Is it possible for DEV and PROD servers to use the same set of engines? #DEV #PROD #XSOAR #ENGINE
Hi, As per below link the integrations can be executed REST API, webhooks, and other techniques. So I'd like to know about what are the other methods available in XSOAR platform. https://xsoar.pan.dev/docs/concepts/concepts#:~:text=Product%20integrations%20(or%20apps)%20are%20mechanisms%20through%20which%20security%20orchestration%20platform...
Hi, In one of the XSOAR documentation its mentioned "For all Linux deployments except RHEL 7.x (for example Ubuntu, CentOS, etc.). Automatically installs Docker, downloads Docker images, enables remote engine upgrade, and allows installation of multiple engines on the same machine. For RHEL 7.x, see Install Docker Distribution for Red Hat on C...
Hi, In a playbook I'm using the automation 'send e-mail (EWSO365)'. In the body of the email I'm adding a list that the playbook has generated as following: Get inputs.BreachData Override input Where No filters applied Transformers JsonToTable (title: BreachData, headers: , is_auto_json_transform: , json_transform_properties: ) I ...
Dears,Kindly need your support to get an answer for the following case:We are A MSSP environment, we have many clients.Our deployment is multi-tenant deployment with multiple hosts and each host has only one tenant on it.Our deployment is using a database and XSOAR App on the same server with no disaster recovery or high availability.One of our ...
An Api call is created in an automation program. The call to the API needs to wait for a value to set to "FINISHED", so a while loop is created waiting for this value. However, I'd like to know the current status of this value setting the value in context. Why is not setting this value on the context? status="" While status != "FINISHED": stat...
Dears, Kindly need your support for the following:• we need to install the below as security controls on our XSOAR server (RHEL8):o McAfee Endpoint security (latest version) for Linux.o Cyber Reason EDR.• kindly provide what is the Antivirus exclusion list of Palo alto XSOAR.• Kindly clarify if there will be any damage, conflict, or issues to ...
Hi, A pre-process rule tests some condition and "link-close" incident into a previous one, and this works great. But i need to close related offense in qradar as well as the xsoar itself, with a sole preprocess rule deployed incident is closed in xsoar but offense in qradar remains open , any suggestion about how to close offense after incident-...
When the integration is used on non-existent hash:!file file=2795b688bb5918e092e0ee33cd25aa98Then it end with error:ReasonFailed to execute file command. Error: Error in API call [404] - NOT FOUND {"message": "Non existing MD5", "query": "2795b688bb5918e092e0ee33cd25aa98"} Usually all other !file just return info that the hash was not found:URLh...
Have followed this kb however under instance, it is still unable to test successfully when unchecking the trust all certification options under the integrated instance. https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-1/cortex-xsoar-admin/docker/configure-python-docker-integrations-to-trust-custom-certificates upon further checking, ...
Hi,I am trying to create playbook where IOCs are extracted and enriched and then values are send as a PDF file via email.I reached the part where the IOCs are parsed and enriched, but I am stuck at creating the PDF file. Is it possible to create a PDF file? I am trying to add the contents as a table. I did try to add html via the context values ...
Hi Team, Can you please help here to integrate Cisco ESA(API V2) with XSOAR . I have tried with the following integration from marketspace "Cisco IronPort Email API (Community Contribution)" which is developed using API v2. But unfortunately It pops' the below mentioned error while testing the connections. Error(Jun 27, 2022 09:49:34 AM)Did ...
Hello everyone, While testing the integration of Splunk to XSOAR with Splunkpy, I'm getting this error:Anyone know how to solve it?Thanks for your support.
Hey guys, I'm working on separating internal and external IP(s) on a playbook and I want to use those values in a email body. So currently I'm using a temporary list to store IP(s) then call when needed in the same playbook with ${lists.templist}. But I have two limitations with this approach, Cannot add more than one IP, as setList fails. ...
Hi, I want users to authenticate in Cortex XSOAR before answering the form sent by mail like explained here https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-5/cortex-xsoar-admin/playbooks/playbook-tasks/communication-tasks/create-a-data-collection-task/create-communication-task-authentication The AD authentication instance seems to work...
reaper
on:
I want to open the use case again
