Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Resolved! Problem with setIncident command

I am working on a new automation which gets triggered dynamically from layout where in I need to check a custom attribute has changed in my remote machine, then update it on the xsoar incident. The custom attribute is a list/array. This is what I am doing in the automation...if len(oldAnomalies) != len(jsonResponse): # Update the new ...

sudhesub by L1 Bithead
  • 3409 Views
  • 2 replies
  • 0 Likes

Update automation script docker image version automatically

I have an automation script which updates all the non custom docker images versions to the latest version of it. It works well and updates all the non custom docker images to the latest version of it from docker images. Now I have some automation scripts using a particular image version. Since the docker image is updated to the latest version o...

IronPort integration with XSOAR, receiving to mails

Hi, I wondered if it's possible to check URLs from mails via integration with XSOAR and then send a response with verdict to those address which was recipient for this mail under investigation? Maybe you can advice some features for realization or something with analogous functional? Will be tanksful for any answer!

asernova by L0 Member
  • 1991 Views
  • 1 replies
  • 0 Likes

Test sample in the playbook

Hi, Is it possible to influence the sample data that is shown in playbook edit mode, when using Test to validate the data in any task? I find that in some playbooks it can give me to select the latest incident of that type, but on others - it only allows the incident data that was created e.g. 6 months ago at best for that incident type. Even ...

Antanas by L2 Linker
  • 1611 Views
  • 1 replies
  • 0 Likes

Appending Incident field from a script

Dears, I am blocking urls on a security control then save the value of URL in incident field name (blocked urls) using setIncident command, But every time I block new url the incident field is not appending the new url to the old url. It replace the old value with the new value. Kindly need your suggestion for how to append the value in i...

Resolved! HTTPS with a Signed Certificate

Hi, As per the below link, XSOAR on-perm services by default use self-signed certificates for secure HTTP connections. It would be great if you confirmed this would be applicable for the hosted service as well. https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-5/cortex-xsoar-admin/high-availability/use-a-signed-certificate#:~:text=By%20...

DP696 by L2 Linker
  • 2729 Views
  • 2 replies
  • 0 Likes

Resolved! Installing Python Libraries for Custom Automations

I have a need to use a library called "Beautiful Soup" for scraping and HTML Parsing on a Custom Automation I am writing for use in a playbook. How do I install the dependencies so that I can use any library that I need ? Traditional on VSCode I would use pip install etc on the server I see that it isn't so simple. Thanks in advance Cortex XSOAR

Free Cortex XSOAR training!

Hello to all on the youtube channel for the live community there is a 6 hour free training. You can also test the free community edition for the Cortex XSOAR and schedule a workshop if want to play with the tool a little more: https://www.youtube.com/playlist?list=PLD6FJ8WNiIqUVEA2e5LZhmqNnwFcFhDTZ About registering to a Palo Alto free Wor...

Resolved! Returning output from scripts that run on indicators to the war room

Hi, I am playing around with buttons on indicator layouts. The output from the script comes as a notification on the bottom of the screen. The output gets truncated if long. To overcome the problem I used the following lines of code. ``` command_result = CommandResults(readable_output=text)result = command_result.to_context() return_results...

  • 1298 Posts
  • 45 Subscriptions