About DougCouch

Hi! Typically what we see people do is prepend their initials so anything they write is named uniquely. The advantages to this would be that if your co-worker created a nice automation you wanted to leverage you don't have to get it from them and load it in your environment. You can also see examples of others work.  The advantage of having your own complete environment is that you can make big mistakes that delay server response or even crash and you haven't impacted someone else. Also if you are trying to measure impact by monitoring server resources you don't have to worry that a coworker is running something at the same time.  I agree that Multi-tenant wouldn't be a great solution for you but if you have a heavily active development team working in parallel there could be advantages to having your own development server.   ... View more

We're having some issues with the automated download link emails.  Let me check into that for you! ... View more

So just to clarify, this would be more of a static map that could be referred to later?  Also, what would be the elements on the map? Are these systems or stages? Unfortunately Canvas is limited to displaying the relationship or connections between incidents and indicators primarily.  It's great for demonstrating the spread of an attack through your environment! If you were attempting to put together more of a static map of your environment you could configure some custom indicators for the systems and include them but that might be the extent of the capability. I hope this helps!   ... View more

That's an official procedure.  We recommend that clients archive anything over a year's worth of data for best performance.   Thanks!   ... View more

Hi! Just checking where you tried to pull the EntryID from?  Did you use ${File.EntryID} as the input to your task?  Here's an example: For more granularity and to not fetch all of the files in the incident you can add a filter into the entry like this:  That fetches the EntryID for a File with txt in the Name. I hope this helps! ... View more

Hi!  So the easy way to get the EntryID of the file is using the variable ${File.EntryID} If you want to get more specific and insure you are getting a certain file you'll need to add a filter into the query, otherwise you'll bring back all of the files. It sounds like several of you are experimenting with writing your own Automation to do something specific with the contents of a file.  If you want a good example of how we do that take a look at the ReadFile automation.  It simply reads the contents of a file and dumps it into a context value.     Let me know if that helps or you are still missing something on this.   Thanks! -Doug ... View more

My first response when someone describe a potential UI anomaly I recommend that you refresh your browser window, clear the browser cache and try again.  If it still isn't there it's worth taking a screenshot and submitting a support ticket. ... View more

The XSOAR server does support both IPv4 and IPv6.  It listens on port 443 of both networks and will respond.  It also recognizes IPv6 network addresses as an indicator type and can submit it to compatible integrations to enrich with reputation data.  The caveat being that the specific integration has to be able to support the request and the API call.  I was unable to find documentation directly addressing that question either.  My information comes from internal (Customer Success) discussions with the Software Engineers.   Let me know if that addresses your questions or if you have something specific you need! ... View more

Ah! Sorry I just reread it after finishing my coffee.  It sounds like you want to flip the table sideways!  Follow up with the Aha! portal like I mentioned.  Check to see if anyone else has requested that and if not put in the request! ... View more

Could you clarify a bit?  I'm not sure I understand what you mean by "everything in one row".  If you have a CSV file in the warroom it will display only a certain number of columns in the warroom (you can change that using a server setting) and a certain number of rows (also adjustable).  Once you click View Full Table in a new tab or View full artifact in a new tab you should get the whole table as expected.  Here's an example using a randomly generated csv file.   Here's the warroom entry: And here's what you get when you click through to View full artifact: (Note the scrolly bars on the right) Were you expecting something else?  If so, you might consider mocking up what you are looking for and putting in a feature request on our Aha! portal .  If I misunderstood the request or you are seeing something different let me know and it may be that something isn't displaying correctly for you.   Thanks! ... View more

Hi!  So if I understand the ask correctly, you'd like to be able to interact with / ask your users or analysts questions based off other information during the investigation.  Let's say this is part of your Playbook workflow.   The first thing you need is the question part.  Take a look at the Data Collection Task.  This will let you create a questionnaire as a task in your playbook.  If you are interested in having the user select a single item from a list use a Single Select question.  I believe in this case you are looking for "Parent Ticket" from a list of similar incidents, correct?  (You can do this with multi-select too if you want to create a list of items selected from a larger list of items).  It should look something like this: Here's How the question will look:   What you are doing here is selecting from the list of id's in the context from the search in the prior step but you can do it from any context entry that has multiple items in it.   So out of my set of AMAZING test data that I was able to create on the fly: When you run the playbook the task will ask for input based on the previous task:   Hope this helps!!     ... View more