About gfilippov

Hi, Please submit a support case so we can further investigate it, as an alternative I would recommend you the "Integrations & Incidents Health Check" pack, to take a look at, thanks. ... View more

Hi, Actually there is: extend-context=TheWholeAnswer= putting nothing after the "=" will take the whole response, thanks. ... View more

Hi, What integration are we talking about? can you provide more context about what you are trying to do? thanks. ... View more

Hi, The Mapping part comes after the incident creation was executed, Please read the following article and and its link to Classification & Mapping: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/5-5/cortex-xsoar-admin/incidents/incident-lifecycle thanks. ... View more

Hi, Please make sure the time range of the search is set correctly (and not just for the last week), If it doesn't solve the issue please submit a support case, I would recommend you to use the "System Diagnostics and Health Check" pack which can also give you those incidents, and much more, thanks. ... View more

Hi, Please review our documentation of the integration: https://xsoar.pan.dev/docs/reference/integrations/microsoft-365-defender And if that won't be enough our support team may assist you over a support case, thanks,  ... View more

Hi, Please review the following articles: https://docs.paloaltonetworks.com/search.html#q=PAN-OS%20EDL&sort=relevancy&layout=card&numberOfResults=25&f:@panproductcategory=[Cortex%20XSOAR] thanks. ... View more

Hi, I see that the integration is following the vendor's API codumentation: https://docs.tenable.com/tenablesc/api/Scan.htm please submit a support case and we will clarify it with the vendor if required, thanks. ... View more

Hi, Please submit a support case, I think that the issue may be only in the pre-proc rules test functionality, and the rule will work as expected with real incidents, please try to test with existing incidents as well, thanks. ... View more

Hi, By design the classification is done by a single field, please submit a feature request for it. As a workaround you can create a new transformer script that gets the whole incoming incident json as an input and takes into consideration any fields you want, then returns the desired incident type based on the script logic, that will be mapped to the right incident type in the classification wizard, thanks. ... View more

Hi, By default if you query for something that wasn't found- it won't be written to the context, it is like this in pretty much all the integrations, the Cherwell result should include the host name which you can use to verify if you got anything back regarding that host, for example if you have an input of 10 hosts, but only some returned data from Cherwell; you can have a task\playbook that will loop the input host names one by one, and will check if it exists in the Cherwell response, if so it will write the data to the other DB, if not it will continue to the next one, thanks. ... View more

Hi, Currently it is only possible to permanently delete files that were uploaded manually by you in the war-room, please submit a feature request for it. As a workaround you can use the RemoteAccess (SSH) integration to connect to the XSOAR server's OS and have a job that will retrieve the file details from the server, and remove files older than X days, it is possible but it may require some scripting, thanks. ... View more

Hi, Please submit a support case with the logs attached, thanks. ... View more

Hi, Please submit a support case with the logs attached, thanks. ... View more