Cortex XSOAR Discussions

Resolved! Create incident with Script

Hi all,

I am creating an incident with script as following:

    uri = f'/incident'
    body = {
        "name": incident_name,
        "type": incident_type,
        "createInvestigation": True,
        #"rawJSON": json.dumps({'hello': 'test'})
    }

...

Resolved! Issue while usin 'JQ' Transformer

Hello,

I would like to use 'jq' Transformer as designed in a custom "Mapper", but it constantly says to me that error message, whatever I am testing :
===> "Result: Failed to execute jq. Error: the JSON object must be str, bytes or bytearray, not dict"

...

Chronicle Errors for a while now -

!gcb-list-detections alert_state="ALERTING" page_size="100" detection_for_all_versions="False" list_basis="CREATED_TIME" start_time="2023-07-17T14:52:46.000Z" end_time="2023-07-17T14:57:46.894Z" retry-count="2" retry-interval="30" is returning "Faile

...

Integration of "Malware Investigation And Response" Playbook

I am writing to request support for migrating from the old playbook (Endpoint Malware Investigation - Generic) to the new playbook (Malware Investigation & Response Incident handler) and I have only the Standard Success support.

Additionally, I would

...

Resolved! SearchIncidentsV2 not returning results

Hi, I am using SearchIncidentsV2 automation to loop through 2 IP addresses previously saved to IP incident key, to see if these IPs are showing in FireEye NX alerts. When I try to loop I receive empty foundIncidents key:

When I hardcode the

...

Resolved! Elasticsearch integration events return limit

Hello everyone!

I am currently using the Elasticsearch integrations to retrieve events related to an incident or events for a specific report and generally have no issues with that. However, sometimes some "reports" have queries that retrieve +10k

...

Is it normal for the main account to hang when syncing 30 tenants at a time

Hi everyone,

This issue started to happen recently, I am not running anything on the main server and I didn't have any issues on that account so far . Syncing all the account however hangs the main server. I am considering either adding more resour

...

Issues after upgrading XSOAR

Hello wonderful people,

I just upgraded XSOAR from version 6.9 to version 6.11 in a live environment.

The upgrade was successful but "I got failed to migrate podman containers" after the upgrade.

Also after all, whenever I try to pull data from

...

Resolved! Delete Indicators Command

1) Is there a way to delete a batch of indicators with a single command, let's say all IP addresses imported with Feed XXX?

2) When I change Domain indicator expire time (Indicator Type) from 14 days to 1 hour, after expiration time indicators are st

...

Resolved! I can't close the incident with Pre-processing Script

Hi all,

In the incoming incident for CarbonBlack I use some conditions. If it matches these conditions i want to close the incident in CarbonBlack and XSOAR. (I use pre-processing script)
If i want to close in CarbonBlack and drop in XSOAR, i use de

...

Cannot start demisto service after changing certificates.

Hello folks,

I followed the steps here to change the GUI certs to new self-signed certificates, but the service doesn't come back up.

I found below error in server tail.

error Could not load scheduled jobs [error 'database not open'] (source: /

...

Able to get time when a user opens an XSOAR incident for the first time?

Hi, I would like to get this context key/value as I need it to track SLAs. Is there a way to do so, rather than manually configuring a button in my playbook workflow to call the `!GetTime` script? Thank you.

Resolved! Generate Investigation Summary Report

Hi

I have used the automation Generate Investigation Summary Report to generate a report of particular incident. But I am not getting full content in the report that is being generated. In war room I can see details but in the generated report inform

...

Automation to Print output and set tag in warroom

Trying to create an automation to print output in the warroom, which works.

print(handover)

Only thing is how can I give a tag automatically to the output in the warroom.

I want to give the tag "Handover" to this output for example.

Does an

...

What is everyone doing with their TIM license?

Hi everyone,

I am running a multi tenant version of XSOAR, this version doesn't come with TIM so I don't have access to full screen view for indicators. So far I have been extracting indicators with an automation and verdicts for those indicators a

...

Discussions

Resolved! Create incident with Script

Resolved! Issue while usin 'JQ' Transformer

Chronicle Errors for a while now -

Integration of "Malware Investigation And Response" Playbook

Resolved! SearchIncidentsV2 not returning results

Resolved! Elasticsearch integration events return limit

Is it normal for the main account to hang when syncing 30 tenants at a time

Issues after upgrading XSOAR

Resolved! Delete Indicators Command

Resolved! I can't close the incident with Pre-processing Script

Cannot start demisto service after changing certificates.

Able to get time when a user opens an XSOAR incident for the first time?

Resolved! Generate Investigation Summary Report

Automation to Print output and set tag in warroom

What is everyone doing with their TIM license?

Default Field Mapping in QRadar Content Pack 2.5.7 on XSOAR 6.12

Field Change Script To System Fields

How to Copy Incident Files from Linked Incidents

Can XSOAR disk space vary automatically?

Assign incident to new owner

Getting Vulnerability Findings from Tenable SC for a Specific Host

Re: Using custom machine learning models in XSOAR

playground query question for servicenow

Re: Incident Parent-Child Relationship

Unlock your full community experience!

Resolved! Create incident with Script

Resolved! Issue while usin 'JQ' Transformer

Resolved! SearchIncidentsV2 not returning results

Resolved! Elasticsearch integration events return limit

Resolved! Delete Indicators Command

Resolved! I can't close the incident with Pre-processing Script

Resolved! Generate Investigation Summary Report