Cortex XSOAR Discussions

Resolved! CrowdStrike Falcon detection mirroring

Hi there, I hope to find some help here.We are facing issues to make the CrowdStrike Falcon mirroring options work. @We are following the instruction provided in the documentation https://xsoar.pan.dev/docs/reference/integrations/crowdstrike-falcon Here is how our integration is set:1. Set a classifier (the system classifier "CrowdStrike Falcon ...

Credential management in XSOAR

Hi, How are the credentials for the integrations handled within the product? I.e., are passwords and keys stored in the cloud? And how are these managed securely? Thanks,

Resolved! Create individual incidents for each value in a list in parallel

Hello, A list of URLs splitted by "," is used in automation. The automation should create a new incident for each value, however it shouldn't be created in a sequential way. All incidents should be created at the same time (don't need to finish the first incident to get the next one).

Resolved! Read emails from mailbox

Hi, I am trying to read the mailbox that we created on Exchange. Other than IMAP is there any other option we have in XSOAR to read mails?

Resolved! XSOAR Engine Backup/Restore

Background:In our XSOAR platform setup, the XSOAR server is cloud hosted by Palo Alto and the XSOAR engines are deployed at 2 different data centers (on-prem). Each of these datacenters will have a single Cortex XSOAR engine server installed, which will include, a. Production Engine b. Development Engine. Both the XSOAR engines from different d...

Are XSOAR incident type updated?

Hello, When an incident comes to XSOAR the classifier set the incident type. I would like to know if the incident is updated with new alerts (for ex. in Cortex XDR), will the incident type in XSOAR be updated if needed or is the type set and never change (like the incident name)? When an incident is updated does the entire process runs again (cl...

Resolved! RHEL Installer Type and Podman Installation Steps

1. What RHEL installer type (minimal or full fledge GUI) should be considered for XSOAR engine server? 2. Is there any documentation by Palo Alto on Podman proxy configuration for XSOAR Engine installation and any specific URLs required to be whitelisted for Podman like Docker? The following URL has information on Docker but not related to ...

Context data 2 layout

Hi all, I wonder that if it is possible to show context data directly on layout, without mapping that data to incident field.

XSOAR Cisco Prime Integration

Hi, When will the cisco prime integration available in marketplace. Is there any license limitation to use Cisco prime content pack? Regards, Deepa

Setting up classification & mapping for email ingest

Hi, Here are two different emails subject: 1. Test email - Phishing Email 2. Test email - Ping Two playbooks: 1. Phishing Email 2. Ping Currently I have setup two instances of integration "Mail Listener v2" with corresponding incident types so that phishing email will go to playbook - phishing email and ping email will go to playbook - pi...

Rasterize PDF format queries

Hi, I created a PDF report using rasterize with HTML body content. The XSOAR variables I put contains URLs and Email addresses. My first challenge i faced was the variables when replaced with the acutal values (URLs and emails), they are clickable. I want to prevent this as this is a phishing analysis report and I do not want the viewer to acc...

XSOAR Engine Storage Requirements

Hi, As per the below link its mentioned minimum storage requirement for XSOAR engine is 100 GB. And for drive partition it is recommended to allocate 50 GB for /var and 50 GB for /home is XSOAR engine is getting installed on RHEL 8.x. In this case other partitions like /tmp, /usr, /etc doesn't require any space? https://docs.paloaltonetworks...

smb-upload (Server Message Block (SMB) v2): error

Hi, I want to upload a file from the XSOAR to a server, for this I want to use the smb-upload automation. Shared map is created, all correct rights are given, credentials in the XSOAR are correct. For now I'm just testing a simple test.txt file to upload I'm always running into the same error: Failed to execute smb-upload command. Error: R...

Resolved! DEV PROD XSOAR Engines

Is it possible for DEV and PROD servers to use the same set of engines? #DEV #PROD #XSOAR #ENGINE

Cortex XSOAR tool integrations methods

Hi, As per below link the integrations can be executed REST API, webhooks, and other techniques. So I'd like to know about what are the other methods available in XSOAR platform. https://xsoar.pan.dev/docs/concepts/concepts#:~:text=Product%20integrations%20(or%20apps)%20are%20mechanisms%20through%20which%20security%20orchestration%20platform...

Discussions

Resolved! CrowdStrike Falcon detection mirroring

Credential management in XSOAR