I'm curious if anyone has had any success leveraging XSOAR with Banner to automate onboarding.
Hi all, I have a problem with QRadar integration. Let me summarize my environment and basic configuration. Cortex XSoar version: 6.10.0QRadar integration version: IBM QRadar v3Mapper: QRadar - Generic Incoming MapperIncident type: Qradar GenericEvent an fields to return from the events query: QIDNAME(qid), LOGSOURCENAME(logsourceid), CATEGORYNAM...
I'm attempting to write an automation that takes a user password. Then sends an api call containing that password, but when I enable the mandatory sensitive options on the automation script. The API call I wrote no longer runs. Are there any examples of passing a password from the mandatory sensitive box to an automation script?
Hi, Anyone please help me to understand automatic incident assignment by DBot to analyst. what are the steps have to perform?how to define the shift in user roles? Thanks.
Is there any way to use a task to preview an email (from an msg or eml) and not just see the filtered results? I'm looking for a solution to display an email in xsoar as if I were to open it in outlook. For analysis it would be important to see the email in its entirety. Thanks in advance for your answers.
Dear LIVEcommunity users, Since version 6.0, Cortex XSOAR implements incident mirroring. Do you know if it is possible to enable two (or more) different syncs on the same incident (e.g. 2 Jira integrations, or 1 Jira and 1 ServiceNow) ? If yes : How does XSOAR manage the dedicated fields ("dbotMirror*" and "dbot*DirtyFields") ? When an incomi...
Our client leverages QRadar as their SIEM.will pull in all cases and then have a pre-processing rule that drops any case that does not have "MSSP" in the name.This works 99% of the time, but there are certain times when MSSP cases get dropped and we don't we don't know why yet.Is there a way to "re-pull" Qradar cases from QRadar if the integrati...
Hi all, I want to mark the Cortex XDR incident coming into XSOAR as TP or FP with preprocessing. Does preprocessing allow this (run a script)? Or does it only do drop processing?
Hi Support, We have a special setup on our cortex xsoar which allows podman to use a Proxy A for pulling images from docker repositories (via http_proxy and http_proxy) and a Proxy B for python integration (Via python.extra.keys) to access internet. However with this setup, Javascript integrations are not working as by default it references ...
Hi, I have integrated Panorama with XSOAR, instance is successfully created. Now I have to block IP using this integration. I want to block ips just using panorama xsoar integration by using Static Address GroupCan anyone please assist how to go forward with this??
incident.labels.source_address_ids:["1.2.3.4'] for above json value when i am parsing/using variable in title field getting error ( i.e. expecting ',' ) is there any way while calling variable we can ignore/exclude characters ( [ and " ) tried multiple option in war room but no luck.
Hi all, In a list field, I want to go through all indexes one by one and if there is *malware* in all indexes(malware execution, malware alert, malware), I want to drop it. However, I could not edit this in the "Conditions for Incoming Incident" field. For example, how can I do it, considering that we have "tag" field?"tag Contains malware" like...
I want to attach the CSV file in the Playbook as an attachment to the e-mail and send it. I use Msgraph. If I send it without attachments, the mail is sent. But when I add an attachment, the mail is not sent. I'm using the following command. I tried it in the CLI and Playbook, it didn't work in both. !send-mail subject=TRY body=TRY attach_ids=...
Hi , Is there any option to automatically close Incident when offense closed via Qradar ? In the integration setting there is the option - "Close Mirrored XSOAR Incident" but it doesn't for work me.
Hello everyone, What is the best option to add a delay in a playbook, for example I have 2 automated tasks and want task 2 to start after task 1 finishes by 1 hour. I thought of creating a one-line automation that has time.sleep(amount) and adding this automation between the 2 tasks. but not sure how safe is this especially for long times. ...
