This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

Create dashboard or mail to report updates in own XSOAR content packs.

Hello, We're having some problems with some content packs compatibility in XSOAR, normally we update all them as soon as possible. However, sometimes they fail, so going back to the last version is needed. We'd like to have some visual information about how the versions of the content packs are updating, for exemple, to know if in the last 3 day...

Josep by • L4 Transporter
  • 2142 Views
  • 2 replies
  • 0 Likes

Resolved! Problems with SentinelOne V2 Integration - 401

Hello, In the past few days our SentinelOne Integration has stopped working. I am seeing the following error; [Failed to execute test-module command. Error: Error in API call [401] - UNAUTHORIZED {"errors": [{"code": 4010010, "detail": null, "title": "Authentication Failed"}]} (85)] . In regards to the Server URL nothing has changed and all ot...

wildfire-get-sample (WildFire-v2) Permission Denied

Hello I'd like to use wildfire-get-sample (WildFire-v2) In the instances settings there is only one entry: API. That API I get from https://eu.wildfire.paloaltonetworks.com/wildfire/account In the instances I do a Test an it returned as "Success" But whatever I try in any Playbook, I always get: Reason Request Failed with status: 403 Reaso...

Resolved! Get Dashboard/Widget value from Cortex XSOAR

I created API key in setting and trying to get the dashboard/widget value (e.g. Playbook runs) from XSOAR but failed. In the API guideline, there is no example of body parameters in "Get Dashboard Statistics" or "Get Widget Statistics", so I have no idea what should I input in order to get the value. Would someone please help for this? Thanks.

ce13_0-1663730334768.png
ce13 by • L1 Bithead
  • 3835 Views
  • 2 replies
  • 0 Likes

Not show tasks with errors in the layout when "stop on errors" is set to "no" inside the task.

The incident layout shows the tasks with "Waiting for user"(orange) and "Task with errors"(red). That's important so it can be checked, however some tasks are set with "stop on errors" to "no", because the playbook can be solved without those tasks. How can make this tasks not to show in the layout?

Josep by • L4 Transporter
  • 1580 Views
  • 1 replies
  • 0 Likes

Automation Output In Indicator or Incident Layout

Dear all, We have an issue about visulazating the outputs of indicator enrichment via using virus total ( vt-passive-dns-data). To be more specific I am going to share our indicator layout and what we are expecting. As its given in the first screenshot we are using nearly default indicator layout. However to provide more precise informatio...

UmutAK_0-1662462438500.png
UmutAK by • L1 Bithead
  • 3557 Views
  • 2 replies
  • 0 Likes

Best way to manage a time based IP blocklist in XSOAR

Hi All, I have been trying to find the best way to manage a list of IP addresses. This is the idea I am trying to achieve. 1) I identify an IP address that is malicious and block it on the PaloAlto firewall in a static object group. 2) I keep track of the IP address along with the time I added it 3) After 48 hours I check the IP addresses I...

Query in Lucene syntax don't get the created data time

Hello, I'm trying to use the automation "SearchIncidentsV2" to get the incidents with two conditions: the name and a range of time. To achieve this, first I created a simple Query to get only the incidentes with a name. name: "name of playbook" It works and a markdown file can be downloaded with all the incidents and other info, like when w...

Josep by • L4 Transporter
  • 3198 Views
  • 3 replies
  • 0 Likes

Reload QRadar incident information

Is there a form to reload the QRadar inicial values for the incident in case it didn't extract them? Once QRadar set his values in incident context there's no way to reload them in case of error.

Josep by • L4 Transporter
  • 2387 Views
  • 3 replies
  • 0 Likes

Managing Self-signed Certificates

As per the below link it's been mention that by default XSOAR uses self signed certificates for secure HTTP connection. https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-5/cortex-xsoar-admin/installation/post-installation-checklist/https-with-a-signed-certificate#:~:text=By%20default%20the%20server%20uses%20a%20self%2Dsigned%20certificate%...

DP696 by • L2 Linker
  • 1753 Views
  • 1 replies
  • 0 Likes

Resolved! Editing details in xsoar integration

Hi , just want to know if we change the password or any details in a XSOAR integration that fetches incidents do we have to change the “ first fetch time stamp” to fetch new incidents alone ? Or will it just pull new incidents after the password change ? For example : I have an integration xyz that is fetching incidents and I decide to change...

Failed to start Demisto Server Service

Hello Everyone, We recently ran our of disk space on our XSOAR device. I was able to clear out 30GB of old updates/files, ect. I rebooted the server after deleting the files and the Demisto service will not start. When running systemctl status demisto I see the following errors. Sep 14 16:29:43 server systemd[1]: Unit demisto.service entered...

  • 1308 Posts
  • 46 Subscriptions
Top Solution Authors
View All
Top Liked Posts
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks