Questions regarding the operation of Cortex Xsoar

[assubramania]

Hi Team,

I have some questions regarding the operation of Cortex Xsoar and need assistance

1. I bought a license for 5 users. Does that mean you can only create 5 users or only 5 users can be active at the same time? 

2. How to classify incident ingress from ibm qradar

3. Can I use 2 nested DT query sessions? ${subplaybook-${CurrentPlayBookID}.MaxMind.Geo.Continent}

I have created more local users than licensed users. So Cortex xsoar's behavior for users exceeding 5 If I integrate with AD to authenticate users, if more than 5 users log in at the same time, what will be the behavior of cortex xsoar for users exceeding 5?

Thanks

[cmcneil]

1. 5 user accounts in XSOAR

2. Check out video 3 of the XSOAR Engineer Training on YouTube. https://youtu.be/TW-q2wmchZk?si=VyXu5vuOSuk4NCE5

3. I don't believe this is possible, but test with a test incident and see what errors or output it throws at you