This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

XSOAR Integration with Cortex XDR

Hello, we're trying to integrate Cortex XDR to our XSOAR, we already have the "Palo Alto Networks Cortex XDR - Investigation and Response" instance and we set the Starred incidents fetch window and the First fetch timestamp to 30 days (we even try to do 7 days) but the problem is that on Cortex XDR, there are some incidents from even 30 or more ...

Resolved! Engine For Hosting Web Forms For Data Collection Tasks

Hi All I am trying to create a data collection task via email wherein the end user receives an email with the link to the form. As of now, the link is hosted on my XSOAR server. I would like to host those web form on an XSOAR engine so that no one reaches out to my application server URL for submitting it. I tried to look into the documents ho...

Resolved! Extract IP's from context data

Hi Team,we want to extract and check the IP reputation of IP's from a context data value which consists of 70k IP's from EDL and i just need 1000 IP's from that context value. Could you please assist us ..? please find the attachment Cortex XSOAR

Resolved! XSOAR - Using a script to run playbook

I want to be able to click on an Indicator (i.e. a domain) in the Incidents page, run a script to kick off an approval process, once approved, continue to block. I've come to the conclusion that script execution in XSOAR is not synchronous; the script feature doesn't have the capability to wait for the user to confirm via War Room or anything ...

integration script timeout; how to increase timeout value

Support is turning me away because the question is regarding a custom integration; they suggested I post a question here.My issue is, i don't want to support troubelshoot the why the script is timing out, i just want to set the property to let it run for more than 300 seconds. Note if i re-run the script it works, it only fails sporadically.Err...

JoshBoyd by • L2 Linker
  • 2104 Views
  • 1 replies
  • 0 Likes

Using RPA from Cortex XSOAR

Hello LC, I working on a unique deployment that requires the use of RPA to do a few actions that are not supported by API on the target systems. Has anyone successfully created an integration or similar for Crayon or other RPA systems? I can see that there are some existing integrations such as PAM360 but this is a system that is not in use in m...

Resolved! Where is the id_set.json file utilized?

The purpose of id_set.json is defined here https://xsoar.pan.dev/docs/documentation/pack-docs#how-do-you-find-pack-dependencies. So it's kind of like package-lock.json in NodeJS. However, where do we need to use it? I can only see it's being used in `demisto-sdk validate`.

TPhan by • L0 Member
  • 1520 Views
  • 1 replies
  • 0 Likes

Playbook condition data input

Hi Team ,we've created a playbook condition in which if the risk is greater than zero, the IP should be added to the list created below, otherwise ., it should be added to another list . The input are in an array . How can i make them into single elements ....? please find the attachment

playbook user investigation - generic

hello everyone, I was reviewing the user investigation - generic playbook for a bit, I would like to have your support by explaining to me what types of uses this playbook could be applied to and if anyone of you already has it implemented. Thank you all

Resolved! Integration Office 365: Get mail reported by user

Hi, one question about O365 integration. Maybe it's a O365 question, not a XSOAR one, but I'd like to know if I can do it with XSOAR. I have an alert "Email reported by user as malware or phish" from Microsoft Graph Identity and Access integration. I have this data from the alert: [{"aadUserId":null,"accountName":"xxxx.yyyy","domainName":"xxxx...

MTubia by • L1 Bithead
  • 5291 Views
  • 5 replies
  • 0 Likes

Trigger action each time an answer is received on data collection task

Hi everyone, I am trying to achieve the following scenario: Send a form with data collection task, the form is closed after 4 weeks. The form asks for a hostname to contain within CrowdStrike Every time someone answers the form, I want to contain the machine in CrowdStrike. However, the task is in "waiting" mode in XSOAR. I am not sure how t...

Resolved! Can I test Playbooks with CLI?

Hi everyone, I'd like to know if it's possible to test Playbooks via the command line interface or something similar. Currently, I always use the GUI for testing purposes, loading an incident from the debugger panel and just clicking to run. However, sometimes, the GUI is too slow, especially when the playbook has a lot of "boxes" to render. Gen...

  • 1308 Posts
  • 46 Subscriptions
Top Solution Authors
View All
Top Liked Posts
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks