This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

integration mirroring vs post processing script mirroring

Our current setup mirrors incidents by post processing scripts. Bulk incident close makes too much noise in the system. It creates a container for each incident at the same time. It can overload the system from time to time. How does mirroring in the integration work? Does it mirror incidents one by one without creating a container for each?

Preprocess rule - link & run a script in the same rule

Hi, Is there a way to configure pre-process rule to link and run preprocess script? I have to link incidents with few identical fields and set some fields values using script. I thought to make preprocess script which will do both, but I ran into a problem. As I see during preprocess the incident doesn't have ID assigned yet, so I can't use co...

How to modify edit fields form applied to multiple incident types for bulk editing

Hi All, I'm attempting to add a custom field to the edit feature in XSOAR and cannot find any documentation when it comes to having that field show up in the edit form when editing multiple incidents regardless of type. When the edit layout is updated for any incident type, it is only used when editing a single incident of that incident type. ...

Docker Hardening

Hello, I followed this docker hardening documentation to harden the docker containerzied environment for Cortex XSOAR solutin. I added the first server configuration key as this (docker.run.internal.asuser = true), and reset docker containers then issue this command (!py script="import os;print(os.getuid())") to validate if docker currently...

[DemistoClassApiModule] Why CustomFields in demisto.incident()

Why is there a separate dictionary returned from demisto.incident? Does it matter whether a field is custom or builtin demisto.incident()['CustomFields']['myfield']I am asking this because I am thinking about implementing a custom function in CommonUserPython to grab field values without worrying about if the field is custom or built-in. Would t...

Multi Tenant Automation

Hi, Is there a way to run XSOAR automations across all tenants without having to place (push) the automation into all the tenants? If I wanted to write a script to pull all incidents across all tenants, how would I do that? Thank you.

  • 1298 Posts
  • 45 Subscriptions
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks