About JoshBoyd

Support is turning me away because the question is regarding a custom integration; they suggested I post a question here. My issue is, i don't want to support troubelshoot the why the script is timing out, i just want to set the property to let it run for more than 300 seconds.  Note if i re-run the script it works, it only fails sporadically. Error: server-2024-03-04T00-02-25.964.log:2024-03-03 16:37:27.8866 info Cyber Enrichment API v2_XXX_XXXX_XXXX Enrichment API v2_cyber-enrichment-api-get-enrichment: Timeout (300000000000) reached, killing (source: /builds/GOPATH/src/gitlab.xdr.pan.local/xdr/xsoar/server/services/automation/container.go:686) The custom integration name is: Cyber Enrichment API v2 Each account has their own instance enabled with a naming convention of: Cyber Enrichment API v2_client_001 Because its an integration script, I cant go into the script like i can in automation under docker settigns and set the timeout value there. I was told i could add a server property to Main and sync; bumping from 300 seconds to 600 seconds: cyber enrichment api v2.cyber-enrichment-api-get-enrichment.timeout = 600   This property isn't working; i think its because the naming convention, but because its on a custom script support is turning me away. Do i have to set the property on each individual account leveraging the name: Cyber Enrichment API v2_client_001 Just looking for some help on how to increase the timeout value - Thanks! ... View more

If I have a tenant/account that has incidents. some of those incidents have indicators / entities tied to abc.com or xyz.com Is there a way to query for, show me all the incidents that have hostnames or account names that end in abc.com? Wasn't having luck in xsoar, so i switched over to kibana and our elastic database, but I don't see any of my indicators stored in elastic; are indicators not stored in elastic DB? Thanks in advance ... View more

Our client leverages QRadar as their SIEM. will pull in all cases and then have a pre-processing rule that drops any case that does not have "MSSP" in the name. This works 99% of the time, but there are certain times when MSSP cases get dropped and we don't we don't know why yet. Is there a way to "re-pull" Qradar cases from QRadar if the integration has already recognized them and dropped them. I basically want a command to call QRadar integration again for a specific offense and have it create an XSOAR case. Any thoughts or suggestions are appreciated -  ... View more

Receiving more business from a customer for some of their other entities.   I need to rename an XSOAR tenant to be more pointed -    Is there any instructions on renaming. Can i just stop the tenant and rename the folder on the backend; assume there's more to it than that -  ... View more