This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

XSOAR CPU been too High

For a while now, our DEV XSOAR server has been holding cpu percentage at 65%. 0 jobs, 0 active workers, less than 10 enabled integrations, and 99 containers. Why is it so high? Any help to diagnose or reduce this percentage is appreciated!

NickyR by • L1 Bithead
  • 2092 Views
  • 1 replies
  • 0 Likes

Resolved! Dynamic interactive multi select input inside a playbook

Dears, We are trying to do the following scenario and we want to check if it is doable or not: 1- We have a phishing playbook. 2- We are extracting all the attachments that are included inside an email file (.eml file). 3- the extraction of these files is working properly and we have each file associated with an entry id. 4- we want to su...

Not able to use the context of one closed incident in a new one using Debugger Panel.

Hello, I'd like to use the information I have in a already closed incident into a new one I'm developing just to test it. When I click in the "Debugger Panel"->"Test data" and I search by the id of the closed incident it doesn't show up.Is there a way of importing the context without opening again the incident? Thanks.

Josep by • L4 Transporter
  • 1606 Views
  • 1 replies
  • 0 Likes

Resolved! python question about importing "msal" module

I want to be able to use this module with my automation scripts: msal: https://github.com/AzureAD/microsoft-authentication-library-for-python import msal by default fails as the module is not installed or available by default. How would i manually correct?

JoshBoyd by • L2 Linker
  • 4888 Views
  • 4 replies
  • 0 Likes

Resolved! Indicator enrichment detail in layout

Hi, In one of our playbook there are 2 enrichment type of integrations deployed for ip enrichment (virustotal and abusedb) all works well as expected and they feed indicator itself but shows only verdict in indicator layout although these enrichments return much more detailed data. I need help about visualize this detailed post-indicator-enric...

MKececioglu_0-1661949108501.png
MKececioglu_1-1661949119395.png

Playbook task naming in subplaybooks

Hi! I can't find much data on Subplaybook naming numbers - how are they being assign and when do they change? I've run into the following issue: i had a standalone playbook with some subplaybooks inside. In the main playbook I've been referring to the results of the subplaybooks by e.g. subplaybook-167.something. It worked fine until I started...

Antanas by • L2 Linker
  • 5020 Views
  • 7 replies
  • 0 Likes

Resolved! Get command arguments in Powershell scripts

Hi all I'm trying to get Command-Arguments in a self-made script in Powershell. On Python it is:demisto.args().get('<command-argument>') What is it in Powershell? Because I tried it with:$demisto.Args()["<command-argument>"]But this didn't worked on my self-made script. (Cortex XSOAR Version: 6.0.2 Build: 94597) Thanksroger

Resolved! Upload IOC from file to firewall via XSOAR

Hi, I want to find a way of maximum automatization of the next process: IOC are extracted from CSV file to Cortex XSOAR and than only this indicators are uploaded to firewalls. I found automations for each step separately but maybe exist any playbook or integration with such functionality? And another less important question is how to co...

asernova by • L0 Member
  • 2609 Views
  • 1 replies
  • 0 Likes

Fail to connect to Marketplace

Hello, Having installed XSOAR v6.8 in RH7.6, also configured Docker too. Proxy and internal DNS is required in our environment. Configured the Proxy on both WebUI and Docker as well. We could login to GUI, but we cannot reach the marketplace. Found out there are many DNS queries from the XSOAR to the root DNS server in our firewall log. Any id...

Resolved! CrowdStrike Falcon detection mirroring

Hi there, I hope to find some help here.We are facing issues to make the CrowdStrike Falcon mirroring options work. @We are following the instruction provided in the documentation https://xsoar.pan.dev/docs/reference/integrations/crowdstrike-falcon Here is how our integration is set:1. Set a classifier (the system classifier "CrowdStrike Falcon ...

Isabelle by • L0 Member
  • 5446 Views
  • 2 replies
  • 0 Likes
  • 1307 Posts
  • 46 Subscriptions
Top Solution Authors
View All
Top Liked Posts
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks