We couldn't sort by date in bar graph widget in custom dashboard. We are in XSOAR 8.7. Please assist.
Hi everyone, We’re working with a custom integration that includes a command called send-notification, designed to request customer confirmation regarding an incident. This command is intended for use within the data collection communication channel ask-by. Currently, we’re encountering a challenge: the send-notification command does not ap...
Hi everyone, I have button in the incident layout and the script it triggers creates a new incident and posts all of the war room entries to the new incident. In the incident, we have some notes that should also be seen as notes in the new incidents but I was not able to tag them succesfully. Read the XSOAR API documentation and I am using "/e...
Is possible to implement own BYOI Integration with failover handling between multiple engine without load-balancing group because we concerned about the sequence of "Run on" engines must be run on primary engine first and secondary after primary is failover. we tried to implement python based BYOI with "demisto.executeCommand(..., using=primary)...
I am currently using a setup where a google form is hosted and a google apps script send the data over to XSOAR upon submission on google form.How about the integrated "Xsoar-web-server" Is there a way we could use this to eliminate google form and apps script. Cortex XSOAR
Hi! We are trying to give more importance to XSOAR within our SOC processes. As part of the changes we are introducing, we want all alert documentation to be done from now on in the 'Notes' section of each XSOAR incident. The issue we are facing is that when we include screenshots as part of the evidence in the Notes, those images do not app...
Hi All, I am using hois integration to use "domain" command. I sometimes have array of strings for domains and sometimes single string and in most of cases whois return results to me but i got sometimes "Connection Refused" Issue. I already adjusted settigns in integrations , also enabled suppress option and also on task level i adjusted retry m...
Hello guys, I am currently working on Use Case for my organization to handle email threats that bypass our Trend Micro Email Security (TMS) gateway. Context My organization uses Trend Micro Email Security as the email gateway. Some phishing, spam, and malware emails still bypass TMS filtering and reach user inboxes. These emails are logged...
I'm trying to create a "dt" filter for use with the GenericPolling playbook. (https://xsoar.pan.dev/docs/playbooks/generic-polling)The key I need to check for the existence of is MsGraph.Alert.Evidence.[1].@odata\.type (XSOAR automatically adds the "\" before ".type" as the period is part of the key name when copying the context path of the key)...
Hi everyone, I have a Post-Processing script that uses the setPlaybook command to switch the incident to a playbook called test1. The problem is that when I close the incident, the script doesn’t run just once - it keeps setting the same playbook repeatedly, and as a result the test1 playbook is triggered about 10 times in a row. Here’s my cod...
If I’m integrating Splunk with XSOAR and need to modify the notables that are created, I may need to update the correlation rule. If the XQL builder isn’t available, how can we create a correlation rule in XSOAR?
Hi Everyone! I’m hoping you can aim me in the right direction. I’m trying to join the PAN DFIR slack community via this url:https://start.paloaltonetworks.com/join-our-slack-community But the register button doesn’t seem to work for me, despite multiple attempts on multiple browsers and devices on my end. The bottom of the demisto/xsoar co...
Hello Dears, I have an issue with Forcepoint web Security with Cortex XSOAR Integration. kindly find the logs:2024-03-26 10:36:37.6939 error Unable to do Http req to url : https:// :15873/api/web/v1/categories/start [error 'Post "https://10.200.30.242:15873/api/web/v1/categories/start": tls: server selected unsupported protocol...
I am trying to connect an Azure AD (EntraID) to Cortex XSOAR so that I can use the user-disable playbooks. However, each time I try to authenticate i get the below error Error in Microsoft authorization: Incorrect padding Please check authentication related parameters. Traceback (most recent call last): File "<MicrosoftApiModule>", line 1...
As you know, the current EWS integration is limited to Exchange 2019. Could you please confirm if there are any plans to extend support for Exchange 2022? Additionally, are there any recommended workaround solutions for implementing inbox monitoring with Exchange 2022 in the meantime?
