This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

Script failed to run: Timeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)

We have a playbook task that sends a query to run on Splunk using the SplunkPy but it keeps failing and returning the following error#22: Splunk Search Query Command: !splunk-search query="index= test blah blah" earliest_time="1666679348" latest_time="1666852148" batch_limit="25000" update_context="true" interval_in_seconds="30"ReasonError from ...

Resolved! Configuration file to playbook

Hi all, I need to provide an externally uploaded configuration file to a playbook whose content varies periodically (it's a list of names). What is the best way to do this? The user who uploads the file can access the XSOAR GUI interface with an Analyst profile.

Rename XSOAR tenant

Receiving more business from a customer for some of their other entities. I need to rename an XSOAR tenant to be more pointed - Is there any instructions on renaming.Can i just stop the tenant and rename the folder on the backend; assume there's more to it than that -

JoshBoyd by • L2 Linker
  • 2026 Views
  • 1 replies
  • 0 Likes

Phone call from XSOAR

How can i make Phone calls from a playbook? I found the twilio integration which is able to send SMS, but I'd rather make a phone call to the incident manager somehow. Have you found any solution to this?

McAfee Integration not sending Summary of alerts to XSOAR for ingestion.

I have an integration between McAfee ESM (SIEM) that produces Alerts. 95% of alerts are received by the XSOAR including the "Summary" which is essentially the Alert Packet. Every few days some alerts are received that do not contain the summary. So essentially the time-stamp and the Alert Name appears yet there are no Summary details. The contex...

Resolved! Timeout: Palo Alto Networks WildFire v2

Hello I've configured the Palo Alto Networks WildFire v2 Service with a Wildfire-API Key from our Wildfire-Account at https://eu.wildfire.paloaltonetworks.com/wildfire/accountI also use this Server base URL: https://wildfire.paloaltonetworks.com/publicapi But if I press the Test Button or use this Service in a Playbook, It runs into this:Script ...

Reports generation and download takes alot of time

Hello, I have any issue with generating reports in PDF and CSV formats, as it takes about 10-15mins to generate the report. This issue doesn't exist with word doc. I tried this multiple times as i thought that the docker image for those tasks maybe not local on the server and it took time to download from the Docker Hub registery, but the fac...

Resolved! Xsoar - XDR Public API Unauthorised

I am having difficulty integrating the XDR Integration. I have followed the instructions and have generated an "Advanced Key", copied the Key and the Key ID + URL. I have inserted the relevant details on the Instance Settings. When I perform "Test" I receive "401 Public API Unauthorised". I have tested multiple different roles of API including t...

Resolved! How do I get the numeric incident id in an automation?

I'm working with a Python automation, and I need to get the numeric incident id. I expect this id to be numeric (123456) but it is always a long concatenated hex string and GUID. incident = demisto.incidents()[0]incident_id = incident['id']print(incident_id ) Output is: 89a633e1ef019afeee78fbb2ac23ee84$&$234f4f55-5c46-44b1-8662-6f65039a9a0c...

Raoul by • L0 Member
  • 4622 Views
  • 1 replies
  • 0 Likes

Resolved! split input to chunks with python

Hi, I'm trying to build an automation which would take an array of objects as an input, split it to chunks of specified number and put in the context. E.g. I have 36 IP addresses, i want it to split to chunks of 10. The end result would be having them in a context - 3 keys having 10 IPs and on key having the remaining 6 IPs. I can set the spli...

Antanas_0-1665477516583.png
Antanas by • L2 Linker
  • 4665 Views
  • 3 replies
  • 0 Likes

XSoar Integration with cisco firepower

Dears, I installed cisco firepower integration. from Market Place. I use update network group objects command but actually it removes all the IP addresses inside this group and add the only list that I newly updated. Kindly need your support. Also for Integration with ASA firewall , it failed in the testing phase as it gives me error ...

Data presentation on XSOAR Web

Hi, I have a use case where I want to share some sensitive data with users which should have an expiration date. I want data to be put on XSOAR web server, which I would have a link for and expire after certain time. I find similar funcionality with data collection task via email when user receives a link to XSOAR and can submit his response o...

Antanas by • L2 Linker
  • 1746 Views
  • 1 replies
  • 0 Likes

Questions for livebackup

Dears,we now are installing a new server to be our live backup server, we have multiple questions regarding this Kindly need your answer :1- Do we need a License for The Live backup Server????2-Are the configuration and Data are moving in real time from Active Server to standby Server?3-In case our main server is down and we converted the standb...

Resolved! User authentication

Hi, Can we use Active Directory Authentication integration for authenticate users into XSOAR, when we are using Azure AD. If not, what is the integration best suitable? Thanks

DP696 by • L2 Linker
  • 2390 Views
  • 1 replies
  • 0 Likes
  • 1307 Posts
  • 46 Subscriptions
Top Solution Authors
View All
Top Liked Posts
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks