XSOAR SLA Script

Hi everyone,

I have a question regarding SLA tagged scripts on XSOAR. 

I have a field-change-triggerred script that starts an SLA timer within automation if the field is changed to certain values. This part is okay and we observe that the sla timer

Is there Any STIX format for external threat feeds via TAXII Protocol

Hi Palo Alto Community,

Is there any documentation or configuration for Palo Alto NGFW that can be integrate with some external threat intelligence feed (via TAXII) to block any IoCs list? I need documentation for direct device, but if you have doc

XSOAR - Scaling for pop-up windows and drop-down menus

Currently there are several areas of the Cortex XSOAR platform experience where pop-up windows and drop down menus appear in a static size regardless of available screen real estate.  Automatic scaling to the existing window size would be fantastic! 

SplunkPy w/ES 8 Capability

Those of you that work with a Splunk environment with Enterprise Security, what has been your experience? 

We were fine until we upgraded to ES 8.x...

SplunkPy Integration

Hi everyone,
I get data from splunk with the "search index=notable" query using Splunkpy. I assign the incoming data to the type named Splunk Generic Notable by default. Here, when an incident occurs, there are fields such as event_code, process_name

Splunk integration - Mirroring not working

I have a problem with the incoming mirroring, the comments have not been synced back to XSOAR when using Splunk ES8.

As a result I upgraded the splunk content pack to 3.3, but now the entire mirroring is broken. No updates are synced back to XSOAR (V

Ability to paste images in Incident Tasks

As in War Room, it would be very useful to be able to paste an image from the clipboard using Ctrl+V for Add-on type tasks. For example, this could be provided through the add-on pop-up (Screenshot 2) in the Incident Tasks section (Screenshot 1).

Cor

Splunk Search Result Issue

Dear All,

I have query that return 11587 records, i checked on splunk. I run this query on xsoar but it showed me total record is 11587 but the actual data is 4900 i trying to figure out, i checked event limit size, query setting all fine but still i

Couldn't sort by date in bar graph widget in Dashboard

We couldn't sort by date in bar graph widget in custom dashboard. We are in XSOAR 8.7.

Please assist.

How to access context data from a send-notifcation command used in ask-by communication channel of data collection?

Hi everyone, 

We’re working with a custom integration that includes a command called send-notification, designed to request customer confirmation regarding an incident. This command is intended for use within the data collection communication chann

XSOAR Mark war room entries as note

Hi everyone,

I have button in the incident layout and the script it triggers creates a new incident and posts all of the war room entries to the new incident. In the incident, we have some notes that should also be seen as notes in the new incident

Is possible to implement Failover Handling Integration (BYOI)

Is possible to implement own BYOI Integration with failover handling between multiple engine without load-balancing group because we concerned about the sequence of "Run on" engines must be run on primary engine first and secondary after primary is f

Xsoar-web-server to setup a web form submission

I am currently using a setup where a google form is hosted and a google apps script send the data over to XSOAR upon submission on google form.
How about the integrated "Xsoar-web-server" 

Is there a way we could use this to eliminate google form and

Retrieve screenshots from Notes section

Hi!

We are trying to give more importance to XSOAR within our SOC processes. As part of the changes we are introducing, we want all alert documentation to be done from now on in the 'Notes' section of each XSOAR incident.

The issue we are facing

WHOIS Integration - Connection Refused Errors

Hi All,

I am using hois integration to use "domain" command. I sometimes have array of strings for domains and sometimes single string and in most of cases whois return results to me but i got sometimes "Connection Refused" Issue. I already adjusted