This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

Proofpoint Threat Response XSOAR integration Block URL, Block Domain, Block IP lists?

Hello, we successfully have integrated Proofpoint Threat Response Logs into our XSOAR instance. One of the problems we noticed right away is that it seems like its only a one way API flow, as in we cannot send any commands from XSOAR back to Proofpoint Threat Response. For example, with the integration we created a layout with certain button scr...

QRadar API 19.0 and Incoming Mapper problem

Dear all, I am trying to deploy MT XSOAR on a customer and they are using QRadar 7.3.5 with API 19.0. I have noticed that some incidents do not get the same mapping, yet they use Qradar Generic Incoming Mapper and all incidents are set as QRadar generic. For instance, Type A incident gets incidents.label.start_time mapped as incidents.start...

timeout or authorization Issue with Mail Sender (New)

Hi, When testing send mail new integration on load balancing group in XSOAR getting "timeout while waiting for engine to answer. Wait time:1m0s. Note that command is supported from engine version 6.0 and above But we are running on 6.10 version".for this i added the below mentioned server setting but issue still persist: key: engine.test.command...

Resolved! How to get the process id from crowdstrike (CS) integration

https://xsoar.pan.dev/docs/reference/integrations/crowdstrike-falcon#30-cs-falcon-process-details https://xsoar.pan.dev/docs/reference/integrations/crowdstrike-falcon#51-cs-falcon-rtr-list-processes https://xsoar.pan.dev/docs/reference/integrations/crowdstrike-falcon#7-cs-falcon-run-command Hi Folks,In my context I do have the malware process p...

Screenshot 2023-08-30 at 5.26.10 pm.png
Screenshot 2023-08-30 at 5.37.55 pm.png
Screenshot 2023-08-30 at 5.36.10 pm.png

Not getting output in Jira

Hi All, I have added a custom field in jira (MITRE Tactic). I have mapped this field in XSOAR with 2 fields: Mitre Tech ID(short text type) and MITRE Technique ID(Multi select / Array). Below is the command I was using and the output I was getting: "customfield_11503": "${incident.mitretechid}"${incident.mitretechniqueid} "customfield_11503": ""...

Himangi_0-1693553691213.png
Himangi by • L2 Linker
  • 1553 Views
  • 1 replies
  • 0 Likes

When editing and incident field to update/delete some values the "old" values appears back again.

Evertyime I run the playbook the old values appear again in the "Incident field" setting. I tried to :- Edit the field with the new values and save it.- Completely delete the field and create is again.- Deleted "field associated with the question" in the playbook and re-configured it again. Does anyone have an idea how to fix this?

Live Backup encountered the following error on this host: [master] Failed live back on remote server [401]. DR authorization header does not equal con

Hi, we've been having issues with Live Backup: Live Backup encountered the following error on this host: [master] Failed live back on remote server [401], [{"id":"unauthorized","status":401,"title":"Unauthorized","detail":"The request requires authorization","error":"DR authorization header does not equal configured key [XXXXXXXXXXXXXXXXXXXXXX...

RickyLam by • L1 Bithead
  • 3240 Views
  • 4 replies
  • 0 Likes

Resolved! Add additional fields in Jira edit issue task

Hi All, "Jira-edit-Issue" task has some default Arguments as Inputs (eg: IssueID, priority,status, summary, description etc.,). Now I need to add new field as Inputs to Jira edit issue from XSOAR, fields like resolution, etc. I tried editing the script also.. Can anyone please help me which part of the script needs to be edited. Thanks

Himangi by • L2 Linker
  • 2370 Views
  • 2 replies
  • 0 Likes

Resolved! Playbook runs in Playbooks page but not with incident

Hello all, I have a playbook, the one from XSOAr Engineer you tube course actually, video #8, sub-playbooks. This runs flawlessly in the playbook page but when I run it from an incident it ends up trying to reset the password for every AD user even though I specify james.bond as the user. I am not sure of the logic. It doesn't seem to "call" t...

GWynn by • L3 Networker
  • 8186 Views
  • 13 replies
  • 0 Likes

Resolved! Grid Field Setup In XSOAR

Dear All I am trying to setup a new Grid Field in XSOAR. I have added few column header with the field names that I require however, in the layout, not all columns are shown. There are certain fields which are missing in the display.

  • 1310 Posts
  • 46 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks