About chrking

I'm confused by this statement: "The way in which XSOAR works with these files does not allow the use of python libraries." If you use a custom automation with a custom docker image you can import and use basically any library you want, I don't understand what the the restriction would be here. ... View more

Yes, you can create incidents in XSOAR based on emails arriving to a dedicated inbox. You'll need a mail integration like Mail Listener or Gmail Single User to receive the emails. These are most commonly used for phishing reports, but there's nothing to stop you from using them for other purposes. You can have multiple instances of the same integration, so if you need multiple mailboxes for different purposes that's fine too.   You can use the classifier and mapper with regular expressions (or similar) to select the appropriate incident type and extract stored data from the email into fields. For this, bear in mind that this kind of extraction works best with highly structured mails (eg, mails created to a template).   Once the incident has been classified and mapped, it will automatically execute the associated playbook for the incident type (depending on incident type settings). ... View more

Hmmm, I think we'll need to look more into the image where this is trying to run. I'm assuming this is a version of the panorama integration downloaded from the marketplace and not a customized version?   I think it would be worth trying to remove the existing docker images for this integration and re-fetching them. First, stop XSOAR. Then run: docker images | grep pan-os That should give you a list of one (or more) images that this integration uses. You can remove them with: docker rmi <image id> where the image id is in the output of the docker images command. Once done re-start XSOAR, and the required image should be re-fetched. If you're still seeing issues, you might need to check out your repository config (to see where you're fetching images from) or your outbound proxy (used to fetch images).   ... View more

Assuming this is XSOAR 6.x and you haven't already, I'd suggest giving /reset_containers a try.  ... View more

XSOAR does not support iframes. You could have an integration which creates a Browserling session and returns a link. You could then put that link in the layout so that users could click on it.   You should also check out the rasterize integration if you haven't already, rasterize has the ability to provide an image file containing the local rendering of an arbitrary URL so you may not actually need Browserling. ... View more

Yeah, if they need the multi-mailbox delete functionality then "O365 Outlook Mail (Using Graph API)" is definitely one way to do this. I had assumed that wasn't possible for DennisO since the original post mentioned "O365" as being something they couldn't do, but if that was a misunderstanding on my part then they should definitely check it out. ... View more

When you say "Graph Mail", are you referring to "Microsoft Graph Mail Single User" ?    Microsoft Graph Mail Single User authenticates as a single, non-admin user for the purposes of sending/receiving email. In contrast with the other integrations, it is specifically intended to be used in situations where XSOAR cannot or should not be granted admin-level privileges over the mail system.   The "Search and Delete" functionality in the phishing playbook requires admin-level privileges to search / delete from other user's mailboxes, and so it is inherently incompatible with the design goals of this integration. ... View more

In your classifier, use a transformer to extract only the part of the email subject you want to classify based on.   In this example, I have a (randomly generated demo data) username which is always a first.last name pair. The regex extracts everything after the period, and the classification options you get show only the last name. ... View more

My understanding is that Splunk Cloud is the base installation (SaaS version) and Enterprise Security is an app that sits on top of the base installation.   The Splunk integration is by default configured to fetch "notable" events which are a kind of event that is defined by the ES app, but the actual API that does the query used for fetching is a feature of the base Splunk and not ES.   The Splunk integration has a lot of additional features (KV lookups, Mirroring, enrichment) that you can find described here: https://xsoar.pan.dev/docs/reference/integrations/splunk-py#splunk-enterprise-security-users but for basic incident fetching all you need is the ability to execute queries against your Splunk cloud. ... View more

That looks right according to the documentation, so unfortunately I think this is going to be hard to debug without the debug logs.   When run with debug-mode=true you should get a log file created in the incident where you ran the command that contains the full request/response contents as well as curl commands so that you can test them yourself.   Integrations should, in theory, provide the error message from the server to the person using the integration but this doesn't always work as expected (especially when the response is in an unexpected format), so the debug logs can help with that.    If the page is an error response of some kind the page should hopefully provide more details on what the problem is and how you can fix it. ... View more

Based on the error, it looks like you're getting a HTML response rather than JSON. That might mean your URL is incorrect, but it's hard to say for sure.   You can also get more detailed information about the API request/response by using the debug-mode=true argument on the command you're running. ... View more