I want to attach attachment in incident using playbook.

Hi Team, I have one use case I wanted to attach an attachment in an incident using the playbook. So I have one command which retrieves attachments of particular incidents.  I have created one playbook which first retrieves the attachment of a particu

XSOAR Search queries

Hello Team,

Trying to remove tags from multiple cases at one go however failed due to incorrect syntax.

• !lr-case-tags-remove case_id:"16563,16532,16626" tag_numbers=154

  Should it be split into multiple lines to execute? could someone assist me wi

Automate download of playbooks backup

Hello,

Is there any way to automate this?

Thank you in advance

Notify user by Microsoft Teams from XSOAR

Hello,

I'd like to send direct messages using Microsoft Teams from XSOAR. No command was found inside Microsoft Teams integration to do it. Do you know how can create this feature?

Cortex XSOAR Multi-Tenant Live Backup License File

integration mirroring vs post processing script mirroring

Our current setup mirrors incidents by post processing scripts. Bulk incident close makes too much noise in the system. It creates a container for each incident at the same time. It can overload the system from time to time. How does mirroring in the

Preprocess rule - link & run a script in the same rule

Hi,

Is there a way to configure pre-process rule to link and run preprocess script? I have to link incidents with few identical fields and set some fields values using script. I thought to make preprocess script which will do both, but I ran into a

How to modify edit fields form applied to multiple incident types for bulk editing

Hi All,

I'm attempting to add a custom field to the edit feature in XSOAR and cannot find any documentation when it comes to having that field show up in the edit form when editing multiple incidents regardless of type. When the edit layout is upda

Create a job to check if an instance pull has failed

Hello,

Sometimes on instance fails pulling the data, however the instance has connection. It's just an error feeding the instance.

How can a job be created to check is a pull has failed?

Put alerts of the same type in just a single one daily.

Hello, 

I receive many alerts of the same type each day creating an incident for each. 

I would like to put together all them in an incident and avoid creating incidents individually. So it will be solved just once.