This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

MT out of sync issue

Hi Team, One of my customer accounts in multi-tenant setup appear to be out-of-sync despite successfully syncing. I have synced accounts from the Main Account UI using both the 'Sync all accounts' and 'Sync' individually selected accounts . The content appears to have propagated, however, when clicking 'Sync' subsequent times, there are many it...

XSOAR removes roles from a user - Licensing issues?

Hi team, I currently have 6 users configured in XSOAR (including the admin user). However, we only have 5 licenses contracted. The "admin" user has the admin role.The remaining users are assigned the analyst role.Incident: I have noticed that, from time to time, XSOAR removes the role of an analyst user for no apparent reason. Questions: Is it p...

jcajam by • L0 Member
  • 968 Views
  • 1 replies
  • 0 Likes

Questions regarding the operation of Cortex Xsoar

Hi Team, I have some questions regarding the operation of Cortex Xsoar and need assistance 1. I bought a license for 5 users. Does that mean you can only create 5 users or only 5 users can be active at the same time? 2. How to classify incident ingress from ibm qradar 3. Can I use 2 nested DT query sessions? ${subplaybook-${CurrentPlayBookID...

Log bundle extraction issue with System Diagnostics and Health Check

Hi All, Is there anyone faced below issues with the content pack "System Diagnostics and Health Check" (#System Diagnostics and Health Check | Cortex XSOAR (pan.dev)) while running the main playbook 'Health Check > Health Check - Collect Log Bundle'. 1. The main playbook 'Health Check' successfully invokes sub-playbook 'Health Check - Collect...

Arpan_C by • L1 Bithead
  • 3872 Views
  • 6 replies
  • 0 Likes

XSOAR Login error when using aws load balancer

Hello This is AWS environment.I installed XSOAR 6.12 on Private EC2.Since it is not accessible from the outside, I created a Public Subnet, connected a Load Balancer, and specified the Private EC2 where XSOAR is installed in the target group. The Load Balancer DNS address uses the default value.(ex. ***-*****-**-1*********.ap-northeast-2.elb.ama...

CrowdStrike Next-Gen SIEM

Hi all, How can i fetch the alert generated by CrowdStrike Next-Gen SIEM to SOAR? Here, are the alerts generated by queries created or like Email, Cloud category. #XSOAR #CrowdStrike #Next-GenSIEM

XSOAR - Manual Review Indicators

Hi, I have created a playbook that extracts IOC from a csv in a mail.I want to ask the analyst if they want to manually review or auto block the IOCs.If the analyst marks Manual review I want it to loop over every IOC and the analyst should mark to block or not.Anybody has an idea of how to loop over every IOC.I saved it to context under ${IOC} ...

Bar_Magnezi_0-1721193781083.png

How does EmailAskUser flow work?

I configured my playbook to execute EmailAskUser script but I don't know what is happening in the background causing the completion of the next task. Can somebody explain this behavior to me? The script isn't well documented and I was wondering the difference between email communication pack and this automation. For loading an email into an exis...

lordstark_0-1723561389650.png

Get Incident List from Microsoft 365 Defender

Hi Team, I want to get the events between the dates I give from Microsoft 356 Defender. In the ‘microsoft-365-defender-incidents-list’ command, the limit is set to maximum 100. What should I do to make the limit unlimited? The command: test_data ={’$filter": “createdTime gt 2024-03-16T06:00:00.29Z and createdTime lt 2024-07-22T09:00:00.29Z”} ex...

XSOAR File Issue

Hi All, I tried to send an attachment using the attachment ID in Exchange Web Services (EWS) for Office 365, and I was also able to see the entry ID of the file in context object. However, the structure of the entry ID is different from the standard format. I created a ZIP file from a text file and uploaded it to the context, but I'm facing an i...

Syedhkt by • L2 Linker
  • 1653 Views
  • 1 replies
  • 0 Likes

Resolved! cve-2024-41110 Docker vulnerability impact XSOAR?

Who is impacted?Users of Docker Engine v19.03.x and later versions who rely on authorization plugins to make access control decisions. Who is not impacted?Users of Docker Engine v19.03.x and later versions who do not rely on authorization plugins to make access control decisions and users of all versions of Mirantis Container Runtime are not vul...

Issue in loading and pulling podman images

We are getting below error in Redhat while loading the images. Error: payload does not match any of the supported image formats: * oci: open test21.tar/index.json: not a directory * oci-archive: loading index: open /var/tmp/container_images_oci3039334482/inde x.json: no such file or directory * docker-archive: writing blob: adding layer with blo...

Evidence XSOAR

Hi everyone,Does anyone know if it's possible to paste evidence (screenshots) into an Incident using CTRL+V? I've tested it and sometimes it works, but sometimes it doesn't...Does anyone know if it's possible to create a button that allows uploading files (pictures and documents) as evidence?Cortex XSOAR

tlmarques by • L4 Transporter
  • 1023 Views
  • 1 replies
  • 0 Likes
  • 1307 Posts
  • 46 Subscriptions
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks