This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.
About Cortex XSOAR Discussions
Cortex XSOAR enables SOC analysts to manage alerts across all sources, standardize processes with playbooks, take action on threat intel, and automate response for any security use case.

Discussions

Start a conversation

Resolved! How to work on File Content collected from Azure blob in Playbook

I am working on Playbook, where I need to update the content of Azure storage blob. I have used the integration with Azure storage container, and I am able to get the file, but I am getting the file metadata only on PB context, and I see that the file itself added to the incident. However, no direct access to the file content to edit/add/remov...

XSOAR - Question Regarding Incident Tasks

Hello everyone, I noticed that when a task in a playbook has an error or requires some sort of input, said task appears in the tab "Playbook Tasks" (attached an image for reference). I was wondering how XSOAR gets that specific information in that tab, I tried checking in the context data but haven't found anything that might relate to that tab ...

buttons to allow specific continuation of workplan

Hi everyone,I need your help. When a task reaches certain thresholds, Cortex XSOAR sends an email to the analyst. My goal is to have the analyst review all the evidence and then the anayst click a button to either approve or deny the continuation of the workplan. this's possible due on workplan?

tlmarques by • L4 Transporter
  • 1065 Views
  • 2 replies
  • 0 Likes

Resolved! Powershell Modules in Xsoar Cloud

Hi, I am trying to integrate with our Microsoft Defender instance from Xsoar Cloud. Right now I am trying to create a playbook task to add an item to the Tenant Allow Block List (TABL). Looks like the only way is via Powershell. I have a script that will work, but the default engine doesn't have the module needed, ExchangeOnlineManagement. Is th...

Error Handling In Playbooks/Integrations

Hi All, I want to know is there any built in configuration/settings/playbook or any module that helps to handle playbook error(error handling). Error/On Continue Task level error handling is not enough so i want if there is any integration issue or command issue or playbook issue i send email or notify the specific users.Thank you Cortex XSOAR...

Syedhkt by • L2 Linker
  • 1186 Views
  • 1 replies
  • 0 Likes

8.9 On-prem Install Documentation Confusion

Hello, I'm trying to install our extra-small single server on-prem 8.9 XSOAR and ran into some confusion with the documentation. I didn't see a way to report the issue elsewhere so I thought it might be helpful here.https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8.9/Cortex-XSOAR-On-prem-Documentation/Install-Cortex-XSOAR-on-a-VM-deploye...

sackett by • L1 Bithead
  • 875 Views
  • 1 replies
  • 0 Likes

XSOAR - Transform Language

Hello everyone, I would like to ask how to get the user.name value from this context data.I tried using the syntax ${incident.labels.user.name}, but it didn’t work. Here's the context structure: { incident: { ... labels: { user.name: "john doe", ... } ... } } Any suggestions?

G.Anshar by • L1 Bithead
  • 1426 Views
  • 2 replies
  • 0 Likes

Changing Multiple Docker Images at once

Hey, We are offline users We updated from 6.12 -> 6.14, Then after the update, the docker images changed, and it's causing a lot of ": Script failed to run: failed to pull docker Image "demisto/python 3:3.11.10.113941" Now, to fix it I need to change one by one (detach, change, reattach) docker image, I want to know if it possible to change...

NivNet by • L1 Bithead
  • 1019 Views
  • 2 replies
  • 0 Likes

Download from War Room

Is there a script or command line call that can be used to download an entry from the War Room? I have a script assigned to a button that generates a report and the report download is then entered into a War Room entry when executed/generated. I am looking for a method to code the download of the report automatically and not have to go to th...

BPalmer_0-1746569185023.png
B.Palmer by • L0 Member
  • 886 Views
  • 1 replies
  • 0 Likes

DR to DC failover completed; DR acts as back up server as expected but in DR "Make this the production server option is not grey out"

Hi Team, The customer has did the DR to DC failover but DR backup server has " Make this the production server" tab enabled blue. The client pointing that the option show be disabled. If it is enabled, any person can make backup server as production if the link is active, without making any changes at DC XSOAR GUI. This is critical. Any suggesti...

  • 1308 Posts
  • 46 Subscriptions
Top Solution Authors
View All
Top Liked Posts
View All
Top Liked Authors
View All
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks