This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

Resolved! XSOAR Qradar Integration Set Range Limit

Hi,I succeeded XSOAR integration with Qradar. But I keep getting timeout warnings. I solved this problem by entering parameter "--env=REQUEST_TIME OUT=1500". But I caught that the real problem is in the query. To give an example of this, I enter the first integration query as "status='OPEN' and id > 13061". Then XSOAR automatically changes th...

Using IsRFC1918Address check on context in condition task

Hi, I'm trying to use the condition to check if incident.destinationip is an public IP. But when selecting from context incident.destinationip and then IsRFC1918Address you need to fill in something in the right side. I checked the automation script and that should return True or False. But When testing the condition it always returns not matchi...

KevinThys_1-1646323874844.png

Resolved! Docker running as non-root, but hardening script fails?

Relatively new admin to XSOAR; previous admin has left.Just completed upgrade to latest 6.5 version.Could anyone help me understand the following:I have a service account that seems to run xsoar demisto server containers; used ps-ef|grep demisto and return a number of containers; "demisto" is the user below.demisto 32710 3808 0 10:56 ? ...

jboyd98_0-1646331218200.png
jboyd98 by • L2 Linker
  • 3589 Views
  • 2 replies
  • 0 Likes

[error 'open /proc/stat: too many open files']

Recently had some performance problems reported from my xsoar users.Found a tenant crashing. Upon investigating I found the following error in the logs:App03 host:error Couldn't calc cores number [error 'open /proc/stat: too many open files']error Couldn't calc cores number [error 'open /proc/stat: too many open files'] I set this on APP03 las...

jboyd98_0-1646333459707.png
jboyd98_1-1646333459832.png
jboyd98_2-1646333459708.png
jboyd98 by • L2 Linker
  • 3759 Views
  • 2 replies
  • 0 Likes

Resolved! X out of X accounts returned an error during a multi-account request

Seeing the following every multiple times a minute in my server.log Note i replaced the host with <host> error Some requests to accounts failed for incidents export [error '2 of 18 requests to accounts failed! failing accounts are [acc_Dem01,acc_DemistoTest][HTTPResponse accountURI:https://<host>:443/acc_Dem01/incident/batch/exportTo...

jboyd98 by • L2 Linker
  • 4112 Views
  • 1 replies
  • 0 Likes

Resolved! Field Trigger Script / Broswer Caching Issue?

I have a field trigger script on dbot status changing; essentially updating a custom field to nothing if the an incident is re-opened. if field=="dbotStatus" and old=="Closed" and new=="Active" and incidentType=="Azure Sentinel":demisto.executeCommand("setIncident", {'customFields': {"sentinelclosereason": ""}}) This seems to work as the previou...

jboyd98_0-1646165018375.png
jboyd98_1-1646165158523.png
jboyd98_2-1646165399027.png
jboyd98 by • L2 Linker
  • 2726 Views
  • 1 replies
  • 0 Likes

Error trying to move an account to a different host

We have a MT XSOAR deployment, and I need to move a created account that is on the main host to a different one, when I try to move the account I get the error "Account acc_XXXX could not be moved to HOST because address phoenix.scilabs.mx: missing port in address" Why is this happening?

Captura de pantalla 2022-02-23 123157.jpg

Resolved! Creating Multiple Widgets on Layout to Show Different Images

Hello,I have multiple screenshots from various tasks in the playbook such as Rasterize among others from a Sandbox Integration. I would like to make individual widgets on the Layout that can display these Image Files Separately. 1. Can the images be displayed in different Widgets such as through !setincident... from a playbook level ?2. Can the...

trying to return raw output vs formatted

!py script=`return_results(demisto.executeCommand("azure-sentinel-list-incident-entities", {"incident_id":"xxxxxxx-xxxxxx-xxxxx"}))`The above works and turns in human readable format; however i want to return the raw json. This works:!azure-sentinel-list-incident-entities incident_id=xxxx-xxxx-xxxx raw-response=true However this does not: !py sc...

JoshBoyd by • L2 Linker
  • 3841 Views
  • 3 replies
  • 0 Likes

Resolved! Xsoar Twitter Entegration

Hi Everyone, We try to use twitter api on XSOAR.We created instince and try to test connection and get error: AttributeError: 'Client' object has no attribute 'say_hello' Anyone saw this error? Thanks for helps.

sentinel integration, azure-sentinel-update-incident, not able to set to active

I can close an azure incident in xsoar war-room with the following:!azure-sentinel-update-incident incident_id="xx-xxxxx-xxxxx" status="Closed" classification="Undetermined" However when i try to re-open the incident in azure from war-room with the following i get the subsequent error:!azure-sentinel-update-incident incident_id="xx-xxxxx-xxxxx" ...

jboyd98 by • L2 Linker
  • 3236 Views
  • 2 replies
  • 0 Likes
  • 1308 Posts
  • 46 Subscriptions
Top Solution Authors
View All
Top Liked Posts
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks