This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

Run a command on all tenants from master

hi everyone, I need some help with microsoft graph integrations with multi tenancy I configured an instance of Microsoft Graph Mail Single User integration in the master and want to sync to all the tenants. Simply syncing won't work because the integration has to run at least once to be initialized before the oproxy token expires. msgraph-ma...

Resolved! XSOAR Mirroring - Move all cases from one tenant to another (with all related information)

Hello, We're looking to move all our cases from one tenant to another one.Looking at the XSOAR Mirroring integration to move all cases. We would like to retrieve all content inside every case.The default settings of the integration (below) doesn't mirror all entries. How can we include all entries in the mirroring?Entry Categories = notes,chat...

Apply transformers directly on variables

Hello, I'm creating Json lists introducing data in them. I'm using "addToList" automation. The data introduced example: listData: {"key1":{ "subkey1: ${dataInput1}, "subkey2: ${dataInput2}, "subkey3: ${dataInput3}, "subkey4: ${dataInput4} } Is there a way to transform the variables directly in the input listData with no need to create a set fo...

Josep by • L4 Transporter
  • 1866 Views
  • 1 replies
  • 0 Likes

Even though get-remote-data command executes successfully, the entries returned in the GetRemoteDataResponse object is not being added to the incident

When the get-remote-data is being called, I am getting below errors when returning entries to the GetRemoteDataResonse. The command is executes successfully, but I do not get entries in the XSOAR incident which I have passed to the GetRemoteDataResponse. Even the incident is not getting closed though I have returned an entry with "dbotIncidentCl...

HarshPanchal_0-1674821669351.png
HarshPanchal_2-1674821769217.png

Panoroma IP Blocking Issue

I wanted to block ips via using xsoar, on Pan-os panorama. We have integrated xsoar and panoroma but non of the automations provide us a blocking on panorama. In addition to that I tried to give inputs to Block IP Generic v3 playbook(which is provided by palo alto). Our aim is blocking IP **WITHOUT** using edl or static list, which corresponds D...

UmutAK by • L1 Bithead
  • 1577 Views
  • 1 replies
  • 0 Likes

closing duplicated tickets in XSOAR & Splunk automatically

Hello, i am trying to close duplicated tickets on XSOAR and Splunk automatically using pre processing rules (for closing on XSOAR) and post processing rule (for closing on Splunk) which i wrote a script for However i cannot test the post processing scripts because the pre processing script closes the tickets and i cannot reopen them or access ...

Getting this error when enabling malwarebytes #xsoar integration

Executed: test-moduleInstance Malwarebytes_OP360bae6c541-5338-433c-8e65-0698f6d1e955Arguments {}Start time 2022-10-21T16:15:27.798846102-04:00 2022-10-21T16:15:28.151429016-04:00 info: (Malwarebytes_OP360bae6c541-5338-433c-8e65-0698f6d1e955_Malwarebytes_test-module) debug-mode started.#### http client print found: False.#### Env environ({'PATH':...

Search IOCs on VirusTotal Faster

We are running a playbook to search a list of IOCs on VirusTotal, the list is received by an attachment on incident creation. The playbook then exports the VirusTotal scores into the war room as a csv file. All this is achieved by manual indicator creation an enrichment. The enrichment process however takes more than an hour for only 4000 IOCs. ...

XSOAR Tenant RO access

Hi All, In an environment where one has a multi tenant setup, what is required from a licensing perspective in order to setup an account (pref read only) to be able to view both the master and any child tenants within. requirement for this account is to review current playbooks, subscriptions etc etc thanks in adv

Ants by • L1 Bithead
  • 1289 Views
  • 1 replies
  • 0 Likes

Microsoft Sentinel Integration

I am having the following error while trying to create an instance of "Microsoft Sentinel Integration": Error (April 12, 2023 9:47 AM) Script failed to run: Error: [Traceback (most recent call last): File "<string>", line 1, in <module> NameError: name 'register_module_line' is not defined ] (2604) (2603)

MSSSOC by • L0 Member
  • 2250 Views
  • 1 replies
  • 0 Likes

Get MFA authentication methods

Hello community! I was wondering if there's any integration that would allow me to get the defined authentication methods for a given user. The use case is to know if someone who has entered credentials in a phishing portal has MFA enabled or not and take actions in consequence. I have been looking in Microsoft Graph User integration but the...

adocasar by • L1 Bithead
  • 1941 Views
  • 1 replies
  • 0 Likes

Not able to create a file in the artifacts folder using automation

I run a query in indicator tags:malicious, I am able to get expect result, Then I run the build in automation "GetIndicatorsByQuery" in playground, it shows there is a file created, however when I download the file the content is all [{}, {}, {} ] I tried use build in automation "SearchIndicator" and then "FileCreateAndUploadV2" to creat...

Avoid using too many containers

Hello, We're trying to avoid using too many containers. In order to reduce it, we have come up with two options for the automation: Use the exact same container for automations (If they use the same libraries) Or use the empty "Docker image name" option (if an external library is not used): Which of them will fit better? Thanks, Josep

Josep_1-1679989178081.png
Josep by • L4 Transporter
  • 5485 Views
  • 6 replies
  • 0 Likes
  • 1307 Posts
  • 46 Subscriptions
Top Solution Authors
View All
Top Liked Posts
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks