About michaelsysec242

michaelsysec242 · ‎12-11-2022

Hello, I have an evaluation license and it has been succesfully loaded on the Server. When running any command I receive the following error. DBOT appears to be blocking my commands yet this license was provided for this product and this server as an evaluation. After checking the logs I am getting the error that this is part of the free license flow, and that an investigation has been started. What can I do to resolve this ?

michaelsysec242 · ‎11-30-2022

Hello, I am attempting to use the integration provided by EDR-Integrations by Martin Ohl. When performing the test I receive the error "Error response from daemon: pull access denied for mohlcyber/dxl, repository does not exist or may require 'docker login': denied:". After trying to manually pull this image through the CLI of the XSOAR Server I have seen that the image truly does not exist in the repository. This image is integral in the Integration and has anyone encountered this problem before ? Many thanks. Cortex XSOAR

michaelsysec242 · ‎11-17-2022

It is of my understanding that you can set server configurations on the XSOAR Server and on a single engine to provide the links and responses through the engine that acts as a proxy. In a single server deployment with multiple engines can you manage this dynamically ? Essentially, can you have two engines with this configuration (Bind Address and Port etc) and send communication tasks based on which environment the end user is located with the allocated link of the engine ? Another question on a similar direction is can you define what engine will be responsible for what specific task in playbook. An example of this is a task that uses a specific Integration in the "Advanced tab >> Using....." that you can dynamically choose what engine will be used rather than defining it on the Integrations Menu. Many thanks Cortex XSOAR

michaelsysec242 · ‎10-25-2022

@Josep , Interesting concept and solution ! I thought you intended to use the "Ask" task instead. This way enay emails returned to the server will not affect the status of the currently running task. The ask task will appear as Yellow in colour and will be pending until the recipient answers. Let me know if this helps ?

michaelsysec242 · ‎10-25-2022

michaelsysec242 · ‎10-25-2022

@Josep As far as I know you can't take into account the the Auto-Reply emails. You could use either Data-Collection task or an ask task. These are in-built features that allow you to ask a question with clickable answers such as "Yes" and "No" etc. I don't believe that an email reply will close the task and carry on in the playbook. A data-collection task will require the recipient to enter a secure link that has a basic questionnaire. You decide the question and even one is enough, the task will not continue until a reply is received or a deadline (SLA) is breached. The primary disadvantages of this is that the recipient will need to have a way to communicate with the XSOAR on the network or you could use an engine. In any case let me know if this helps.

michaelsysec242 · ‎10-25-2022

I have had a similar Use-Case before. To make phone calls i would recommend that you use Email to Phone Call providers. such as Emailtovoice or Zapier. Essentially the provider will be in a listening state and the second it receives a specific email it will trigger a phone call. In the playbook use EWS-Send email or any other email integration to send the email to the listener. As far as I know the XSOAR does not have any in-built function or external integration for this. We wanted to send a whatsapp message automatically however the Twilio integration does not provide this capability + Twilio had a major breach recently.

michaelsysec242 · ‎10-25-2022

Thanks for your message. The incidents that do not contain the required "Summary" is not a mapping issue. Even after ingestion the Context Data doesn't contain any event details, just time stamps. As I mentioned before these are the same alerts that most of the time provide a static set of fields that do not change. @jfernandes1 is it recommended to speak with McAfee or PAN CSP regarding this issue ?

michaelsysec242 · ‎10-23-2022

No, creating a new integration helped. It appears that the previous one was not allowing the API requests to be authenticated.

michaelsysec242 · ‎10-23-2022

I have an integration between McAfee ESM (SIEM) that produces Alerts. 95% of alerts are received by the XSOAR including the "Summary" which is essentially the Alert Packet. Every few days some alerts are received that do not contain the summary. So essentially the time-stamp and the Alert Name appears yet there are no Summary details. The context data has been analysed and does not show any details. The Integration has is updated to the latest version. The McAfee ESM is of a recent version. This is a relatively new phenomenon yet no explanation has been found. A new integration has been defined with a new Instance in order to attempt to fix this problem, unfortunately without results. A playbook for Unclassified events has been set to attempt to retrieve the summary for every anomalous alert through the Instance. Which also doesn't work 100% of the time. The XSOAR is community edition. I have two questions; Does anyone have a solution or workaround for this problem ? Is there a way to ensure 100% Alert transfer for this usually static use case ? Thanks in advance. Cortex XSOAR #McafeeESM

michaelsysec242 · ‎09-22-2022

Hello, In the past few days our SentinelOne Integration has stopped working. I am seeing the following error; [Failed to execute test-module command. Error: Error in API call [401] - UNAUTHORIZED {"errors": [{"code": 4010010, "detail": null, "title": "Authentication Failed"}]} (85)] . In regards to the Server URL nothing has changed and all other parameters appear correctly. In regards to resolving this issue I have done the following; Revoking and Generating a new API Key from the SentinelOne Panel, ensured that the Site-Ids are correct and reset the "Last run Timestamp. Nothing appears to have worked. In regards to content pack I am currently on the current 3.0.0 yet I have downgraded in order to see if this is the problem. Apart from this the SentinelOne Tenant has received an update which includes more commands. Can someone help me with this problem ? If anyone else is experiencing the same thing please let me know. #sentinelOne #XSOAR

michaelsysec242 · ‎08-23-2022

Hello all, I have encountered multiple occurrences in which a specific process raise many of the same BIOC Analytics Alert. I understand that engine is based on server side and as a customer we are not privy to see what calculations are done on our behalf. In regards to Exclusion, exclusion can only be carried out for the entire alert. 1) Is there a way to individually exclude certain processes that are causing many of the same BIOC Analytics alerts ? 2) Is it possible to define on the XDR Tenant that you use an additional security product by a different vendor and that no alerts should be raised by their behaviour including BIOC Analytics? In my experience the BIOC Analytics Mechanism is very powerful yet lacks this fundamental flexibility. Cortex XDR

michaelsysec242 · ‎07-04-2022

As I have outlined in the Question, i have set the amount to 0 and have checked the "Complete task as :No" Once saving the playbook the setting is returned to default when reentering the playbook.

michaelsysec242 · ‎07-04-2022

Hello, I am attempting to configure an Ask Task to send one email only with no retries and an end by SLA condition. I have implemented the settings to no retries (default) and to end the task upon SLA Breach 6 hours. Once saving the playbook I see that the SLA Breach setting is returned to original state without being marked. This is a relatively simple function that I require yet XSOAR is not delivering on this feature. Does anyone know why this happens and what is recommended for a single email to be sent ? Cortex XSOAR

michaelsysec242 · ‎06-14-2022

@YAltmann, if that is so then only mail sent by Use of the button on the Email Communication layout will allow this Pre-Process rule/script to work ! In any case the documentation states that as long as the eight digit code is included in the subject the rule will work. Is it possible to run this flow of reply from within the playbook automatically and all future replies will be added to the original mail event ?

Member Since	‎02-13-2022 12:05 AM
Date Last Visited	‎03-18-2024 05:44 AM
Posts	73
Total Likes Received	3

Online Status	Offline
Date Last Visited	‎03-18-2024 05:44 AM

About michaelsysec242

NFR Licence Query

Using RPA from Cortex XSOAR

Hiding Incident Types from Specific Role

Re: Storing Incident Notes in Context Data

Storing Incident Notes in Context Data

Bulk Changing Incident Status from Pending to Active

Re: Reruning playbook and preventing communication tasks from being rerun

Reruning playbook and preventing communication tasks from being rerun

Using "GetFailedTasks" with a relative time range of 7 or 30 days lookback

Using Dev/Prod Configuration as a test environment for noisy integrations

Re: Recurrent data input problems in tasks

Re: Phone call from XSOAR

Re: SetGridField Issue

Re: Polling XDR Integration for Alerts that are not Incident Based

Re: Using Await for an email only for expected answers

Re: Differentiating mail from multi-tenant XDR

Re: Cortex XSOAR - Community Edition Support

McAfee Mvision Integration Missing Image

Defining Multiple Engines for Communication Tasks

Re: Using Await for an email only for expected answers

Re: Using Await for an email only for expected answers

Re: Using Await for an email only for expected answers

Re: Phone call from XSOAR

Re: McAfee Integration not sending Summary of alerts to XSOAR for ingestion.

Re: Xsoar - XDR Public API Unauthorised

McAfee Integration not sending Summary of alerts to XSOAR for ingestion.

Problems with SentinelOne V2 Integration - 401

BIOC Analytics Specific Exceptions and Vendor Exceptions

Re: Sending only one email for an Ask Task

Sending only one email for an Ask Task

Re: Email Pre-Process not dropping email replies

Unlock your full community experience!

About michaelsysec242