Hello, How can I know what ports are being used by XSOAR?
I have noticed that many of my recent support cases are being lodged into the XSOAR Queue rather than being assigned a support case owner. Is anyone else having this problem and can anyone advise how I get an update for these cases. I have tried calling Palo Alto support but the automated system tells me I do not have phone support and hangs up.
I am trying one splunk query to fetch some result in xsoar using automation splunk-search, but I am not getting any result in xsoar whereas for the same query I am getting result in splunk, can anyone please help, below is the query: index=cbuae_windows | search host IN(${incident.destinationhostname}) | stats values(Account_Domain) as Account_...
Hi All, I have faced one issue while sending a API call to IVANTI. I need to call one value into this request as below {"OrgUnitLink": "${org}","Symptom": "${body}","Subject": "${incident.labels.Email/subject}","Source": "Email","Status": "Submitted"} ${org} gets passed without an issue when I call it since the value is like asda232adadf334d Bu...
Hi, I'ld like to run a simple web server on demand, which would listen for POST requests and put the data posted in a file (or context). So far I achieved similar by modifying community integration XSOAR-Web-Server, which use long lasting instance mode and creates web server using Python Bottle. Server is started by an integration in a simple ...
We are looking for a Cortex XSOAR lead to join our growing team! What better place to look for the right talent than in the Live Community!! DM for more information if you have the skillset, are motivated to succeed, and want to join a winning organization!
Hi, Trying to use yarascan automation from yara pack on marketplace, always receiving "HasMatch: false" Here it goes the printscreen with the command and the contextdata showing the entryid The content has that rule Could you help? Regards, Fábio
How can I map keys (query, network.cidr, network.country) to a table? I'm trying with below command, is not working for CIDR & Country. !SetGridField context_path="Whois.IP" grid_id="whoisipinfo" overwrite="true" columns="IP Address,CIDR,Country" keys="query, network.cidr, network.country"Whois.IP{"asn_registry": "apnic","entities": ["IRT-AP...
Hello, While I'm creating a playbook, the taskids don't follow the proper order due to the changes made. How can these tasks be realigned to follow an ascending order? Thanks, Josep
Hi, We are using SAML integration for XSOAR user authentication and azure AD as an IDP. I'm bit confused in SAML role mapping in XSOAR. for eg. in Azure AD we have only one group and users are mapped to it. but in XSOAR we want to give analyst permission for few users and admin permission for few users. Will that be possible by creating 2 diff...
Hey Everyone, In the context I have one key that holds multiple email values, I need to use them in my "SendEmailReply" automation. However when I call the key as a variable in To field, it comes as an array not single object. Is there any out of the box way to format values in arrays? My example JSON in context { "Email":["[email protected]", "NM...
Hi, Any playbook for "check website access if it is malicious"? To events that come from Cortex XDR Regards, Fábio
I'm currently using EWSv2 to listen to emails and have a classifier as well for fixed subjects. Is there a approach that I can use to take a part of an email subject to classify emails? As an example: Email Subject 1: Incident#1213131 Email Subject 2: Incident#3234234 Should be classified in "Incidents"
When automation EmailAskUser is used, a wait task is placed after it waiting if there's an answer. If there's no answer the automation will stay there forever, a time threshold is needed to continue the automation. How can be this time limit set?
Greetings all.I have this situation I am trying to resolve, but can't find a solution.I have a dynamic section in a layout, in which I want to add a button. When clicked, this button should run a query, but it should first ask for a user input, which needs to be a part of the query.Example:I want a button to run a Azure Log Analytics query.I mak...
