Cortex XSOAR Discussions

Is it possible to create a local user without email invite?

Hi team,

Is it possible to create a local user without email invite?

The customer is using XSOAR on-premise v6.12. They have a contractor (which does not have account in our AD) that we need to create a local user for, but I don't see the option

...

Resolved! Unable to read the file via remoteaccess with service account Cortex XSOAR ID: 4893410215349833399

Unable to read the file via remote access with service account Cortex XSOAR ID: 4893410215349833399 We created a service account with /usr/sbin/nologin in /etc/passwd but was unable to read the file in /home directory. However, we managed to read it

...

XSOAR Dashboards

Looking for a dashboard to pull bandwidth usage from PANOS into XSOAR.

Virus Total V3 Integration Issue

I am trying to integrate Virus total v3 in xsoar and have api key already. As you know in v3 version of virus total we cannot adjust server url so thats why I am getting issue please check and provide your useful answer

Verify that the server URL p

...

Resolved! Need to know how to check how many times a specific task within a playbook has run in a month.

Hi Team,

The customer has only Standard license I couldn't able to move to CS team. Your help will be appreciable.

The customer have a master playbook that is run on every single case raised on the platform. This master playbook contains many tasks

...

Transitioning Events/Incidents Across Analysts

Does anyone mind sharing any resources or practical examples of how they're using XSOAR to transition events/incidents across multiple analysts or shifts?

Resolved! Is there a way to launch a playbook from a button in an incident

I have a couple different use cases where I have several steps in a playbook that I would like to complete again after the playbook is complete. I basically have several steps in a playbook that I would like to have launched by a button. I am trying

...

Resolved! Playbooks repository

Does anyone know and can share if there are websites or communities like this where playbooks used in Cortex XSOAR are shared? I'm not talking about code, but flowcharts etc

Issue in health check playbook under system diagnostics and health check content pack

I have installed system diagnostics and health check content pack from marketplace(using xsoar version 6.12). I have followed the steps given in this article: https://xsoar.pan.dev/docs/reference/packs/system-diagnostics-and-health-check

The pack has

...

Extracting Domains Not from URL

Hello Live Comm,

I am working on a use-case that allows us to extract indicators from specific reports and then pushes them to monitoring systems.

We have seen that using the built-in Extract Indicator command causes domains to be extracted from URL

...

Unable to retrieve work_notes from Servicenow.

We have the Servicenow V2 integratoin enabled and we are able to retrieve "comments' but "work_notes" are not visible.

- No errors are observed (it's just empty)
- We are able to "add" work_notes from XSOAR.

- We verified the permissions of the accoun

...

Resolved! Create CSP account that does not have access to xSOAR portal

Hi team,

I have a customer, who have enabled SSO login for access to their xSOAR portal. They want to disable CSP login to the XSOAR portal but maintain the account to be used for logging support tickets in CSP. Any action plan or steps please let me

...

Resolved! Unable to fetch incident taks with Servicenow V2 integration.

Our company will use Servicenow "Incidents taks" to send a task to another team.

Currently it is only possible to fetch "sc_tasks" which are Service Catalog tasks, however these service catalog tasks are not being used in our company.

Use-case is th

...

Crowdstrike falcon incident fetching issue

Hi team,

In the crowdstrike builtin integration instance we have included the query to fetch detections as: status:['new'], but still the alerts with False Positive status are also getting fetched in XSOAR.

Resolved! Unable to send Slack block messages

I've been trying to send a block message from the SlackBlockBuilder automation. However, when I try to test it out via the debugger panel, it would result in an error.

Spoiler

Command:

!SlackBlockBuilder list_name="SLACKV3_BLOCK_ASK_URLAL

...

Discussions

Is it possible to create a local user without email invite?

Resolved! Unable to read the file via remoteaccess with service account Cortex XSOAR ID: 4893410215349833399

XSOAR Dashboards

Virus Total V3 Integration Issue

Resolved! Need to know how to check how many times a specific task within a playbook has run in a month.

Transitioning Events/Incidents Across Analysts

Resolved! Is there a way to launch a playbook from a button in an incident

Resolved! Playbooks repository

Issue in health check playbook under system diagnostics and health check content pack

Extracting Domains Not from URL

Unable to retrieve work_notes from Servicenow.

Resolved! Create CSP account that does not have access to xSOAR portal

Resolved! Unable to fetch incident taks with Servicenow V2 integration.

Crowdstrike falcon incident fetching issue

Resolved! Unable to send Slack block messages

Do we have XQL query builder feature in XSOAR

Where is the XSAOR 8 CLI Reference?

Pre Processing Rules Logs

XSOAR CMDB - SQL issue

Cortex XSOAR - Best Practice Optimize Threat Intelligence Management (TIM)

Re: Cortex XSOAR intergration with Terraform Cloud?

Splunk integration - Mirroring not working

Unlock your full community experience!

Resolved! Unable to read the file via remoteaccess with service account Cortex XSOAR ID: 4893410215349833399

Resolved! Need to know how to check how many times a specific task within a playbook has run in a month.

Resolved! Is there a way to launch a playbook from a button in an incident

Resolved! Playbooks repository

Resolved! Create CSP account that does not have access to xSOAR portal

Resolved! Unable to fetch incident taks with Servicenow V2 integration.

Resolved! Unable to send Slack block messages