Cortex XSOAR Discussions

Question from "Dev to Prod" Webinar - restructuring and creating directories for content items

Has there been any consideration into restructuring and creating directories for the various content items vs the current strategy of everything going into a flat list? When you get to a point where there is a lot of content it becomes very burdensom

Question from "Dev to Prod" Webinar - Ansible

Can ansible used for deployment of SOAR ?

**Note: this is a question from our CS Webinar: Dev to Prod Configuration and Best Practices in Cortex XSOAR

Question from "Dev to Prod" Webinar - Export Custom Content

Will Export Custom Content export a change to a system field (Like setting "Owner" to mandatory? This has not been my experience.

**Note: this is a question from our CS Webinar: Dev to Prod Configuration and Best Practices in Cortex XSOAR

Integrating Palo Alto XSOAR or leveraged any other API integration with any of the following next-gen firewalls: Checkpoint Smart Log, Fortinet, a

Has anyone tried integrating Palo Alto XSOAR or leveraged any other API integration with any of the following next-gen firewalls: Checkpoint Smart Log, Fortinet, and Cisco firewalls for running automated searches for IOCs such as IP addresses, URLs f

QRadar API get assets query

Does anyone know with QRadar Integration: "qradar-assets-list"

how to get incident xdr my endpoint only in xsoar

I successfully configured and integrated xdr into Xsoar

but in xsoar incidents page it gets all common incidents from XDR but i need to get only my own endpoint user incident

there is a filter option in the xdr incident to use and check your own end us

Cortex XSOAR integration

Hi, I want to poll for Status that is nested under Results. See below example :

I have this output when running the command tn-get-question-result

Tanium.QuestionResult
{
"QuestionID": "455036",
"Results": [
{
"ComputerName": "WIN-KBR5CNLJK52.icdc-caas.loca

Add event data into "incident summary" section in "incident info"

Hi,

Is there any way to add a specific event field into "incident info" page to visualize in the "Incident Summary" section. Let's say a request url is not included in incident info but in event info we have the url information.. 

Regards.

ip list retention

Hi,

In our environment we have a list to hold ip addresses with comma seperated format, how can we provide data retention for each ip addresses within the list.

Regards.

How to change Dashboard Widget Date Range from occurred to closed date

Looking at some of my widgets on my dashboard, i noticed there is a date range filter.  But is there a way to specify to use the closed date and not the occurred date?