This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

extend-context of multiple columns at once

Hi all.I'm struggling a lot to solve a particular issue.I am performing a Log analytics query which returns 4 columns (named AuthenticationRequirement, ResultType, ExternalUser and TrustedNetwork). The result could result in multiple rows with these 4 columns.I want to map each of these columns to a separate key, but I don't find a suitable way ...

EspenAbildgaard_0-1664871502807.png
EspenAbildgaard_0-1664872920815.png
EspenAbildgaard_0-1664872384980.png

Resolved! Search custom fields in report query

Hi, I think subject is clear enough that what i want to 🙂 , for some reason i want to query on some custom fields in report query page. As below pictures presents "domain" is the custom field that i need to query but no way to call it in report query page. Changing mapper and map to a searchable filed is a workaround but i need to query exa...

MKececioglu_0-1658219660817.png
MKececioglu_1-1658219709934.png

I want to attach attachment in incident using playbook.

Hi Team, I have one use case I wanted to attach an attachment in an incident using the playbook. So I have one command which retrieves attachments of particular incidents. I have created one playbook which first retrieves the attachment of a particular incident and then in the second task I'm using setIncident command to update incidents with a...

shreyash_412_1-1675055542282.png

XSOAR Search queries

Hello Team, Trying to remove tags from multiple cases at one go however failed due to incorrect syntax. !lr-case-tags-remove case_id:"16563,16532,16626" tag_numbers=154 Should it be split into multiple lines to execute? could someone assist me with the best way to achieve this requirement. Regards Parans

Parans by • L0 Member
  • 1790 Views
  • 1 replies
  • 0 Likes

Resolved! Creation of table from arrays

I am trying to create a table something like this: I already have arrays (of names in this example) for each situation. So my HasX array would be like ["John", "Roger"] and my 'doesn't have X' array would be ["Steve"], and similar for Y with ["Roger", "Steve"] and ["John"] for the two properties. I feel like I have all the information to ...

JMaton1_1-1665053040919.png
JMaton1 by • L1 Bithead
  • 3583 Views
  • 2 replies
  • 0 Likes

Resolved! not able to retrieve Extend Context Output

Hi Team, I'm trying to get the output field which I want in "jira-issue-query" command. But I couldn't be able to get it. Below are the default outputs for Jira Issue. Now I want only one particular Field as an output. So I used Extend Context field to get the desired output (in this case, I want only the "ID" field as an ouput) But, I'm no...

Keerthigav_0-1675825392522.png
Keerthigav_1-1675825630484.png

Cortex XSOAR Multi-Tenant Live Backup License File

Hi, Does someone know how long the demisto requires to complete the sync license from the primary server to the backup server? Please note you are posting a public message where community members and experts can provide assistance. Sharing private information such as serial numbers or company information is not recommended.

image.png

integration mirroring vs post processing script mirroring

Our current setup mirrors incidents by post processing scripts. Bulk incident close makes too much noise in the system. It creates a container for each incident at the same time. It can overload the system from time to time. How does mirroring in the integration work? Does it mirror incidents one by one without creating a container for each?

Preprocess rule - link & run a script in the same rule

Hi, Is there a way to configure pre-process rule to link and run preprocess script? I have to link incidents with few identical fields and set some fields values using script. I thought to make preprocess script which will do both, but I ran into a problem. As I see during preprocess the incident doesn't have ID assigned yet, so I can't use co...

How to modify edit fields form applied to multiple incident types for bulk editing

Hi All, I'm attempting to add a custom field to the edit feature in XSOAR and cannot find any documentation when it comes to having that field show up in the edit form when editing multiple incidents regardless of type. When the edit layout is updated for any incident type, it is only used when editing a single incident of that incident type. ...

  • 1307 Posts
  • 46 Subscriptions
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks