About atullo

@SGupta While XSOAR could be used to create the report, I recommend using something like Netflow to gather this data. ... View more

Please check if there are any results for these searches in XSOAR's Threat Intel tab: value:"43.128.225.120" value:"43.128.225.120" and tags:BlockPA value:"185.224.128.30" value:"185.224.128.30" and tags:BlockPA ... View more

Pavendhan_K Have you been using the NFR license for more than 30 days? Start Your 30-Day Free Trial of Cortex XSOAR ...    ... View more

We may be confusing "accounts" with "access", where, in this context, "access" means "network connectivity".    These users would still require an account which aligns with XSOAR's licensing model (licenses are purchased based on the number of users).   If this answers the question I'd appreciate if it were marked as an accepted answer.   From the guide: "You can use engines to enable users who do not have access to the Cortex XSOAR server ..."   Thanks, Adrian ... View more

Roger, Thanks for providing that simplified syslog output in your original post. Could you provide an actual syslog message? Please redact anything sensitive of course.   Thanks ... View more

You'll need to restart the XSOAR engine service on your engine (not the demisto service on your app server; my apologies, I did not word my previous questions correctly).   For engines running a Debian based distro the command would be   sudo service d1 restart   More info for starting & restarting the XSOAR engine service can be found here: Install a Cortex XSOAR Engine.     ... View more

Roger,   Are you able to restart demisto like you have in the past? How are you verifying that demisto is running? Could you share the commands you're using and their output (please redact anything sensitive)?   Thanks ... View more

Happy to help and thanks for marking as a solution. ... View more

The XSOAR team is currently working on a fix for this issue. ... View more

Sanaya,  To learn more about XSOAR's API endpoints, you can download the Cortex XSOAR API Guide right from XSOAR itself: Settings > Integrations > API Keys > Download Cortex XSOAR API Guide (also see the screenshot below).   An alternative method for determining the API endpoint and POST body syntax would be to make the desired request in a browser and use its 'Developer Tools' to view the request (see screenshot below for an example)   Please let me know if this answers your question.            ... View more

just an update: I reopened our internal issue for this ... View more

Apologies, I don't think you have access to those links I referenced.   I'll check if it makes sense to reopen this issue. ... View more

Looks like this was brought up here: https://github.com/demisto/etc/issues/23229 and purportedly resolved here: https://github.com/demisto/content/pull/5849   If PR 5849 hasn't resolved bug ID #23229 it may be worth re-opoening the GitHub issue.   ... View more