About mbordach10

Can ansible used for deployment of SOAR ?   **Note: this is a question from our CS Webinar: Dev to Prod Configuration and Best Practices in Cortex XSOAR ... View more

Will Export Custom Content export a change to a system field (Like setting "Owner" to mandatory? This has not been my experience. **Note: this is a question from our CS Webinar: Dev to Prod Configuration and Best Practices in Cortex XSOAR ... View more

Download Content Packs and Docker Images Offline As some of are customers are air-gapped due to security and regulations concerns, and due to the Marketplace nature of Cortex XSOAR, we recently released a flow that enables you to download only the relevant Packs and Docker images to your organization. This way you will save time and complexity by getting only the updates you need. Read more about this pack on the XSOAR Marketplace: Download Content Packs and Docker Images Offline | Cortex XSOAR ... View more

Check out our revamped XSOAR Best Practices Guide and learn about recommended configurations, integration and playbook monitoring, indicator exclusions, and performance optimization.   Have a question? Post it on the Discussion Forum  Cortex XSOAR  ... View more

Cortex team released a unified integration Generic Export Indicators Service. This integration is meant to be the only integration used for the Indicators Sync use case, and should replace the existing 'PAN-OS EDL Service' and 'Export Indicators' integrations.   This integration has it all: Existing functionalities from both older integrations, new features (such as selecting the exported columns) and major performance enhancements.  Full integration documentation can be found here: Generic Export Indicators Service | Cortex XSOAR   Cortex XSOAR  ... View more

XSOAR CI/CD Flow We are happy to share that we have released the XSOAR CI/CD flow. The flow allows you to manage custom content in a pack structure outside of XSOAR, in a Git repo to your liking. This way you can develop in a multiple branch approach, resolve conflicts, test and stage your changes and deploy. This flow is mainly aimed for advanced customers, which are familiar with CI/CD concepts. Read more at: https://xsoar.pan.dev/docs/reference/articles/xsoar-ci-cd ... View more

As part of our Rapid Breach Response program, following the Russia/Ukraine Cyber conflict, Cortex XSOAR released a new content pack: "WhisperGate & CVE-2021-32648'' that can help automatically detect and mitigate the two threats. Read the full threat brief from Unit 42: Threat Brief: Ongoing Russia and Ukraine Cyber Conflict. ... View more

Example Phishing Use Case Definition Template   This document provides a filled out template for implementing the OOTB Phishing Use Case in XSOAR, with the trigger being a reported suspect phishing email to a Security inbox.  A Playbook for this use case can be started with the Phishing Investigation - Generic V2 as an initial template.   You may find the Phishing UCD template HERE. ... View more

Using Cortex XSOAR to Deal With Apache Log4j Vulnerability (CVE-2021-44228)   Critical RCE Vulnerability: log4j - CVE-2021-44228 refers to a 0-day exploit in the popular Java logging library log4j2.   As part of our Rapid Breach Response program Cortex XSOAR released a new playbook to automatically detect and mitigate the remote code execution (RCE) vulnerability in Apache log4j 2 that is being actively exploited in the wild.    Read more about the exploit in our Unit42 blog post.    Find a link to the new pack on the XSOAR Marketplace website.   For more information subscribe and follow Palo Alto Networks security advisory. Disclaimer: This threat is rapidly evolving by the hour. Unit 42 researchers are updating the Unit 42 blog in real time, and therefore the blog serves as our single source of truth. The information provided is for general informational purposes only.  ... View more

Does the Content Type of the list affect how it is read in by an automation or playbook, or is that only for editor syntax highlighting? Previously, would input json into a list, but since it is read in as text, we would have to handle the data with a text to json transformer. Does this still work the same? ... View more

What are the limits for lists, number of lists and size of lists? ... View more