization

Hello,we are working on a playbook that needs to run a single task on 10 different instances of the same integration. Currently, the only way we know to handle this is by creating a separate sub-playbook for each instance, with the task configured to run on each of the 10 instances. As a result, the main playbook consists of 10 separate sub-play...

MF762 by • L1 Bithead
  • 2869 Views
  • 3 replies
  • 0 Likes

Resolved! ML Content Pack Issue - Phishing Email

I'm currently developing a phishing email playbook that includes the ML module DBotPredictOutOfTheBoxV2, which is causing issues. Upon investigation, I found that the Machine Learning content pack is installed, but the Demisto image demisto/ml is not available. If you have any insights or solutions, I would greatly appreciate your help. I got th...

Syedhkt_0-1727335022455.png
Syedhkt by • L2 Linker
  • 1775 Views
  • 2 replies
  • 0 Likes

xsoar license

I currently have 5 SOAR licenses contracted. However, I have a question: Does the Admin user consume a license? It should be noted that this user has been assigned the administrator role.

jcajam by • L0 Member
  • 965 Views
  • 1 replies
  • 0 Likes

XSOAR hosting docker container problem (exit status 125)

Hey, I have a xsoar instance hosted by PA (saas access) and today none of my containers seems to work. Any script run gives the following message Error from Scripts is : Script failed to run: "docker images demisto/python3:3.10.13.86272" with error "exit status 125" and output "Error: cannot re-exec process to join the existing user namespace H...

Cortex XSOAR Hosts File

Hello, Since we use XSOAR 8.6.0 OVA and the SSH user (Viewer) does not have authority to use sudo to alter the hosts file on the OVA, I need to add local domains to the Cortex XSOAR hosts file. Is there another SSH user with the highest privileges that you know of that could utilize it?

mnassar by • L0 Member
  • 855 Views
  • 1 replies
  • 0 Likes

How to stop a playbook task until ALL previous tasks are done?

Hi all, I'm developing a playbook for Cortex XSOAR that sends a number of queries to our SIEM in parallel and uploads the results as files to an incident. I want to introduce subsequent steps that all depend on the files existing, however I cannot figure out a good to make a "gate" task that stops the playbook from executing until all previous...

XSOAR MISP - sync

Hi,Does anyone have a #Cortex XSOAR sync with a MISP server (bidirectional sync)? I have two objectives: I have several indicators on my XSOAR, and my goal is to upload these indicators to MISP (including adding the "XSOAR" tag). XSOAR should query MISP and update local indicators based on matches found in MISP. Does anyone know if this is pos...

tlmarques by • L4 Transporter
  • 2054 Views
  • 1 replies
  • 0 Likes

XSOAR Engine Integration issue

Hi, I installed engine using Shell following instructions on https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Administrator-Guide/Install-an-Engine. Then when trying to configure Syslog v2 integration I got multiple errors. First one was related to inability to create /home/demisto folder which was solved by me manually ...

anmark by • L0 Member
  • 1283 Views
  • 1 replies
  • 0 Likes

XSOAR incident in Qradar

Hi Team, We are encountering a connection timeout issue when attempting to create incidents in Cortex XSOAR using a custom QRadar integration. Based on our observations, we suspect this issue is due to low IOPS on XSOAR, as low as 100, despite the IOPS being allocated as unlimited from the VM Console. We believe the low IOPS are causing delays...

First time create custom docker image for Cortex XSoar

We are trying to create a docker image for our in-house python dependency project that will be used in our Cortex XSOAR integration. I saw the doc said we should use demisto/dokerfiles to create the image. I followed the README file in the GitHub repo to create a new docker image, but could only create an empty image. Could anyone please hel...

BSun8 by • L0 Member
  • 1461 Views
  • 1 replies
  • 0 Likes

How add "description" message for Custom Indicators via playground commands

Hello Team, Am creating the custom indicators via playground command we need to add the "Description" message for particular IOC IP address. i.e; IOC 158.x.192.10 Description= "Honeypot Malicious IP Address" I could manually able to add description in Xsoar console > Indicators Tab > Edit Indicators Page. (Screenshot attached for you...

cV V by • L2 Linker
  • 986 Views
  • 1 replies
  • 0 Likes
  • 1305 Posts
  • 45 Subscriptions
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks