This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

Where to Download XSOAR Single Server Installer Setup File

Hello Team, Kindly help where to download the xsoar server installer setup file (single server installer file i.e standalone server mode) planning to deploy xsoar test setup environment. I followed the guide single server installation steps and error occurs see the attached screen shorts.

cV V by • L2 Linker
  • 5601 Views
  • 6 replies
  • 0 Likes

Resolved! Creating Docker images

I would like to create a Docker image to make a Python Library, which is not pre-installed, available on XSOAR. Therefore, I executed the following command: /docker_image_create name=jpholiday base="demisto/python3-deb:3.8.2.6981" dependencies=jpholiday,datetime However, I encountered an error and was not successful. error creating the docker ...

MEiunyo1 by • L1 Bithead
  • 2462 Views
  • 2 replies
  • 0 Likes

Resolved! Web Scrapping

Hi All, I have some website for news and i want to get content of that webiste and send email using xsoar. Any useful integrations? Cortex XSOAR

Syedhkt by • L2 Linker
  • 3530 Views
  • 6 replies
  • 0 Likes

6.12 on RH 7.9 - Web server won't start

Hello. We tried in many ways but web server wont start. I see the server working and doing outbound connection, but it's not listening on 443. There is nothing strange in the log as I can see. I don't know what I can look at to fix that. Thanks

SPisani by • L0 Member
  • 1280 Views
  • 2 replies
  • 0 Likes

Resolved! How XDR Sync command working in XSOAR

Hello, how the !xdr-iocs-sync firstTime="True" command working in XSOAR, It will deleted IOC list in XDR IOC rules. If i need to run the sync command any proper format to run before those. I want to upload or sync 100 no's of IP's or Domain names with XDR. whether can able upload via sync command. Guide for the above queries. Regards, ...

cV V by • L2 Linker
  • 1948 Views
  • 2 replies
  • 0 Likes

Resolved! Integration/Content Packs Update Issue

Hi All, I have some integrations/Content Packs and they need to be updated but when ever I tried to update from update button on market place, it gives me error "Unavailable docker image...." how to tackle this issue and what are possible best ways to fix this Cortex XSOAR

Syedhkt by • L2 Linker
  • 1658 Views
  • 1 replies
  • 0 Likes

Non Enterprise Security Splunk users

Hi Please share some info on how you are running your setup. We are currently using the TA-Demisto splunk app to push the alerts to the XSOAR but having issues with excessive incidents in XSOAR being created when we use the |table in our searches and havent been able to figure this out. Thanks in advance for tips and tricks on this subject.

Extracting Incident Files from the Server Side or Through API

I have a functionality question regarding Incident Files, for example, images. I have uploaded images as both "Files" and "Media" on the XSOAR incident through the war room. Can these files be accessed from the DB or Linux side? Take note that this is not for a specific incident but rather a functionality access question. If not possible does th...

Playbook to upload IOCs to Cortex XDR

Hello,We are working in an integration between XSOAR and XDR.We want to upload IOCs from a given file to XDR, we have seen that Cortex XDR - IOC integration allows a synchronization of IOCs but what we want is a manual push of new IOCs to XDR, not to sync them. We don't understand the given commands of the integration and need to understand how ...

Creating a Playbook to Upload Indicators to Various XDR Tenants

Hello all, I am currently building a playbook that can pull indicators from an external MISP system and then publish them to various tenants of Cortex XDR. I have seen that there was a similar post in the past yet the solution suggested in 2022 does not appear to work as expected. In regards to available automation scripts I am using the task c...

michaelsysec242_0-1692889022972.png

How to push Bulk IOC list in file format to Cortex XDR (IP address,Malicious URLS,Malicious Hashes ) via from XSOAR

Hi Team, I have integrated the Instance Cortex XDR - IOC content pack: Cortex XDR by Palo Alto Networks kindly help me, below which command to push bulk update IOC indicators to Cortex XDR if am wrong kindly guide me. Instance = Cortex XDR - IOC Cortex XDR-IOC xdr-iocs-create-sync-file Creates the sync file for the manual process...

cV V by • L2 Linker
  • 3052 Views
  • 2 replies
  • 0 Likes

XSOAR 6.11 Content Bundle Update via API

Hello We have build a CICD Pipeline to manage Lists in a external Git-Repository. The reason for that is we want to have the option to let our analyst create message templates and config files in a versioned way. Also we don't want that our analyst have to handle the deployment of that files. Until now the external repo was relativly small and ...

JBoehm_0-1719908025087.png
JBoehm by • L1 Bithead
  • 1760 Views
  • 2 replies
  • 0 Likes

Fetch Indicator Integration

Hello i plan to implement a custom integration which fetches IP Indicators. So far so good i was able to create the indicators with no issue. However i would like to update some fields eg. Hostname and also some custom fields like a Gridfield of Vulnerabilities. But for some reason i can't update any field by side the verdict. Thats my func...

JBoehm by • L1 Bithead
  • 1835 Views
  • 2 replies
  • 0 Likes
  • 1307 Posts
  • 46 Subscriptions
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks