This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

Resolved! Upload IOC from file to firewall via XSOAR

Hi, I want to find a way of maximum automatization of the next process: IOC are extracted from CSV file to Cortex XSOAR and than only this indicators are uploaded to firewalls. I found automations for each step separately but maybe exist any playbook or integration with such functionality? And another less important question is how to co...

asernova by • L0 Member
  • 2667 Views
  • 1 replies
  • 0 Likes

Fail to connect to Marketplace

Hello, Having installed XSOAR v6.8 in RH7.6, also configured Docker too. Proxy and internal DNS is required in our environment. Configured the Proxy on both WebUI and Docker as well. We could login to GUI, but we cannot reach the marketplace. Found out there are many DNS queries from the XSOAR to the root DNS server in our firewall log. Any id...

Resolved! CrowdStrike Falcon detection mirroring

Hi there, I hope to find some help here.We are facing issues to make the CrowdStrike Falcon mirroring options work. @We are following the instruction provided in the documentation https://xsoar.pan.dev/docs/reference/integrations/crowdstrike-falcon Here is how our integration is set:1. Set a classifier (the system classifier "CrowdStrike Falcon ...

Isabelle by • L0 Member
  • 5598 Views
  • 2 replies
  • 0 Likes

Resolved! XSOAR Engine Backup/Restore

Background:In our XSOAR platform setup, the XSOAR server is cloud hosted by Palo Alto and the XSOAR engines are deployed at 2 different data centers (on-prem). Each of these datacenters will have a single Cortex XSOAR engine server installed, which will include, a. Production Engine b. Development Engine. Both the XSOAR engines from different d...

gnakhede by • L1 Bithead
  • 3483 Views
  • 2 replies
  • 0 Likes

Are XSOAR incident type updated?

Hello, When an incident comes to XSOAR the classifier set the incident type. I would like to know if the incident is updated with new alerts (for ex. in Cortex XDR), will the incident type in XSOAR be updated if needed or is the type set and never change (like the incident name)? When an incident is updated does the entire process runs again (cl...

lulu42 by • L0 Member
  • 1875 Views
  • 1 replies
  • 0 Likes

Resolved! RHEL Installer Type and Podman Installation Steps

1. What RHEL installer type (minimal or full fledge GUI) should be considered for XSOAR engine server? 2. Is there any documentation by Palo Alto on Podman proxy configuration for XSOAR Engine installation and any specific URLs required to be whitelisted for Podman like Docker? The following URL has information on Docker but not related to ...

gnakhede by • L1 Bithead
  • 3882 Views
  • 3 replies
  • 0 Likes

Setting up classification & mapping for email ingest

Hi, Here are two different emails subject: 1. Test email - Phishing Email 2. Test email - Ping Two playbooks: 1. Phishing Email 2. Ping Currently I have setup two instances of integration "Mail Listener v2" with corresponding incident types so that phishing email will go to playbook - phishing email and ping email will go to playbook - pi...

ce13 by • L1 Bithead
  • 2438 Views
  • 1 replies
  • 0 Likes

Rasterize PDF format queries

Hi, I created a PDF report using rasterize with HTML body content. The XSOAR variables I put contains URLs and Email addresses. My first challenge i faced was the variables when replaced with the acutal values (URLs and emails), they are clickable. I want to prevent this as this is a phishing analysis report and I do not want the viewer to acc...

XSOAR Engine Storage Requirements

Hi, As per the below link its mentioned minimum storage requirement for XSOAR engine is 100 GB. And for drive partition it is recommended to allocate 50 GB for /var and 50 GB for /home is XSOAR engine is getting installed on RHEL 8.x. In this case other partitions like /tmp, /usr, /etc doesn't require any space? https://docs.paloaltonetworks...

DP696 by • L2 Linker
  • 2454 Views
  • 1 replies
  • 0 Likes

smb-upload (Server Message Block (SMB) v2): error

Hi, I want to upload a file from the XSOAR to a server, for this I want to use the smb-upload automation. Shared map is created, all correct rights are given, credentials in the XSOAR are correct. For now I'm just testing a simple test.txt file to upload I'm always running into the same error: Failed to execute smb-upload command. Error: R...

SteveB by • L0 Member
  • 3158 Views
  • 1 replies
  • 0 Likes
  • 1310 Posts
  • 46 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks