Cortex XSOAR Discussions

Resolved! Exclude character while using variable.

incident.labels.source_address_ids:["1.2.3.4']

for above json value when i am parsing/using variable in title field getting error ( i.e. expecting ',' )

is there any way while calling variable we can ignore/exclude characters ( [ and " )

tried

...

Resolved! Setting a pre-processing rule

Hi all,

In a list field, I want to go through all indexes one by one and if there is *malware* in all indexes(malware execution, malware alert, malware), I want to drop it. However, I could not edit this in the "Conditions for Incoming Incident" fiel

...

Attaching a CSV File to the Mail Attachment

I want to attach the CSV file in the Playbook as an attachment to the e-mail and send it. I use Msgraph. If I send it without attachments, the mail is sent. But when I add an attachment, the mail is not sent. I'm using the following command. I tried

...

Close Incident when offense closed via Qradar

Hi ,
Is there any option to automatically close Incident when offense closed via Qradar ?

In the integration setting there is the option - "Close Mirrored XSOAR Incident" but it doesn't for work me.

Resolved! delay in a playbook

Hello everyone,

What is the best option to add a delay in a playbook, for example I have 2 automated tasks and want task 2 to start after task 1 finishes by 1 hour.

I thought of creating a one-line automation that has time.sleep(amount) and addi

...

Close Incidents from Preprocess Rule "Script"

Dears,

Hope you are doing well.

We need to close the Incidents on xsoar from preprocess script, How can we close it using a script in preprocess rule?

I dont need other options like: link and close or drop or close. Because there are some mandato

...

How to know if a zip file is encrypted in XSOAR

Hello,

We'd like to know if a zip file is encrypted inside a playbook or a automation. The way in which XSOAR works with these files does not allow the use of python libraries. Is there a way through the File context value to know if the file is encr

...

Resolved! Include Linked incidents table in email notification

Dear Community members,

hope you are all doing well !

I'm wondering if there is an option to include linked incident table (can be added to the incident layout) in email template.

I'm using Mail sender (New) : https://xsoar.pan.dev/docs/referenc

...

Could use some help with Azure SSO for community edition Cortex XSOAR

Hello,

I have tried many settings and can't seem to quite figure out what text is to be entered into the setup section within Xsoar for the Azure SAML SSO setup. I keep getting this error:

" {"id":"errSAMLLogin","status":400,"title":"Failed to login

...

Resolved! Filter Incidents in specific Time interval

Hi ,

Is there a way to filter incidents in specific time interval ?

For example -

Filter incidents that occurred From 1/5/2023 to 31/5/2023 only between 7:00 to 14:00

Content Update Manger Playbook giving error in Task : Install updates for chosen packs

Error Detail:

ContentPackInstaller - Error occurred while setting up machine. string indices must be integers

Any suggestion, what could be the reason. Tried to pass integer values also but no luck.

Resolved! Running Script or Playbook in one tenant from another tenant.

Hi all,

I have a multi-tenant deployment. I want to run a script or playbook from one tenant to another tenant. How can I do this?

#XSOAR

How to Find and update existing incidents through Integration

Hi,

We are providing partner integration for our product and this is the requirement.

My product # generates/creates 'Cases' which are pulled inCortex XSOAR as incidents using fetchIncidents call. It might be possible that sometimes a 'Case' in ou

...

Resolved! Script-based Widget

I want to design a widget. This widget will appear on the dashboard. But I want this widget to work only once a day. How can I do this?

Cortex XSOAR

Trigger a usecase by sending an email to an email address (Dedicated) owned by Paloalto

I would like to explore an option to trigger a use case by forwarding or sending the email to a cortex email address (Dedicated) to a client and trigger a playbook from there.

(Something like client@paloalto.com) and then it creates an incident and

...

Discussions