About rbuchwalder

Hello   If we press in the war room output to " View full content in a new tab" then the output is a table - and everything in one row. Is it possible to get the output in columns?   Even csv is all in one row...   so, instead first row with description, put that in one column. then the 2nd row put that in secound column. it is a bit nicer to scroll around and it's a bit more pleasant    Is there a way to switch those outputs?   thanks roger ... View more

Hello All   In my Playbook I run into an issue with empty returns. My Playbook requests Cherwell with several hosts in an array: ["server-A","server-B"] In Cherwell, "server-B" does not exist, so I do see that in the "Result Tab" of the Task, but the Output is only from the one Host (server-A), which is in the Cherwell DB. The reason is, that I have to fill out later some other DB. And they fill me in both Servers (server-A and server-B) the same one content from Cherwell. How do I avoid "empty" fields? I'm looking for something like (If output = "no result" then ...) But this must happen in the Cherwell-Task.   To understand: Cherwell-Task: Input:     ["server-A","server-B"] Result:     dbot request server-A:         a Table with contents of server-A     dbot request server-B:         "no results" Output:     Cherwell.QueryResults [{ "stuff from server-A" }]   Next Task I see: for [{"server-A","server-B"}] insert [{ cherwell-output }] and cherwell-output contains only info from one server (server-A) and this Task inserts the content of server-A in both targets (server-A and server-B)   How may I bring this "no entry" into this whole loop?   I hope my question is clear... 🙂 thanks roger   ... View more

Hello   I've configured the  Palo Alto Networks WildFire v2 Service with a Wildfire-API Key from our Wildfire-Account at https://eu.wildfire.paloaltonetworks.com/wildfire/account I also use this Server base URL: https://wildfire.paloaltonetworks.com/publicapi   But if I press the Test Button or use this Service in a Playbook, It runs into this: Script failed to run: Timeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)   In the /var/log/syslog I see many of these Lines: Feb 12 08:16:22 sa1100049 snmpd[1848]: Cannot statfs /var/lib/docker/overlay2/53bc122e04e2b296b8e9b49aa42c6f78f7cbb32272f540b3e09a0157557fb3bb/merged: Permission denied Feb 12 08:16:22 sa1100049 snmpd[1848]: Cannot statfs /run/docker/netns/92dbf58c974e: Permission denied Feb 12 08:16:22 sa1100049 snmpd[1848]: Cannot statfs /var/lib/docker/overlay2/c653ffb365434cc055c31abecbff87764e9a46e0ed49877a57d28b323849255c/merged: Permission denied Feb 12 08:16:22 sa1100049 snmpd[1848]: Cannot statfs /run/docker/netns/3d5b1470c9af: Permission denied   And in /var/log/demisto/server.log I do see these lines: 2021-02-12 08:09:55.4613 info Starting instance test: [Palo Alto Networks WildFire v2 | WildFire-v2_instance_1] [server: "https://wildfire.paloaltonetworks.com/publicapi"] [insecure: false] [proxy: false] [suppress_file_type_error: false] (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/integrations.go:739) 2021-02-12 08:09:55.4620 info Removed module: WildFire-v2_instance_1e226ebb6-81ab-48d0-85fb-8f5da076870e (source: /home/circleci/.go_workspace/src/github.com/demisto/server/modules/registry.go:44) 2021-02-12 08:09:55.4658 info Starting new container for Docker Image [demisto/python3:3.9.1.14969], amount of containers in array is 0/20 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/containerpool.go:116) 2021-02-12 08:09:55.4659 info added container for docker image [demisto/python3:3.9.1.14969] amount of containers in array is 1 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/containerpool.go:128) 2021-02-12 08:13:54.0479 info No telemetry data to send (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/telemetry.go:336) 2021-02-12 08:14:56.1758 info WildFire-v2_instance_1e226ebb6-81ab-48d0-85fb-8f5da076870e_WildFire-v2_test-module: Timeout (300000000000) reached, killing (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/container.go:602) 2021-02-12 08:14:56.2304 info Stopping docker container demistoserver_pyexec-3c227a60-8e6e-4bfc-8247-c9c52305387d-demistopython33.9.1.14969--68 (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/container.go:361) 2021-02-12 08:15:06.7443 error Container exit with error. container name: [demistoserver_pyexec-3c227a60-8e6e-4bfc-8247-c9c52305387d-demistopython33.9.1.14969--68] error: [exit status 137] (2619) (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/container.go:118) 2021-02-12 08:15:06.7444 error Failed to run script: WildFire-v2_instance_1e226ebb6-81ab-48d0-85fb-8f5da076870e_WildFire-v2_test-module with image: demisto/python3:3.9.1.14969 [error ' Timeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604)'] (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/automation/runner.go:57) 2021-02-12 08:15:06.7445 error Instance test failed: Palo Alto Networks WildFire v2 | WildFire-v2_instance_1e226ebb6-81ab-48d0-85fb-8f5da076870e [error 'Script failed to run: Timeout Error: Docker code script failed due to timeout, consider changing timeout value for this automation, (2604) (2603)'] (source: /home/circleci/.go_workspace/src/github.com/demisto/server/services/integrations.go:765) 2021-02-12 08:15:06.7446 info [POST] "/settings/integration/test" 200 5m11.285461065s (source: /home/circleci/.go_workspace/src/github.com/demisto/server/web/middleware.go:96) 2021-02-12 08:15:06.8082 info Removing container [demistoserver_pyexec-3c227a60-8e6e-4bfc-8247-c9c52305387d-demistopython33.9.1.14969--68] from from container pool [demisto/python3:3.9.1.14969]   What do I wrong? Thanks roger ... View more

Hello   I do have problems to get Cortex XSOAR talking to our ADFS Server (Windows AD 2012) Which certificate is here used? It should be, as fas as I understood, somewhere on Cortex XSOAR, but couldn't find anything...     Response from ADSF Server: The verification of the SAML message signature failed. Message issuer: http://<adfs-server-url>/adfs/services/trust Exception details: MSIS7075: SAML authentication request for the WebSSO profile must not specify any SubjectConfirmations.   This request failed.   User Action Verify that the message issuer configuration in the AD FS configuration database is up to date. Configure the signing certificate for the specified issuer. Verify that the issuer's certificate is up to date. Verify the issuer and server message signing requirements. Thank you  roger ... View more

Hello all   I run into a failure on Playbook Panorama Query Logs. The failure is: "Set vsys for firewall or Device group for Panorama"   This happen on the GeneralPolling Playbook and there at the task RunPollingCommand.   I've defined Device Group and asking Panorama - but the failure still occours. Does anyone have any Idea, what this could be?   thanks roger ... View more