Can it link into 3rd party tools such as Proofpoint or Symantec dlp? This question was asked as part of our Cortex XSOAR Customer Success Webinar: Prisma VM Alerts & DLP Playbooks
Dear All, i was trying to install COrtext SOAR in an Airgap (offline)Enviorment with no internet where i was refering cortex offline installation guide, and i i could not complte the installation and stuck in uploading docker dependaci file to which explain below , did any one here installed XSOAR offline and get sucsess, if yes please help m...
Hi , Is there anyone else who gets this Error ? how do I solve it ?Its updated to the latest version , The server URL , username and password are correct.
I have created an integration that produces many alerts and I have a few thousand incidents that are currently in the Pending state. The plabyook has yet to run etc. What I would like to is select the incidents from the "Incident" page and change the status for these incidents from pending to active without entering each incident manually. I hav...
Hello All, I have a question, i have mapped an incident from qradar with the playbook i've created. At first it's worked, the incident severity was "high". but later until now, the severity become "unknown". What is the main cause of this issue?Thank You
Hi! I want to extract specific key data from context of multiple incidents. The context key I'm looking for is not under "incident". Specifically, I have many incidents of type "Phishing" and want to output the contents of "Recipient Selection.Answers.0" key from all of them. I thought of using SearchIncidentsV2 but it does not seem to include...
The code below, creates an incident with attachment uploaded but in the incident itself, when I see the context, I dont see any file. Since there is no entryID for the file, I cannot read the attachment and also cannot run the playbooks. Any change I need to make to make the attachment appear as File with entryID? https://docs-cortex.pal...
Morning everyone, I hope that you are doing well I have a little problem. We have implemented the XSOAR in our customer environment and configure th EWS O365 content pack for phishing attacks but since we do not have a case, we cannot show to the customer how it work in a real case. We alrea;dy gernerated incident with the onboarding content...
Hi, I am trying to ingest our taxii feed into XSOAR 6.12 with following steps: installed XSOAR 6.12 on ubuntu 22.0.4 LTS launched the web portal, and installed TAXII Feed (1.x) pack from marketplace Ingest feed using "Integration Instance Settings" Typed in the parameters such as name, discovery service URL, username/password, collection nam...
Hello All, I have a question, i have integrate qradar into xsoar, but why only 2 fetched data shown in the classification & mapping? Is there any configuration should i modify ? Thank You
Hello All, I have been working on the XSOAR Platform for a long time and there is something which I haven't been able to find a solution for. I would like to rerun a playbook for multiple incidents and I use the !setPlaybook to do this. I do this after rectifying the issue on the playbook for example task error or similar. The problem is that m...
Is there a way to select alternate layouts in a case based on an if-statement?
Hi!I'm installing XSOAR multi tenant environment. Currently its a Community edition for POC.Installed main host and tenant host as per documentation. Both Ubuntu 22.04I am unable to connect tenant host to main host.Settings - account management - new account - host/HA group only shows main host:hostname:443They are both in same subnet, main host...
Why does the browser window in XSOAR remain open when an incident has been closed? Is there a way to automatically go back to all incidents? e.g. to https://xsoar.dev/#/incidents
- Hi, While doing the customized Remedy integration test, getting-"Did not get the expected value from test (85)" but able to fetch the incident status via "remedy-incident-get incidentID", OAuth test successful via "remedy-auth-test" in playground through queries and also generating the Incidents. Could anyone assist me with this?
