Cortex XSOAR Discussions

Resolved! Do content pack updates require downtime

I need to update my QRadar Content Pack which also requires X dependencies be upgraded.

What is best practice for content package upgrades?
Is it as simple as installing from marketplace or do we have to run a sync after or cycle demisto after?

Other th

...

Resolved! Blueliv integration error

Hi!

we are testing XSOAR capacities. For testing purposes, we are creating an integration with our intel solution, Blueliv:

https://xsoar.pan.dev/docs/reference/integrations/blueliv-threat-compass

When fetching it returns an error. From the mapping ed

...

Resolved! Do I have to set Server Configurations per tenant?

Example:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-5/cortex-xsoar-admin/docker/docker-hardening-guide/run-docker-with-non-root-internal-users#idb5fe7d70-f021-4270-a328-7439d5574723

I set this on the main account and sync'd all accounts.

H

...

XSOAR community Edition System Requirement

Hi,

I'm trying to install XSOAR in my personal machine to practice a bit and experiment, Anyone has recommended system requirements for this?

Including space.

Thanks in Advanced

Resolved! error 'Missing required field: 'owner' when uploading / creating incident via json

Trying to export a ticket from PROD into DEV.

To test I exported a ticket in DEV as a json using this in the playground.

!azure-sentinel-get-incident-by-id incident_id="c5dc30e5-6981-4cb0-9895-66967fc3f2e9" raw-response="true"
(saved as json)

Then n DEV

...

Application Unreachable

Hello,

I am having issues working with the Automation Menu. When opening the menu I receive the error "Application Unreachable".

It appears a few times yet I am still able to access the automation that I need. What is the reason why I am receiving this

...

XSOAR RSS integration not fetching updated feed content

We have configured the RSS integration in the community supported RSS content pack (https://xsoar.pan.dev/marketplace/details/RSS) to ingest CISA NCAS alerts as incidents for our threat intel teams to investigate. This is using the public feed at ht

...

Integration with Nexthink

The connection has been tested sucessfully but error during executing commands

QRadar Integration Magnitude Query not returning expected results

Got a QRadar integration.
It's suppose to pull back offenses with magnitude > 4

However, our metrics are much higher than what the client expects.

When reviewing this case got pulled into XSOAR:

However, when exporting QRadar, the incident has the foll

...

Alerts are not fetched within time from QRadar

Hello Everyone,

Yesterday, I have observed delayed in offenses which comes from QRadar into XSOAR. I am confused with this type of behavior from XSOAR.

Offense which is triggered in QRadar : 29-03-2022 23:00PM

Same offense/Alerts is created in XSOAR :

...

Resolved! Incidents Mass / Multiple "Close" button, field trigger script

Workflow:
From the Incidents page / table, select multiple incidents.

Click the "Close" button that allows closing multiple incidents at one time.
My close form comes up. I have a field trigger script on one of the fields.

It doesn't look like that fiel

...

Resolved! ScriptA not calling ScriptB as expected

I have some automation that I'm working on and I am not seeing the expected results. I broke the script down into the following simple version.

ScriptA which is:

demisto.executeCommand("ScriptB", {})

ScriptB which is:
return_results("ScriptB Called")

wh

...

Splunk custom index not getting incident in xsoar

I am using splunk 60 day free trial non-enterprise edition and created a new custom index in splunk and manually added a sample event csv format file in the new index and all date is 2 days ago sample data

splunk integration with xsoar does not genera

...

Screen Shot 2022-03-11 at 1.33.40 PM.png

Screen Shot 2022-03-11 at 1.34.28 PM.png

XSOAR test/free license - Paloalto ignoring a request from customer

I have tried to request test/free license of XSOAR using web form - (https://start.paloaltonetworks.com/sign-up-for-community-edition.html). Completely ignored. Then I asked for support - they pointed out to local rep. Local rep can do nothing, they

...

error Couldn't calc cores number [error 'open /proc/stat: too many open files']

Recently had some performance problems reported from my xsoar users.

Found a tenant crashing. Upon investigating I found the following error in the logs:

App03 host:

error Couldn't calc cores number [error 'open /proc/stat: too many open files']error C

...

Discussions

Resolved! Do content pack updates require downtime

Resolved! Blueliv integration error

Resolved! Do I have to set Server Configurations per tenant?

XSOAR community Edition System Requirement

Resolved! error 'Missing required field: 'owner' when uploading / creating incident via json

Application Unreachable

XSOAR RSS integration not fetching updated feed content

Integration with Nexthink

QRadar Integration Magnitude Query not returning expected results

Alerts are not fetched within time from QRadar

Resolved! Incidents Mass / Multiple "Close" button, field trigger script

Resolved! ScriptA not calling ScriptB as expected

Splunk custom index not getting incident in xsoar

XSOAR test/free license - Paloalto ignoring a request from customer

error Couldn't calc cores number [error 'open /proc/stat: too many open files']

Do we have XQL query builder feature in XSOAR

Where is the XSAOR 8 CLI Reference?

Pre Processing Rules Logs

XSOAR CMDB - SQL issue

Cortex XSOAR - Best Practice Optimize Threat Intelligence Management (TIM)

XSOAR IP Forwarding requirement

Unlock your full community experience!

Resolved! Do content pack updates require downtime

Resolved! Blueliv integration error

Resolved! Do I have to set Server Configurations per tenant?

Resolved! error 'Missing required field: 'owner' when uploading / creating incident via json

Resolved! Incidents Mass / Multiple "Close" button, field trigger script

Resolved! ScriptA not calling ScriptB as expected