This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

Nested variables in XSOAR ? Interpolation?

I would like to use a Context key Value as a variable in a task, is this possible, or how are people accomplishing this in XSOAR? Do i need to create a custom script? I saw someone else mention they were able to do something similar with Lists, but I am not sure how that would work. For Example: ContexKey1 : ContextKey2.Key ContextKey2.Ke...

kbratt by • L1 Bithead
  • 2335 Views
  • 2 replies
  • 0 Likes

XSOAR Playbook SQL Query

hello everyone ! I'm new to XSOAR, I hope you'll be patient with me. I have created a small job in which I execute a SELECT type SQL query, the result is a series of records. Here I have some doubts:- How can I map the result of each record in each field of type "Output"? My goal is to add a new task which executes some conditionals based on t...

XSOAR Execute query SQL

Hello !! I have created an automation to execute a SQL query (SELECT), however additional fields appear in the result ("module name", "brand", etc). How can I remove these fields? My intention is to email the result of the SELECT query only the fields that are within the query. Thank you

Problem to whitelist internal domains and IP's

Need help, as in Cortex XSOAR , I'm having issues adding my domains and internal networks to a whitelistIn the settings, I have two options for this, but I can't edit them. Anyone else experiencing the same issue? My objective was to insert and exclude internal domains and IPs from external feed analysis.

tlmarques_0-1706787040765.png
tlmarques by • L4 Transporter
  • 4047 Views
  • 8 replies
  • 0 Likes

How can I get the scores of the indicators I extract with commands?

Greetings to everyone, With the help of an automation, I extract indicators from incoming incidents. I do this by running commands that createNewIndicator and then enrichIndicator. But these are not written to the context. I need to write them to the context, find out if it is Malicious or Suspicious and send it as an email. When I search with t...

Mutli-Tenant - Playbook Sync

Hello, Do I have to select everything individually when syncing content from main tenant to child tenants?For example,I will sync the playbook, I cannot see the indicent fields used in the playbook. I have to select them one by one.How can I make it sync the dependencies in the playbook while syncing the just playbook instead?

Data Entry (Data collection) Issue after XSOAR 8.5 update

After the XSOAR 8.5 update, our playbook data collection tasks are having data entry issues via the keyboard. The user can enter the first character, but each successive characters needs to be "double-striked" (hit twice) to be recognized. This is across the board in all playbooks. Are other having this issue with XSOAR 8.5 SaaS ?

DBruce by • L0 Member
  • 1375 Views
  • 1 replies
  • 0 Likes

Resolved! ThreatConnect's reputation commands does not return correct results when no indicator found

Hi all, I am not sure if this is a bug in ThreatConnect pack since its reputation commands does not return correct results when it could not find the indicator. The correct behavior should be https://xsoar.pan.dev/docs/integrations/dbot#unknown. Since it does not return correct results in those cases, we have no idea if the command has ever ru...

TPhan_0-1708785626717.png
TPhan by • L0 Member
  • 1648 Views
  • 1 replies
  • 0 Likes

Using the Customer Service Management ServiceNow Plugin with Cortex XSOAR

Hello all, I wanted to share the following procedure I worked through to use the existing XSOAR ServiceNow V2 Integration with the Customer Service Management plugin for ServiceNow. This topic came up during a customer engagement and I was able to work up the below steps to use the create/update/get/delete record commands in the existing integ...

image.png

Resolved! Incident Tables in Custom Layouts

I have a custom layout containing an Linked Incidents table panel. I've edited this layout/table to present specific incident fields (columns) in a defined order. First, I've noticed this does not always show changes to these columns when editing the layout. For example, adding the Action field, and moving it up between two other values - this d...

Resolved! Dynamic user input

Hi, I was asked to display a dropdown with each element representing a script. A button next to the dropdown would execute the selected script. Each script requires different user input. Is there a way to ask the user for input based on what element they have selected? I can't create a button per script as the list will be dynamic. Thanks in...

Automate Reported Phishing Email Attachments to CrowdStrike Falcon Sandbox w/ XSOAR

I was wondering how to create a playbook so when a user reports an email as phishing, to somehow have it automatically upload to the CrowdStrike Falcon Sandbox for further analysis - Basically anytime a phishing email with an attachment is submitted to our company report phishing email inbox, to pull it from Abnormal Email Security, then send it...

passat2k by • L0 Member
  • 4431 Views
  • 3 replies
  • 0 Likes

Connecting Cortex XSOAR to Internal Cloud Hosted Panorama for Prisma Access Integration

I'm seeking assistance on securely establishing an SSH connection from Cortex XSOAR to Panorama as part of the integration Prisma Access with XSOAR. This integration aims to execute CLI commands on Panorama, which is hosted within Azure (internally). To ensure security and avoid exposing Panorama to the internet, I'm looking for best practices o...

Wassif by • L1 Bithead
  • 1712 Views
  • 1 replies
  • 1 Likes
  • 1307 Posts
  • 46 Subscriptions
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks