This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

Handling errors in a playbook

I'm looking to change the flow of my playbook not only if errors are encountered in my tasks, but dependant also on what those errors are. I found a tutorial on docs.paloaltonetworks.com that included this: Step 3: For new tasks, in the Task Name field, type a meaningful name for the task that corresponds to the data you are collecting. Step 4...

Dbot Score for Virustotal IP check is always 1

Hey Guys, I'm facing this issue that doesn't matter how malicious the IP is Dbotscore is being 1 for the VT IP automation, Things I tried, 1. Setting a threshold in VT integration for 1. 2 . Setting the reliability to A+ 2. Running the command !ip ip="54.37.136.187" long="false" threshold="1" sampleSize="10" wait="60" retries="0" fullResp...

Resolved! SetGridField Issue

I'm testing the inbuilt playbook "Integrations and Incidents Health Check" , however it throws an error on the block which contains SetGridField, which is the error shown below. I have few questions regarding the automation and troubleshooting,1) What is grid field mentioned in troubleshooting? is it the same as the grid_id?2) Is grid_Id is ju...

vidurasupun_0-1655096548235.png

Resolved! A question from the Phishing V3 webinar: Investigation

It does within an isolated container. We use XSOAR to investigate all kinds of malicious content and it is designed for it - Can we get more information on this? Is it the hardening of Docker ? or others? Note: This question was asked during our Customer Success Webinar: Phishing V3

rtsedaka by • L6 Presenter
  • 2724 Views
  • 1 replies
  • 0 Likes

Error (July 1, 2022 2:50 PM) Script failed to run: "docker images demisto/python3:3.9.8.24399" with error "exec: "docker": executable file not found i

I am getting an error like this when i add instance while integration cortex x soarError(July 1, 2022 2:50 PM)Script failed to run: "docker images demist o/python3:3.9.8.24399" with error "exec: "docker": executable file not found in $PATH" and output "" (2617) (2603)

Sending only one email for an Ask Task

Hello, I am attempting to configure an Ask Task to send one email only with no retries and an end by SLA condition. I have implemented the settings to no retries (default) and to end the task upon SLA Breach 6 hours. Once saving the playbook I see that the SLA Breach setting is returned to original state without being marked. This is a relative...

Resolved! Unable to retrieve output value while using extended context

Hello team, I'm trying to use the extended context feature to keep only the data I'm interrested in and put them where I need them to be. The automation I'm using is infoblox-get-ip from Infoblox integration. Here is the output of the automation: I'm setting the following string in the Extended Context field (splitted on multiple lines for bette...

screen1.png
screen3.PNG
aborgo2 by • L1 Bithead
  • 2648 Views
  • 1 replies
  • 0 Likes

Resolved! How to prevent IOCs and Incident Cases from being created when running playbooks

Hi, I was making 2 playbooks.In the first playbook, after creating the same I scheduled it as a job. Each time the job runs, it creates a incident case. How do I prevent the incident case from being created when the job runs? In the second playbook, I was creating playbook which pulls MISP feeds which I want to send to another solution. Since it...

  • 1310 Posts
  • 46 Subscriptions
Top Solution Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks