This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

Resolved! How to change a .xlsx file in context data or upload new from python script

Hi all, Could you help me with the following problem? I have an incident with .xlsx file that I handle by pandas and openpyxl. After the file will be handled, I need to save it to the context data to upload it to IRP by IRP integration and process a ticket. but I have a problem: when I save the .xlxs file by the method .save from openpyxl t...

PachaOne by • L1 Bithead
  • 3022 Views
  • 1 replies
  • 0 Likes

Command "setList" issue introducing variables from context

Hello, We're using command "demisto.executeCommand("setList",{"listName":listName,"listData":listContent})" in order to introduce data in a json list. Where the "listName" is a json list name and "listContent" is data extracted from the context. The issue: The values introduced in "listContent" are like this example, "IPs" is a context variabl...

Josep by • L4 Transporter
  • 3270 Views
  • 4 replies
  • 0 Likes

Resolved! SAML role configuration in XSOAR

Hi, We are using SAML 2.0 integration for user authentication to XSOAR. Can someone help to understand what value need to update on "SAML Roles Mapping" in XSOAR under Settings->User and Roles-> Roles. Thanks, Deepa

DP696 by • L2 Linker
  • 2267 Views
  • 1 replies
  • 0 Likes

Resolved! Looking for a way to identify links between our parent and subplaybooks.

This relates to lifecycle management and removing old unused playbooks/subplaybooks. We can use the XSOAR Metrics widget to see when a playbook last executed, however this isn't always a good indicator as we have playbooks for rare events which have never triggered but are still required. This isn't such an issue with our parent playbooks as ...

DHodd1 by • L0 Member
  • 2137 Views
  • 1 replies
  • 0 Likes

Convert Multiple Files

Hello, I am trying to convert multiple files with different extensions using the 'ConvertFile' automation, so that it can be display on the layout. However, when there are different types of files in one incident, it keeps giving me an error. What would be the best way to list all files and convert them by EntryID? Here what I currently have con...

axespera_0-1670353410461.png
axespera by • L1 Bithead
  • 2839 Views
  • 3 replies
  • 0 Likes

A question from the Malware Pack v2 webinar: Malware pack playbooks optimization

Kudos for all the work on developing these playbooks. Are they optimized so the incidents don't get flagged under System Diagnostics (exceptionally big incidents, exceptionally big context, etc)? Note: This question was asked as part of Cortex XSOAR Customer Success Webinar: Malware Investigation & Response V2

rtsedaka by • L6 Presenter
  • 2196 Views
  • 1 replies
  • 0 Likes

A question from the Malware Pack v2 webinar: Misclassification rate

How do you address the extremely high misclassification rate of both file detonation (any semi-sophisticated malware won't divulge any information in a sandbox) as well as the high misclassification by Virustotal (both FP and TP)? Note: This question was asked as part of Cortex XSOAR Customer Success Webinar: Malware Investigation & Respon...

rtsedaka by • L6 Presenter
  • 2032 Views
  • 1 replies
  • 0 Likes

Resolved! Make a section in layout a static list?

Hi all!I've been looking at trying to make a section in a layout a static list, but could not find any easy ways to do it.Essentially what I am looking for is:I have a layout, in which I have a section called X. Now what I want is that every time an incident is created, the section field X is populated with the contents of a list called Y. The c...

Resolved! XSOAR NSlookup and ThreatVault info

Hi everybody, is there a way how to get following information in XSOAR? - NSLOOKUP - I have an IP address and need to get name from internal DNS server - Threat Vault info - I have an information from the firewall (threat name and threat ID) and I need to get more info like CVE number, threat description etc. Thank you, Jan

Resolved! integration indicator pull limits?

Hi there, I've just started testing threat feed integration in XSOAR. For some reason, the integration instance was only downloading 100 indicators on each pull whereas the source has thousands. Is it because my AWS instance doesn't have a license? Is there a limit on how many indicators can be downloaded into XSoar? Thanks in advance!

boweic by • L0 Member
  • 2293 Views
  • 1 replies
  • 0 Likes

Resolved! "Enable pagination" for table widgets on dashboards

Ticking the box in the widget 'Operations' tab and selecting how many rows to show per page doesn't appear to do anything. The table always says "Showing Total 279 results sorted by: Id" and there are no page navigation buttons anywhere. Has anyone else used this feature successfully? Tried Chrome and Edge in case it was a browser issue, with...

Resolved! Extract Indicators from context to Field

Hi, I have one playbook where I'm using the Builtin ExtractIndicators Function to extract any indicator from one field, and it's working fine: After this, I call more subplaybooks, and I want, from this subplaybooks, use this indicators for some action, for example send an email or create a ticket in a ticketing system. How can I access to this...

MTubia_0-1669885597443.png
MTubia by • L1 Bithead
  • 4400 Views
  • 3 replies
  • 0 Likes

fatal Error during ensure repo

Hi everyone,I am facing a strange issue. I was trying to change the certificate like explained in this link https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar-admin/installation/post-installation-checklist/https-with-a-signed-certificate/create-a-private-key-and-certificate-signing-request-csr.html.But after I did the restart...

arn_stoz by • L0 Member
  • 6891 Views
  • 7 replies
  • 0 Likes
  • 1310 Posts
  • 46 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks