Cortex XSOAR Discussions

Query on the usage of 2 XSOAR's integrations

Hi Team,

The customer wants to implement 2 integrations, so they are requesting the TAC support on the usage of 2 integrations.

Note: No CS team available.

Below are those 2 integrations.

1. NCIIPC Threat Intel Feeds via normal API key.
2. HPSM (

...

Pre Processing script for dropping multiple similar incidents

Hi Team,

I need to find a way to drop similar events (by eventnames field) from QRadar when they are mirrored in in XSOAR by using a pre process rule

I have checked for a native approach in Cortex Xsoar to do it but it seems that
Pre-processin

...

Automated Daily Report for XDR and XSOAR?

Hi all and happy Taco Tuesday!

I'm part of a very small team of 3 that supports a retail company's domestic and international security & compliance operations, and I'm looking to automate some daily reporting that would ultimately be viewed in Conflue

...

Propagation Label

Hi all,
I imported a custom pack to XSOAR main account, but I don't want some tenants to use it so I want to use XSOAR propagation labels, but even if I set propagation labels, when I sync it distributes to tenants.
Do you have any suggestion?

Integration not able to invoke fetch-incidents command at given interval

I am trying to create a custom integration and have read that xsoar will invoke fetch-incident command at the given incidentfetchinterval timeframe on its own. But when i run the integration to fetch incidents i dont see it adhering to the given inte

...

Microsoft Teams Ask - Getting Unable to Reach App on Teams Side.

Hello LC,

I have recently developed some advanced workflows with team integration. I use the MicrosoftTeamsAsk to send a message to a user, and when the user clicks on one of the buttons within Teams, they receive an error message, "Unable to reach a

...

Running Playbooks on the Engine

Can I configure XSOAR Engine used to run playbooks, instead of the XSOAR instance itself, and if yes what is the configuration steps, sizing, ..etc

Cortex XSOAR

sending subset of devices to Cisco ISE

Hi there, looking to see if we can send limited number (subset) of devices from Palo IOT XSOAR integration to Cisco ISE instead of the full set.

ref > https://docs.paloaltonetworks.com/iot/integration/network-access-control/integrate-iot-security-w

...

XSOAR File Management issue

Anyone using XSOAR File Management.?

I am getting below error when trying to run any command

Failed to execute test-module command. Error: Failed to parse json object from response: b'<!doctype html>\n<html lang="en">\n<head>\n <meta charset="ut

...

XSOAR Community Edition is not available?

What I hate about Palo Alto to not give any option for learning and home labs, and all their education programs are waste of money. XSOAR community was great and this is how people build lots of playbooks and integration on XSOAR free for Palo Alto..

...

Is there a way to obtain Cortex XSOAR community edition

Hello All,

I wanted to obtain a copy of Cortex XSOAR community edition for my practice lab as I need to test and deploy playbooks at my work.
After going through different discussions here I could not find a working method to obtain a copy of Cortex X

...

Editing custom content via XSOAR UI and local PC

Hello,
in our team we have two groups of engineers - one are developers, who mostly edit code locally via VSCode with combination of demisto-sdk. Second group is creating playbooks, managing integrations, mappers and so on via XSOAR UI.
We are at the b

...

Restrict visibility of specific incident types based on user roles

Hello Everyone,

We're currently focused on improving our access control model to limit the visibility of certain incident types based on user roles. Currently, this is done manually through the system command:

```
/set_incident role = <role name>
```

T

...

Extracting fields from Context/JSON in Playbook

Hello,

I want to use the "GetFailedTasks" built-in automation to take some actions on the failed tasks and playbooks. The challenge i'm facing is parsing off fields from the output of the "GetFailedTasks" in playbook, namely "Task ID" and "Task Name"

...

Not able to export custom field in the report

Hello team,

I attempted to export the values of custom SLA fields into a CSV report. When I tried to create the report through the UI, it displayed the timer values, but when I actually generated the report, it only showed the run status (running or

...

Discussions

Query on the usage of 2 XSOAR's integrations

Pre Processing script for dropping multiple similar incidents

Automated Daily Report for XDR and XSOAR?

Propagation Label

Integration not able to invoke fetch-incidents command at given interval

Microsoft Teams Ask - Getting Unable to Reach App on Teams Side.

Running Playbooks on the Engine

sending subset of devices to Cisco ISE

XSOAR File Management issue

XSOAR Community Edition is not available?

Is there a way to obtain Cortex XSOAR community edition

Editing custom content via XSOAR UI and local PC

Restrict visibility of specific incident types based on user roles

Extracting fields from Context/JSON in Playbook

Not able to export custom field in the report

XSOAR Dev to Prod - Builtin content repository

Still waiting on XSOAR Community Edition + Cortex XDR lab access

Result empty after using json2html script

Do we have XQL query builder feature in XSOAR

Where is the XSAOR 8 CLI Reference?

Re: Creating a custom command for XSOAR marketplace integration

Re: XSOAR Dev to Prod - Builtin content repository

Re: War Room Table to Layout view

Re: delay in a playbook

Unlock your full community experience!