About jfernandes1

Hi @BCC_Automatizacion_Josep,   We currently only have a Phishing training model that comes OOTB.    Model inputs are shown below.  ... View more

Hi @Harsh-Panchal,   1. XSOAR's incident state field is used to signify different engagement states of the investigation. The field is not used inside the mapper and so is not affected by changes to the remote ticket. You can engage a dummy playbook in the incident type with the "Run playbook automatically" set true to ensure the state is changed from Pending to Active when the incident is created.     2. The  0001-01-01T00:00:00Z value means that the sync is not yet run or in some cases its run but failed. Not sure what you mean by "due to that I'm not able to add the previous entries".   3. Note that this feature is not supported for all mirroring integrations. For ServiceNow, you need to ensure that the note or entry is tagged correctly. You can configure which tags to pick-up inside the integration like below.    4. Not sure I understand. Does this refer to point 3? ... View more

Hi @azharsazpan, you can download our community edition here https://start.paloaltonetworks.com/sign-up-for-community-edition.html   The community edition is fully featured for the 30 day evaluation period.  ... View more

Hi @azharsazpan, You can register for the community edition here https://start.paloaltonetworks.com/sign-up-for-community-edition.html. You'll get your own link to download XSOAR. As @MBeauchamp2 mentioned, you can then add &downloadName=6_6_latest at the end of the link.   ... View more

Hi @oDarweesh2,   Running the  AssignAnalystToIncident command with the roles parameter will assign the ticket to all the users that belong to that specific role. Run the command with the username parameter only.   If you're using a conditional task approach Playbook steps I assume you currently have (Steps 1-3) 1. Assign the incident to the analyst 2. Analyst chooses the radio button option and clicks "Mark Completed". (Cannot be in quiet mode for custom automation solution) 3. Playbook step to set the Incident Categorisations 4. Custom automation that uses XSOAR REST API to URI  /investigation/<Incident ID > (Check screenshot for more information) . In returned results find "Task Done" warroom entry for the conditional check in Step 2. Grab username who completed the task.  5. Assign the incident owner to the above username   Recommended Approach. As you can see the above approach is complicate and requires a custom automation. I would recommend the below approach.  Configure a Data Collection task to be a "Ask by Task". This is done by de-selecting all the options in "Select communication channels". Then create a field linked question. When the task is called it should look like the below during the playbook run.  When the analyst selects an answer, the field is updated directly and the user who submitted the answer is also captured in the context.               ... View more