About GShriki

Hi,   Any standard SAML IdP is supported. We do not have specific document for gsuite, but you can see the Okta example: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-0/cortex-xsoar-admin/users-and-roles/authenticate-users-with-saml-20 There are also guides from google on how to use gsuite as SAML IdP...   Gilad ... View more

Hi,   Best would be to use an external authentication mechanism that supports MFA. For example any SAML service (like Okta) usually supports MFA for authenticating users for the services.   Gilad ... View more

Seems like server keeps restarting. can you please upload the full server.log?  ... View more

Is this an .sh installer, or the OVA machine?   Can you check if you see in the server.log (/var/log/demisto) the following line: info Listening on 0.0.0.0:443 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/web/router.go:3588)   Gilad   ... View more

Hi @batd2    We are not familiar with specific issues with Global Protect. Can you please open a support case on this issue, and attach client HAR files?   How to capture HAR file: https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000PNiJCAW   Gilad ... View more

Looking on the EWS v2 integration, I do not see the option to create or modify a blacklist. You can file in a feature request at https://xsoar.ideas.aha.io/  so our engineering team can see if this can be added.    Gilad ... View more

Martijn,   Understood we got this resolved. Let us know if you have any other questions.   Gilad ... View more

MP,   Community Edition process usually takes less than a week. 1. It requires an enterprise email address (gmail, yahoo, etc. mail accounts will not be not approved) 2. sometimes these emails fall in the spam folder, so please also check there 3. In case you still didn't get it - please ping me on Slack DFIR workspace (@shriki)   Gilad ... View more

MattEllisPAC20, are you not able to perform any action? When the system is downgraded to Free Edition - you should be able to work with it, under the Free Edition limitations (https://start.paloaltonetworks.com/rs/531-OCS-018/images/Cortex_XSOAR_Community_Edition_FAQ.pdf) ... View more

Hi,   You can configure different level of notifications on your profile settings section (click on the avatar on the lower left side of the sceen). Then move the notification tab, where you can control the different notifications. As long as you have email sender integration configured - you will get the configured notifications.     Shriki ... View more

Hi,   This might happen when the license expired before uploading it. Open the license file (it's a normal text file), and check expiration on it. Otherwise - try restarting the server, and then upload again. If nothing works - Please check the logs for errors regarding license, and share so we can look.   Gilad  ... View more

Hi,   This is how all integrations implement the ingestion mechanism. When you set up a new integration instance that "fetch" incidents - it will mostly look for last 10 minutes, and fetch only "alerts" from that timeframe. Then, once an incident is "fetched", the system will maintain that id, and in the next cycle it will start searching from that point onward.   Specifically for QRadar - it will start ingesting incidents from the moment you configured the instance, so you will only get QRadar Offenses that are created after the integration is activated. The query parameter that you can set up in the integration configuration will be applied on top of this time frame consideration (and not as a substitute)    Gilad  ... View more

hi,   in general, all integration reference documentation is located here: https://xsoar.pan.dev/docs/reference/index Specifically, the IBM Qradar: https://xsoar.pan.dev/docs/reference/integrations/q-radar   Also, you can click on the "Show command" under the integration name to actually see the commands it is exposing once an instance is set up   ... View more

You will need to use an integration that returns the domain age. Look at "DomainTools Iris" which does that exactly. The integration also allow you to set a "young" domain threshold so anything created within that time will be marked as suspicious. This is done using the "domain" command which is the generic command to enrich domains. That command is already used by the built-in playbook Domain Enrichment - Generic v2, so you can simply use that playbook with the integration for that use case   ... View more