Cortex XSOAR Discussions

A doubt with ElasticSearch Integration and EQL searches (es-eql-search)

Hi everyone, I'm currently working on how to make some EQL queries to my Elastic Instance from Cortex XSOAR. I'm using ElasticSearch integration, specifically the command "es-eql-search" which purposoe, I guess, is to make a EQL query to ElasticSearch API. However, regarding to the XSOAR documentation related to the Elastic's integrations, I c...

AWS Market place Prisma Cloud (PAYG with 15-Day Free Trial)

From the Welcome mail I receive Palo Alto network Support expected is Hub right?

Resolved! SlackAskV2 automation

Hi all, I'm trying out SlackAskV2 and my message is being sent to the channel successfully. I used 'Yes' and 'No' as options. When I click the 'Yes' or 'No' buttons from the slack channel, nothing is returned to the War Room. Now, where do I find the response so that I can use the 'Yes' or 'No' for the next task?

Mapping fields to XSOAR IOCs

I'd appreicate guidance on how to update IOC fields with information extracted from an excuted playbook task. My use case centers around updating File Hash IOCs to include file signature metadata information to enable easier cleaning up of IOCs associated with known vendors such as Microsoft. Any assistance is appreciated.

Some simple task taking long time to complete, dont know why

Hi Everyone I have multiple simple playbooks tasks taking over a mins to complete, such as closing ticket, condition select etc, We checked the CPU and Memory usage it seems normal, Any suggestion where I can change why ti taking so long? Cheers

Resolved! [Multi-Tenant] System configuration levels

in a multi tenant environment, should I forward all the system configurations to tenants or are some of them meant only for hosts? CSP cases in particular, can be pretty confusing. CSP tells me to put a sys config on the main account and in another comment they say to set the conf on the host as well and in some they recommend forwarding it to t...

Rasterized content on Incident Layout

Hello!I have a question. How can I make it so that I would like to rasterize email/url. The image that appears in the war room (which is the result of running the command) i would like to display on one layout field.I guess I should use dynamic sections but can someone help me how exactly? Thanks in advance.

Playbook to update IOCs on Microsoft Advanced Threat Protection (APT)

I want to achieve below steps. is there any exiting playbook or have to customized playbook? Step 1: Checking Existing IOCs in Microsoft APT In this first step, we will fetch the list of existing IOCs from Microsoft APT and compare them with the IOCs you wish to add. Step 2: Handling Existing IOCs Upon comparing the fetched list with your desire...

Create Incident layout fields from Context Data

Hello! During incident investigations, it would be useful if certain Context Data fields (if they have a value) are written to the incident layout and you don't have to search for the value in the Context. My question would be, how can I make it so that the contents of the context data fields associated with the incident are written to the incid...

How to read file from the pandas FileExcel?

I need to create some report and I am using pandas module for that but unable to read the file from my local rdp desktop. Note: I am using xsoar from web Interface. I try to use with "\\" to avoid escape sequence mistake. It is unable to read the file even the path is correct. Can anyone help me with that. I just started my xsoar journey. ***...

Resolved! Using SearchIncidentsV2 or GetIncidentsByQuery in automations

Hi, First of all, we are using a lot of automations searching for incidents using queries often with more than 100 results. The scripts line looks like this: res = demisto.executeCommand('SearchIncidentsV2', {'query': query, 'limit': 5000})[0].get('Contents') It seems however the "Content" only contains 100 results even though it shows the rig...

Resolved! No output in action

In the "cybereason-get-sensor-id" task we manage to retrieve the sensor id for a given machine, but only in the result tab. In fact, it looks like the integration doesn't return an output result, so we're not able to use the sensorId as an input further into the playbook. Is there any workaround to retrieve the actual result of this ta...

Custom Fetch Incidents

Hi, I want to use Exabeam integration in XSOAR but not to fetch incidents (incident responder) as it is currently set in fetch-incidents command, that is in fetch_incidents function. The plan would be to fetch with get-notable-users command, which produces this result (context-data), when using '!exabeam-get-notable-users time_period="1 month" l...

Resolved! Limit of Support Licence

Hello, I am just wondering if we are losing XSOAR Support after installing several custom Docker images which are not in the following list, on our XSOAR* Environment :==> https://hub.docker.com/r/demisto * : OnPremise - BarMetal XSOAR Thanks in advance for your reply and Best Regards,Thomas Nicolas

How to run and or use HelloWorld Integration?

Hello all, Fresh install of XSOAR onto Ubuntu, all went well. I a trying to run the HelloWorld integration but I keep getting the error: Failed to execute test-module command. Error: Verify that the server URL parameter is correct and that you have access to the server from your host. Error Type: <requests.exceptions.ConnectionError> E...

Discussions

A doubt with ElasticSearch Integration and EQL searches (es-eql-search)