About cpayne26

Good morning.   The renaming of the microsoft products gets me confused too.  Microsoft Threat Protection is a former name for microsoft 365 defender  to find it when adding API permissions in your application page you need to select API permission > add permissions > APIs my organization uses > (then in the search bar) type Microsoft Threat Protection and select that app.  You should then be able to see the permissions you're looking for.  source: https://learn.microsoft.com/en-us/microsoft-365/security/defender/api-create-app-user-context?view=o365-worldwide#create-an-app.  Let us know if this helps.      ... View more

You can pull the information for installs if you're looking for when something was installed by going to Settings > User and Roles > Audit Trail.   Here's a sample query to get you started object:ContentPack and type:install and action.ID:CommonScripts modified:>2023-04-01T00:00:00 Here's the reference in the admin guide  https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.5/Cortex-XSOAR-Administrator-Guide/Audit-Trail  Here's a command that pulls no more than 200 entries for common script installs from the past 3 months.   You can see more syntax under getAudit in the api guide https://<yourdomain name>/api#_getaudits !demisto-api-post uri=/settings/audits body="{\"page\":0,\"size\":200,\"query\":\"object:ContentPack and type:install and action.ID:CommonScripts\", \"period\": {\"by\": \"\",\"byfrom\": \"months\", \"toValue\": null, \"fromValue\": 3, \"field\": \"\" }}"     ... View more

Hi @KavitaK Have you seen the customer journey for TIM?   https://live.paloaltonetworks.com/t5/threat-intel-management-tim/tkb-p/TIM?  The skills learned in the engineering training would apply here too as you develop TIM specific playbooks.  This link gives you top use cases for TIM https://register.paloaltonetworks.com/cortexxsoartopusecaseswebinarseries    ... View more

There's not much that exit code  screenshot provides on its own and you should probably open a ticket with support.   In the interim, Assuming a standard installation you can probably see some more hints in /var/log/demisto.service.log  or in the journal logs (journalctl --since "<##>  hour ago" > <jfilename>   (example collecting 12 hours of journalctl logs:  journalctl --since "12 hour ago" > journalctl _12hr.txt )   ) .  Off the top of my head, make sure there's enough space in the filesystems the relevant directories (see link for relevant directories) and demisto has access.  Make sure you're system meets the minimum requirements.   also confirm the docker/podman  service is up and healthy   https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/Install-the-Server-for-a-Single-Server-Deployment  (contains relevant filesystem structure and sizing recommendations)  https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.11/Cortex-XSOAR-Administrator-Guide/System-Requirements (system requirements) ... View more

Hi did you get your download link or are you still having an issue?  ... View more

Hi  I see you have a space in your user name which may or may not be a problem.   Can you try running  !microfocus-smax-get-entity entity_type="Incident" entity_id="16989" entity_fields="Description,Urgency,Status,RegisteredForActualService" replacing 16989 with an actually incident id and see if its possibly just an issue with the test module?     An additional thing you can try (though I would make sure the logs were sanitized to be posted in a community forum)  is to go to the bottom of the SMAX integration and set logging level to debug (see screenshot)?    This will put the logs in the integration-instance.log  You can then create/download the log bundle to see the log (just remember to switch it back to off once you're done troubleshooting) .   Here's some other things you can do to generate more logging information so you can troubleshoot the instance.  ... View more

You'll need an API key but you can run a get command against this https//<url  or IP>/content/bundle   ... View more

Hi can you confirm if this is the first instance for sentinel you're trying to create or if you have an instance created already?    Also which version of the azure sentinel content pack do you have installed?   You can see that by going to the integration --> Clicking on the Content pack "Azure Sentinel Link"  (this will take you to marketplace) -->  Then clicking on Version History (You should see a green Installed  message in the top right corner of the version that you have installed?     Also what base pack do you have installed?    Also can you check to see which base pack you have installed?  ... View more

Perhaps look at The Graph API interface   Based on https://learn.microsoft.com/en-us/graph/authenticationmethods-get-started  You can test  this request GET https://graph.microsoft.com/beta/users/<userid>/authentication/methods and test to see if this give s you the data you want in  https://developer.microsoft.com/en-us/graph/graph-explorer  Got these results when I tried it in my lab  using  The Cortex XSOAR Azure App for authentication and setting scope to UserAuthenticationMethod.Read.All !msgraph-api-request resource="/users/leeg@somedomain.onmicrosoft.com/authentication/methods" api_version=beta |@odata.type |id|isUsable|methodUsabilityReason|phoneNumber|phoneType|smsSignInState| |—|---|—|---|—|---|—| | #microsoft.graph.phoneAuthenticationMethod | <string>-<string>-<string>-<string>-<string> | true | EnabledByPolicy | 867-5309 | mobile | notAllowedByPolicy | | #microsoft.graph.passwordAuthenticationMethod | <string>-<string>-<string>-<string>-<string> | true | EnabledByPolicy | | | | | #microsoft.graph.microsoftAuthenticatorAuthenticationMethod | <string>-<string>-<string>-<string>-<string>| true | EnabledByPolicy | | | | ... View more