This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

XSOAR License URI

Hello everyone,I want to access the XSOAR license date, but whatever I type in the 'uri' field does not return results (for demisto-api-get and internalHTTPRequest). How can I access it?I tried many uri like "!demisto-api-get uri=/license" but I could not access it.

Use TensorFlow models inside XSOAR automation

Hello, We'd like to create our own TensorFlow models to improve the system. The model will be trained and tested outside XSOAR, while the production model will be set inside an automation. The main problem here is whether XSOAR containers could have enough resources to make it work. The other option is to create a server to communicate via API w...

Josep by • L4 Transporter
  • 1401 Views
  • 1 replies
  • 0 Likes

Resolved! Display flags in long XSOAR automation

Hello, A long automation with no time limit is created. However, when we execute it, there's no way to know if it's executing properly. We've tried: "demisto.results" and putting information in the context but it only appears when it's completely executed. How can we display flags to know the progress of an automation?

SanDev by • L2 Linker
  • 4139 Views
  • 7 replies
  • 0 Likes

Resolved! MS 365 Defender Integration Error

Hi, I'm installing MS 365 Defender Addon using the guide (https://xsoar.pan.dev/docs/reference/integrations/microsoft-365-defender), and the "Self-Deployed Application - Client Credentials Flow" method. I have registered the app in Azure, and configured the addon with the App data (App Id, Secret, Tenant Id...) as in the guide. When I exec...

MTubia_0-1673396136905.png
MTubia by • L1 Bithead
  • 5445 Views
  • 6 replies
  • 0 Likes

Resolved! XSOAR Multi tenant Cortex Data Lake Integration

Hi, I'm checking the manual on how to set up integration between XSOAR and CDL. https://xsoar.pan.dev/docs/reference/integrations/cortex-data-lake If it is a multi-tenant XSOAR environment, what HUB should I go to for set-up(Step1 and Step4)? For example, I have an XSOAR environment for which I owned the license. And I want to integrate it...

Resolved! xsoar initial admin login fails - websockets error and CSRF token match problem

I installed xsoar 6.6 according to the instructions and am using nginx as a front-end. I also configured nginx according to the instructions, but I am connecting to xsoar from nginx via http and port 8080 (as opposed to https/443 as used in the example nginx config).I created the otc.conf.json file with the initial admin user and restarted the ...

bchill by • L1 Bithead
  • 4909 Views
  • 3 replies
  • 0 Likes

Recurrent data input problems in tasks

Hello, Data key received from API calls don't always have the same format in the context. Example: Sometimes it could be: data.[0].results.username data.results.[0].username data.[0].results.[0].username data.results.username The API call is the one creating these formats in the context. There's no possibility to change the call. How can the inp...

Josep by • L4 Transporter
  • 2080 Views
  • 2 replies
  • 0 Likes

Resolved! SearchIncidentsV2 doesn't obtain only incidents with the exact name.

Hello, I'm using !SearchIncidentsV2 query=`name: "This is a test"`, just to find the incidents with name "This is a test". However, when the command is executed, it shows not only those incidents but also incidents with longer names, for example: "This is a test (russ)". How can the command limit to the strict words?

Josep by • L4 Transporter
  • 2469 Views
  • 2 replies
  • 0 Likes

XSOAR XDR Query Context Data Delay

Hi everybody, could you please help me with following issue? When I use XQL query to XDR dataset (!xdr-xql-generic-query) it returns correct data to the War room but before are this data moved to Context data it takes almost 5 minutes (No matter how many data has been returned from XDR. This interval is always the same). It looks like some kind ...

XSOAR Proofpoint TAP and TRAP Email Ingestion

Palo Alto XSOAR is not able to ingest Proofpoint's TAP (Targeted Attack Protection) or TRAP (Threat Response Auto-Pull) emails. Because of the automation that is being done with TAP and TRAP, these emails do not go through XSOAR for "phishing" analysis. Our "Phishing" emails go right to XSOAR once a user reports it as phishing with the outlook e...

Resolved! Problem with setIncident command

I am working on a new automation which gets triggered dynamically from layout where in I need to check a custom attribute has changed in my remote machine, then update it on the xsoar incident. The custom attribute is a list/array. This is what I am doing in the automation...if len(oldAnomalies) != len(jsonResponse): # Update the new ...

sudhesub by • L1 Bithead
  • 3702 Views
  • 2 replies
  • 0 Likes

Update automation script docker image version automatically

I have an automation script which updates all the non custom docker images versions to the latest version of it. It works well and updates all the non custom docker images to the latest version of it from docker images. Now I have some automation scripts using a particular image version. Since the docker image is updated to the latest version o...

  • 1308 Posts
  • 46 Subscriptions
Top Solution Authors
View All
Top Liked Posts
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks