This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About LancePettay
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About LancePettay
06-06-2023
8Posts
8Likes
2Solutions
Jun 06, 2023Last Visited
User
Activity
User
Profile
Latest posts by LancePettay
| Subject | Views | Posted |
|---|---|---|
| 1466 | 03-21-2022 04:58 PM | |
| 2747 | 03-17-2022 12:30 PM | |
| 2682 | 03-17-2022 10:51 AM | |
| 2722 | 03-17-2022 10:16 AM | |
| 1382 | 03-03-2022 12:26 PM | |
| 2751 | 12-02-2021 01:00 PM | |
| 2751 | 12-02-2021 12:59 PM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 03-21-2022 04:58 PM | |
| 1 Like | 03-17-2022 12:30 PM | |
| 1 Like | 03-17-2022 10:51 AM | |
| 1 Like | 03-17-2022 10:16 AM | |
| 1 Like | 03-03-2022 12:26 PM |
Posts I Liked
| Subject | Likes | Author | Latest Post |
|---|---|---|---|
| 1 Like | |||
| 1 Like | |||
| 3 Likes |
User Badges
Community Statistics
| Member Since | 07-20-2020 02:59 PM |
| Date Last Visited | 06-06-2023 12:15 PM |
| Posts | 8 |
| Total Likes Received | 7 |
03-21-2022
04:58 PM
1 Kudo
Hi @jboyd98 ,
I would just recommend removing the [0]['Contents'] on the end of executeCommand, and do return_results(str(res)) so that you can get an understanding of the entire entry structure. Since you have multiple return_results() in ScriptB, this means the second output would actually be under res[1]["Contents"].
I hope this helps!
-Lance
... View more
03-17-2022
12:30 PM
1 Kudo
Ok, I have tried various things to get this to work. I was able to reproduce what you were seeing, with it working on a single incident but not multiple. Unfortunately that may be a bug. I noticed in the war room of each respective incident, there is an entry saying the close notes were modified, but it isn't actually modified. You are welcome to report it via support.paloaltonetworks.com
As far as other options, I also tried this in a post-processing script, but fields are kind of locked into a limbo state during post-processing and can't really be changed. If you attempt to set them, they just return to what they were prior to being set.
I unfortunately am not able to come up with any way to get this working as far as your current flow goes.
... View more
03-17-2022
10:51 AM
1 Kudo
Update: I did test this, and I am able to get the field-trigger scripts to work even upon batch incident closure from the incidents page.
There is no need to change the script as it doesn't run any differently when you're closing multiple incidents. It runs from the scope of each individual incident, i.e. the script will run once per incident.
Perhaps there is an issue with the script logic? Maybe the concurrent runs are conflicting somehow? Would you be willing to share the script itself? Please sensor anything that would be considered sensitive to you or your organization.
... View more
03-17-2022
10:16 AM
1 Kudo
Hi Josh, I would need to double-check but I'm not sure if field-trigger scripts will work at all on incident closure. Once the incident is closed, most things lose the ability to execute. A field-trigger script wouldn't be triggered until after the fields are modified, therefore the incident would already be closed.
This sounds more like a case for a post-processing script: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-6/cortex-xsoar-admin/incidents/incident-management/post-processing-for-incidents
Let me know if that helps.
-Lance
... View more
03-03-2022
12:26 PM
1 Kudo
Hi Jboyd,
This forum is best for implementation questions, not so much for server crashes, bugs, or other unexpected behaviors.
I would recommend that you open a support ticket a support.paloaltonetworks.com. Please attach your log bundle set to Debug level from the Settings>About>Troubleshooting page. There you will be met with the proper team to investigate this, along with an SLA for a response to your issue.
Thanks,
Lance
... View more
12-02-2021
01:00 PM
1 Kudo
Forgot to mention this one,
4. Make sure that the disk usage on your system is not maxed out.
... View more
12-02-2021
12:59 PM
1 Kudo
Hey Saul,
There is no hard limit to the file size in the war room.
Some things to try:
Try additional files, perhaps it's a problem with this particular file.
Check the debug log bundle (Settings>About>Troubleshooting) / journalctl on the system, it might provide more info about the error.
For example maybe the OS is preventing the file upload due to an SELinux restriction for example
Feel free to open a support ticket for this sort of issue, as it is outside of a standard implementation question which this discussions board is more suited for. Be sure to include logs for them to review.
... View more
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks