This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

HTML field

Hello everybody, I have a question regarding HTML fields in XSOAR. So I have a Python script to get data from a table but I'm wondering how do I configure an HTML field so that the data my script returns is displayed in an HTML format? I tried connecting the HTML field to the script but haven't had any luck getting the data to display. Thanks ...

mof2024 by • L0 Member
  • 1450 Views
  • 1 replies
  • 0 Likes

Resolved! Can't Append strings into incident.Hostnames

Hi all!, I'm having issues trying to update the incident.Hostnames field. What I want to do: I'm receiving an alert which involve different hostnamed, for the sake of simplicity and to track easier the incidents we want to add the hostnames to the incidentHostnames field: As it is an array there shouldn't be any issue but when we perform....

FOtero_0-1706113371425.png
FOtero_1-1706113684985.png
FOtero_2-1706113857656.png
FOtero_3-1706113963629.png
F.Otero by • L1 Bithead
  • 2239 Views
  • 2 replies
  • 0 Likes

Resolved! XSOAR Indicator Management webinar: Expired indicator and Bolt Database

**This question was asked during Part 1 of the webinar series: Indicator Management. You may review the recording here If we are using Bolt database and an indicator is expired and has a last seen date of September 1, 2023 - does that mean it exists in the September Bolt database file? If we call the indicator command and the last seen date i...

rtsedaka by • L6 Presenter
  • 2089 Views
  • 1 replies
  • 0 Likes

IPs en lista Barracuda Reputation Block List (BRBL)

Estimados tengo implementado un playbook en Xsoar que usa varias fuentes de enriquecimiento y se ha identificado que Barracuda esta identificando como IP maliciosa, IPs de redes solciales como facebook, instagram, whatssap, etc y otras publicas de la empresa donde laboro que al realizar las revisiones manuales no veo estas IPs como maliciosa, en...

ISOC_PNP by • L0 Member
  • 1893 Views
  • 1 replies
  • 0 Likes

HA Setup for community version

Hi All, It seems like I can't find anything about HA setup for the community version. I wanted to try out to do a HA setup (Active/Passive) in the community version before proceeding to the enterprise version. Appreciate all the help from all.

Resolved! automation scripts

Cortex XSOAR Hi community, Can I get a few sample automation scripts in Python implementing any use cases or achieving any useful task via XSOAR. Any links to such a resource

regish by • L0 Member
  • 2226 Views
  • 1 replies
  • 0 Likes

Automation in Python using parallel processing

#Cortex XSOAR Hi, Is there a way of creating parallel processing inside an automation in Python ? My goal is to execute the same function on multiple incidents (pausing and/or starting timers). The thing is, sometimes we have a lot of incidents and the current automation using a mere "for x in y" can timeout. Obviously we could increase the t...

sdes by • L0 Member
  • 3023 Views
  • 2 replies
  • 0 Likes

Cortex XSOAR Playbook and Automation permission

Hi,I would like to ask for help on how to be able to implement within XSOAR the ability to determine which playbooks and automation can be executed or viewed by the user via the command line (by typing !) while still having the ability for the same user to be able to execute commands within an incident layout when an automation is associated wit...

Cortex XSOAR support for RHEL 8.9 version

Hi All, We were reviewing the prerequisites document for Cortex XSOAR installation from the below linkhttps://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/System-Requirements We couldn't find whether XSOAR is supported on RHEL version 8.9. It was not listed in the documentation. Could anyone confirm wheth...

Resolved! Automation to query incident team from current and linked incidents

Hi, TLDR: How can i write an automation that returns the incident team of multiple investigation ids (1,2,[...]) without needing to run the automation manually in each investigation. I want to create an automation to send an E-Mail to all users in the incident team of the current incident, as well as all linked incidents. To achieve this for...

GetIndicatorsByQuery command

Hi all, Does anyone knows how to retrieve the firstSeen/creation date of an indicator using the GetIndicatorsByQuery command? These are the only fields I know that can be returned so far but none of them is the firstSeen/creationDate of the indicator. id,value,lastSeen,investigationIDs I'm unable to have it populate every fields as well ...

LIEWS05 by • L0 Member
  • 1459 Views
  • 1 replies
  • 0 Likes

XSOAR + Threat Intelligence

Hi, All! I am working on integrating more threat intelligence into our XSOAR platform. Our latest efforts have been integrating other free sources of IOCs (AlienVault, Abuse.ch, etc...) and then we are going to work that into playbooks to create logic based off of the new IOCs we are bringing in. For example, if an event is created where it sh...

User Restriction and permission

Hi, using XSOAR I came across some issues related to user permissions and audit logs to have an account of the various activities performed on the platform: - Is it possible to restrict user permission to execute scripts/commands only via field changes in layouts? - using the command !listExecutedCommands source=All I cannot see the commands lau...

  • 1307 Posts
  • 46 Subscriptions
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks