Hello, How can this error be solved?
Hello, I'm changing a subplaybook which could affect to many playbooks. Is there a way to know in which playbooks are used this specific subplaybook?
Hello, I'm trying to create a dataframe from two lists from the context: key1: 0:value1 1:null 2:value3 key2: 0:value1 1:value2 2:value3 When I call them using demisto.getContext(...), the null value is not passed, like if the key doesn't exist. So my first list becomes, without a row: key1: 0:value1 1...
Help required to install cortex Xsoar community edition on AWS,Please be informed that I have file in my PC and need to pull that in to EC2 instance. I will not be able to install it with the url as I have reached maximum number of attempts and system is throwing below error "HTTP request sent, awaiting response... 400 Bad Request2023-10-10 14...
Hello, We're feeding XSOAR with a lot of incidents. To avoid this, we created a job which deletes incidents each week. However, due to the amount of them, the command "SearchIncidentsV2" fails, it's no capable to search them. How can we free space by deleting incidents in a massive way?
Hello community, I am having a problem retrieving fields in XSOAR from XDR. I get most of the fields, but there are some that do not reach XSOAR, such as, for example, the "action_evtlog_data_fields" (it is not that they do not appear in the context, it is simply that the incident in XSOAR does not have those fields, as shown in the picture)....
Currently, XSOAR is randomly assigning incidents to users. This includes user accounts who will never work incidents. As I understand this is the default built-in process. I looked at the AssignAnalystToIncident script, but really don't know what needs to be updated here. I would like to completely disable the auto assigning of incidents. I...
HI All, I have created a playbook in Cortex Xsoar to sent automate email when a particular incident came. The issue is when i am getting email it was in the below format:- Hello Team, We have observed an alert , kindly find the alert details below - Event Name - Source IP in Event - Raw Data - Recommendations: Kindly check the business rel...
Hi! I would like to be able to read QR codes locally. The marketplace offering does not suggest a local QR read option. What would it take to develop one, as I can generally see that Python related libraries do exist? Could I request a QR related docker image to be created (currently i do not seem to find one)? Thanks, Antanas
hi,is there a possibility in xsoar to prevent an incident from being closed if certain conditions are not met? I would like to implement in incident workflow where one part is executed automatically and the other by the analyst, then if certain fields are not valorised prevent the closure of the incident.Thank you very muchregards
Hi all, We were experiencing issues with integrations that are making use of the library "datetime" When trying to execute this piece of code: It returns the following error: We've tried using different Docker images, creating our own images from scratch and running the code in different hosts but we are getting the same error all ...
Hello, We are working on an automation which calls many different lists of nested dicts. Example: upField: 0: field1:value1 field2: value2 1: field1:value3 field2: value4 In a playbook it will be easy to call only field1 using this expression: ${upField.field1} . It will create an array with these values: [value1, value3] However, if we want t...
I'm creating a widget so I can have a report run returning certain Managment Audit log information. One of the fields, "Management_Auditing_type" has values that are quite long that I would like to truncate. For example, have "MANAGEMENT_AUDIT_ACTION_CENTER" changed to "Action Center", and "Management_Audit_Policy_Profiles" changed to just "Po...
Hi, I am needing to build a playbook for onboarding new accounts into Active Directory. I do know they have some Premium Playbooks but I don't have that budget so building our own. How do I take in to account the aspect if the username is already taken and how to adjust for that? Is there a task to create an email account when Hybrid 365 is u...
Hello, We are executing a long playbook. This playbook started to work incorrectly. To check what was happening, we looked inside the War Room, but it only showed a limited number of outputs. In order to check more outputs, we had to scroll up inside the War Room, however, it took too long to load just a couple of new outputs. How can we obtain ...
