About amore

Hi @EnesOzdemir , 200 containers is still high. Are your hosts meeting the MT sizing requirements stated here? The general recommendation is 1 tenant per host. If you have multiple tenants on a single host, you need to multiply the single tenant requirement by the times of tenants to find the host resource requirements. Highly recommend keeping the master in it's own host. For more detailed guidance please reach out to your Customer Success Architect available through our Premium Success offering. ... View more

Thank you for sharing. ... View more

Hi @Josep I will let the community weigh in, but to me it is a matter of preference. If your team is capable and proficient in development practices like content management through tools like github, and develop content outside XSOAR's UI, the CI/CD process might be better suited for you. The remote repositories feature, or dev-prod as we like to call it, allows all of the development to remain in XSOAR and also the management through the XSOAR UI. Hope that helps.  ... View more

Thank you for sharing, @vigneshmohan  ... View more

Hi @JacobCromly , That is a very interesting use case. Firstly, there is no way to attach a file to a data collection task at this time. However, I would like to share a recommendations with you. In the Questions tab, Question argument, you will see a {} that allows you to pick a variable input. You can choose "Evidence Board URL" to add a link to the Evidence Board (See screenshot attached)   Please let me know if that works. I also encourage you to check out our AHA portal to submit this as a Feature Request ... View more

Hi @DP696 ,  I don't see any problem with using the community edition license in your AWS. Please be sure to note the limitations of our community edition of XSOAR.  ... View more

Hi @EnesOzdemir The script is a great start. I suggest you duplicate the script and edit the lines 23 and 24. If you look closely, line 23 specifically asks to 'get' the count. Line 24 returns that as a result. If you identify how to get the actual tenant names in line 23, you can achieve your desired result. Please let us know how it goes. Good luck! ... View more

Hi @JKerwin2 You should receive it almost immediately. Please try again and let us know if it doesn't work.  ... View more

Hi @Josep , I would love to understand what led you to want to limit containers. You can reference these Docker Server Configurations, particularly the  containers.high.water.mark  to understand how Cortex XSOAR handles containers per docker image. You may change this from the default of 20 to a lower number if you wish. The way to avoid docker memory issues would be through utilizing docker hardening. You can find detailed steps to do so here - https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.10/Cortex-XSOAR-Administrator-Guide/Docker-Hardening-Guide     ... View more

Hi @Josep , thank you for posting your question on the Live Community forum.  What type of events do you want to get more data for? I don't believe the existing integration has that capability. Feel free to submit a feature request for our content team at https://xsoar.ideas.aha.io/ ... View more

Hi @sai thank you for posting your question to the Live Community Forum. This depends on whether the incident status, whether it was already Active when the user clicked the incident. In that case, there is no trigger and we can't log that time with the current functionality. However, if it isn't already active, you can use a timer that is started in the pre-process rules and stopped using a field-change-triggered script, when the status changes to Active.    In addition, you can refer to our example Automation script "StopTimeToAssignOnOwnerChange". You can start the timer field " Time to Assignment" in a preprocess rule. Then use the script StopTimeToAssignOnOwnerChange as a field-change-triggered script on the "owner" field to stop that timer. This will calculate the time taken between the incident been created and it being assigned an owner.    Hope this helps. ... View more

Hi @DavidKoh In that case, we would need to see more screenshots of your configuration and perhaps logs. If you have a dedicated Customer Success team, please reach out to your CSE to take a look. If not, please open a support case with the aforementioned information.  ... View more

Hi @DavidKoh , I would check the following:  1. Is that indicator added to the Exclusion List in some way (as value, CIDR or Regex) 2. The query for the indicator in the threat intel/Indicators page - try using an * before and after ... View more

Hey @DigitalAvenger, It's awesome to know your experience in the data analytics space. Here are my two cents on your questions:  XSOAR has the capability to handle automation of multiple use cases, including firewall related ones. We have EDL management, change management, etc.  Data Analytics skills don't translate directly to XSOAR as it is related more to Incident response and automation. However, we do integrate often with tools such as SQL as they make up critical pieces of security investigations XSOAR is an enterprise solution and we have several offerings to help you get started with your automation journey. I would encourage you to join our Slack community and participate in the #demisto-discussions channel, to see what other SOAR members are doing with this tool.  ... View more

Hi @jboyd98 , is this still an issue for you? Please open a support case with logs and screenshots.  ... View more