XSOAR 8 cloud incident retention policy query

Hi Team,

The standard XSOAR customer, wants to know how the incident retention policy works on V8 cloud instance.

Data retention policy:
1. Is the default retention period is 6 months (180 days)? 

Yes , the default retention period is 6 months (18

Playbook Showing Keep Running & Running

Dear All,

I am facing really annoying issue. I have setup integration(mapper,type) and playbook hit very well on incident but the problem is the playbook showing running and running for all incidents and not run. I try to pause and resume but it also

Is there a way to check all scheduled entries in XSOAR?

Is there a way to check all scheduled entries regardless of the incident you're in? I've been using ShowScheduledEntries in the playground to test an automation (let's call it X), but after a week, when using the ShowScheduledEntries command it retur

CSV Feed Same Indicators

Hi,

I am using CSV Feed integration and a delta triggered Job, that is triggering whenever there is a new item (IP indicator) in CSV feed. The playbook under job is adding only new and modified indicators which have "tag":"pending_ip".

Now, I underst

Engine in cloud - design concept

I have a cloud instance of XSOAR, with set of technologies in cloud and on prem as well, my initial thought is to have an engine for each group, that means two engines, and separate the technologies accordingly, any thought on that and what is challe

How to Delete War Room Entries or Clear War Room

Hello LiveComm,

is there a way to remove an entry from an XSOAR incident ? This is needed for general entries and not just files as files can be deleted with Core API. An example of this can be a comment by an analyst or any textual entry. Perhaps th

Service Limit Information for On-Premises Deployment Cortex XSOAR

Hi everyone,

I have been searching for documentation related to the system’s performance limits, but most of the available information seems to focus on cloud deployments. I am specifically looking for service limit details for an on-premises deploym

ElasticSearch integration es-eql

Can someone, anyone, post a properly formatted (working) !es-eql-query command run in XSOAR.  I am apparently too dumb to get it working.  For context, here's the ES|QL query I'm trying to make work.

FROM logs-* | WHERE winlog.event_data.LogonProcessN

Increasing docker image pull timeout

Hey everyone,

I am looking for a way to increase the docker image pull timeout from its 5 minutes default.

The error occurs due to a combination of very slow network connection (a traffic shaping option which I cannot change) and big images (e.g. dem

How do I find the *meaning* of fields listed for APIs?

I see the API documentation (e.g., https://cortex-panw.stoplight.io/docs/cortex-xsoar-8/qqt4382rrk8vo-create-an-incident-from-json), but it seems that in many cases the actual meaning and usage are not defined for some of the input fields.  Because o

Layout Section in Email

How to include sections from a layout in email body which is send by send-mail command? For example, Indicators section? Cortex XSOAR 

Urgent !! Cortex XSOAR User Licence Support

Would you please assists on picking a user for cortex xsoar, we have been bought a 1 year license for cortex xsoar starter (1 in quantity with support 2 users) and full user (4 in quantity) which is total of 6 users. However, currently we are plannin

Reminder Follow-Up Mail Playbook

I need to create a simple JOB in Demisto that does the following:

Sends an email to the user - with the text "Reminder to perform action XXX"
Give the user half an hour to reply by email (the user can reply with any text they want),
Wait half an hour
If

Help with retrieving list of XSOAR items

Hi all, 

I am looking to build an inventory list of everything we have within XSOAR, such as:
All playbooks, dashboards, integrations regardless of whether or not we use them.

Extra points if we also know the author of each item, and / or the last per