Playbook to update IOCs on Microsoft Advanced Threat Protection (APT)

I want to achieve below steps. is there any exiting playbook or have to customized playbook?

Step 1: Checking Existing IOCs in Microsoft APT

In this first step, we will fetch the list of existing IOCs from Microsoft APT and compare them with the IOCs

Create Incident layout fields from Context Data

Hello!

During incident investigations, it would be useful if certain Context Data fields (if they have a value) are written to the incident layout and you don't have to search for the value in the Context.

My question would be, how can I make it so t

How to read file from the pandas FileExcel?

I need to create some report and I am using pandas module for that but unable to read the file from my local rdp desktop. Note: I am using xsoar from web Interface. I try to use with "\\" to avoid escape sequence mistake. It is unable to read the fil

Custom Fetch Incidents

Hi, I want to use Exabeam integration in XSOAR but not to fetch incidents (incident responder) as it is currently set in fetch-incidents command, that is in fetch_incidents function.

The plan would be to fetch with get-notable-users command, which pr

How to run and or use HelloWorld Integration?

Hello all,

Fresh install of XSOAR onto Ubuntu, all went well. I a trying to run the HelloWorld integration but I keep getting the error:

Failed to execute test-module command. Error: Verify that the server URL parameter is correct and that you ha

How can i change type (shorttext, multiselect) of incident field?

Hi all,

Earlier, I created a field called propagation_x and posted it to the main account. The type of this field is shorttext. I want to change the type of this field to multiselect. In YML file shows multiselect, but XSOAR shows as shorttext. How c

XSOAR integration fetching incidents past the set time.

We're only running one instance of the integration and we've set the first fetch timestamp to be 3 days.
When we run the integration, initially it only fetches incidents in the past three days and then after a while it starts fetching incidents as old

Moving a file

Hello,

Anyone know how I can run an automation in the playground, to save a string of text into a file locally on the system?