Cortex XSOAR Discussions

Resolved! Returning output from scripts that run on indicators to the war room

Hi,

I am playing around with buttons on indicator layouts. The output from the script comes as a notification on the bottom of the screen. The output gets truncated if long. To overcome the problem I used the following lines of code.

```

command

...

How to remove Integration "cache" completely

Hi,

We are facing an issue where the integration ran into an error trying to pull an investigation from Secureworks, where an asset was not found, and the integration kept giving the same error continuously and would not pull the next investigation

...

Resolved! SLA Total Duration field in incident table

I can query successfully tickets that have an SLA > than X seconds.

What I'm having trouble with is displaying a field in the incident table.

For example: If i pull back tickets that have an SLA.TotalDuration > 2 days, I want to see the tickets an

...

Resolved! Replying to an Email using a Playbook

Hi All,

I need to automate customer follow ups using XSOAR. My requirements are as below.

Listen to emails and create incidents for each sent email - EWS V2 is being used for this
Once the initial mail is sent XSOAR will follow up with the custome

...

Resolved! Using Incident Variables Within Data Collection Web Form

Hello, I am attempting to use variables such as ${incident.name} within the Web Form in the section called "Short Description". After conducting tests I can see that It wont render any variables. They just appear as above. Now I can see that it suppo

...

Podman - Docker - new Integration

Why does every time I install a new Integration like (Splunk) I get a warning ( unavailable docker image 'demisto/python3XXXXXX' ) Used by Integration (name of the integration)?

although I have opened the access and if I go to the console i can pull t

...

Cortex XDR Incident

Hello everyone, we started dealing with Cortex XDR and after getting the furst Incident, I am kinda lost. I am not even sure whats the issue, there is a lot of "information" on the management console. For example, the Incident, under "Key Assets & Ar

...

If a pre-process rule fails how can it been seen if the incident hasn't been created?

Hello,

If a pre-process rule fails how can it been seen if the incident hasn't been created?

Could be that the the incident is created anyway?

Just to set in context:

A pre-process is created to introduce the playbook procedure documentation in the

...

Send Report to Slack

Hi,

I want to send the report created from Dashboard&Report section via slack. Is this possible? I only saw mail configuration.

How to count the playbook

We have a question for how to count the playbook?

We have a function with 3 product and 3 version.
How to count/quantify the playbook? Is 3 product X 3 vesrions =9 playbook?

For the playbook should different versions/bands be in the different playboo

...

Resolved! Subplaybook execution count

Hi!

Is there a way to count how many times was the specific subplaybook executed across mutliple/all incidents? How to ensure the number includes loops in subplaybooks?

The reason I need this number is to better understand ROI of the platform.

Th

...

Problems with the Integration "QRadar v3" - Mirroring not working and qradar-reset-last-run command not working

Hi everyone,

Anybody having problems with the Integration 'QRadar v3'?

In particular, I found two things that are not working:

- First, Offenses created in QRadar are not being creating Incidents on Cortex XSOAR.

I configured the integration fo

...

Transformer to delete line breaks in a string

Hello,

Some data is introduced in XSOAR with line breaks. Example:

data1,

data2,

data3,

data4

This data is joined with "," to be introduced in a task. However, data is not parsed correctly and the line breaks are introduced, causing an incorrect

...

Obtain payloads bounded by time and IoCs of Cisco Firepower from XSOAR

Hello,

We'd like to use Cisco Firepower integration to obtain extra info for our playbooks. However, we can't find the proper command to get the payloads of an event.

XSOAR Incident Opened Time

Once a XSOAR incident is created, how can we find when a user actually clicked & opened incident for the first time?

Discussions

Resolved! Returning output from scripts that run on indicators to the war room

How to remove Integration "cache" completely

Resolved! SLA Total Duration field in incident table

Resolved! Replying to an Email using a Playbook

Resolved! Using Incident Variables Within Data Collection Web Form

Podman - Docker - new Integration

Cortex XDR Incident

If a pre-process rule fails how can it been seen if the incident hasn't been created?

Send Report to Slack

How to count the playbook

Resolved! Subplaybook execution count

Problems with the Integration "QRadar v3" - Mirroring not working and qradar-reset-last-run command not working

Transformer to delete line breaks in a string

Obtain payloads bounded by time and IoCs of Cisco Firepower from XSOAR

XSOAR Incident Opened Time

Do we have XQL query builder feature in XSOAR

Where is the XSAOR 8 CLI Reference?

Pre Processing Rules Logs

XSOAR CMDB - SQL issue

Cortex XSOAR - Best Practice Optimize Threat Intelligence Management (TIM)

Re: DT Query, special characters in key:value pair

Re: Do we have XQL query builder feature in XSOAR

Re: Couldn't sort by date in bar graph widget in Dashboard

Unlock your full community experience!

Resolved! Returning output from scripts that run on indicators to the war room

Resolved! SLA Total Duration field in incident table

Resolved! Replying to an Email using a Playbook

Resolved! Using Incident Variables Within Data Collection Web Form

Resolved! Subplaybook execution count