Hello, Sometimes on instance fails pulling the data, however the instance has connection. It's just an error feeding the instance. How can a job be created to check is a pull has failed?
Hello, I receive many alerts of the same type each day creating an incident for each. I would like to put together all them in an incident and avoid creating incidents individually. So it will be solved just once.
Hello, I followed this docker hardening documentation to harden the docker containerzied environment for Cortex XSOAR solutin. I added the first server configuration key as this (docker.run.internal.asuser = true), and reset docker containers then issue this command (!py script="import os;print(os.getuid())") to validate if docker currently...
Hey! I'm trying to get a widget on a dashboard that shows a field and how many times it has triggered next to it.Example: Name: | Alert Count: ---------------------------------------------- Department 1 | 4 Department 2 | 2Department 3 | 6I know the horizontal bar allows you to group by a sp...
Hello, Now we are using CiscoEmailSecurity (Beta) integration for version 13.8.1, and is going to be updated to 14.2.0. How could we know if it's compatible? Thanks
Why is there a separate dictionary returned from demisto.incident? Does it matter whether a field is custom or builtin demisto.incident()['CustomFields']['myfield']I am asking this because I am thinking about implementing a custom function in CommonUserPython to grab field values without worrying about if the field is custom or built-in. Would t...
Hi All, In the new version of XSOAR server 6.10 GA cannot save the filter in the Playground War Room. The save bottom cannot click. Everyone found this same issue or not? BR Sakkarin Pichetskul
whenever there is an email thread involved in the incident, a field in the context is created as EmailThreads: [{email1 values}, {email 2 values}]I want to find all the incidents which have this email thread involved.
Hi, Is there a way to run XSOAR automations across all tenants without having to place (push) the automation into all the tenants? If I wanted to write a script to pull all incidents across all tenants, how would I do that? Thank you.
Hi everyone, I want to create a job to run everyday at 12pm to check if any license in the tenants expires in a week. The main account doesn't have the jobs tab. so I can't simply sync the job to all the tenants. What are my options?
While running a command in the XSOAR, there is a common argument named "execution-timeout" which increases the timeout for the command. Can I use this argument directly in the python code? What I want to achieve is, I have one command which is taking more than 5 minutes (which is the default timeout for a command) to complete. Now, I don't want ...
Is there a way to copy/paste tasks between playbooks? I have many occasions when similar task logic can be reused elsewhere (and I am not talking sub-playbooks here) and the quickest way to be copy/paste the task in the new playbook. However the copy function seem to be limited to a current playbook only, dragging the task to different playbook...
Hello, I am trying to set the IncidentName and IncidentSeverity of an XSoar incident with the incoming mapper but it does not work. Ive tried googling and reading up but I cant find how you are supposed to set these fields. Has anyone done this before and can point me to the right documentation to follow? Thanks!
Hi, I wanted to integrate Mulesoft with XSOAR, Since Mulesoft is not available in XSOAR marketplace, looking for Mulesoft' s REST API documentation or connector which will be helpful to develop custom integration in XSOAR. Can you help me to get those details if you have already developed custom integration for Mulesoft. Thanks in advance.
Is it necessary to add a tag to the entry or comment in XSOAR to get it mirrored on remote incident?Suppose, I do not add a tag to a note/war room entry, then do I get that entry in the "UpdateRemoteSystemArgs"? Currently, I am not getting that entry in the "UpdateRemoteSystemArgs". Is it so that I have done something wrong in configura...
