About AbelSantamarina

Hello @Josep ,  In order to reset a task you will need to reopen it first if it has been previously run. To reopen a task you can run the command !taskReopen which takes as arguments: i. The id of the task (that can be a tag assigned to the task in the task's details tab). ii. The incidentId of the incident running the playbook. iii. The parentPlaybookID, which is to limit the task to reopen if it's found in different subplaybooks.  E.g. !taskReopen id=TaggedTask incidentId=1111 Once the task has been reopened, it can then be marked as completed using the !taskComplete command: !taskComplete id=TaggedTask isAutoRun=true incidentId=1111   ... View more

Hello @weijielim,    You can change the name of a closed incident using the command !setIncident from a different incident, by passing the id of the incident you'd like to rename and the name you'd like to give to it. If you'd like to target multiple incidents at once you will need to wrap that command inside a for loop in an automation.  You can use this basic automation below as an example: import json query = demisto.args()['query'] new_name = demisto.args()['new_name'] try: incidents = demisto.executeCommand('getIncidents', {'query': query, 'size': '10000'})[0]['Contents']['data'] incident_ids = demisto.dt(incidents,'id') except: demisto.results('No incidents found matching query.') sys.exit(0) if not incidents: demisto.results('No closed incidents found matching query.') sys.exit(0) res = [] for inc_id in incident_ids: try: command_res = demisto.executeCommand("setIncident", {'id': inc_id, 'name': new_name})[0]['Contents'] if "Script failed" not in command_res: res.append({'Incident ID': inc_id, 'Status': "Success"}) else: res.append({'Incident ID': inc_id, 'Status': "Failure"}) except Exception as e: demisto.results(e) sys.exit(0) demisto.results({'Type': entryTypes['note'], 'ContentsFormat': formats['markdown'], 'Contents': tableToMarkdown(name='Renamed Incidents', t=res) })   This works for both Active and Closed incidents.  ... View more

Hello @JacobCromly, for this scenario, we have the option to use the EmailAskUser workflow. You can read more about it in our documentation here below: https://xsoar.pan.dev/docs/reference/scripts/email-ask-user On a high level, this works by sending an email to a user, waiting for the response to come back and routing the response back to the original incident. The response can then be used to control the execution flow in the playbook. With this method we have the option to attach incident files and artifacts to the email using the argument attachIds. The Id's are the corresponding EntryIDs of the files in your incident.  Here's how you would use this method in your playbook (see screenshots below for additional context): 1. Create a task with EmailAskUser automation. In this task you specify the recipient, the subject line, the different reply options, the EntryID (s) of the file (s) you want to attach and the tag of the next task you want to complete once the response is received. 2. Create a manual task with a tag corresponding to the previous task. This task will keep the playbook in waiting state until the response is received.  3. Create a conditional task with EmailAskUserResponse automation and with ${lastCompletedTaskEntries} as input.  4. Create a branch for each possible response. The response will be parsed from the first textual response line of the reply body. Notes: 1. This method will require a email integration that can both send emails using send-mail and fetch incidents. 2. This method will not work in the Playbook debugger.  3. Be advised that the incidents can contain malicious files and artifacts and these should handled with caution to avoid getting infected.  ... View more

@UmutAK ,  You can achieve this by creating a custom indicator field (https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-9/cortex-xsoar-admin/manage-indicators/understand-indicators/indicator-fields/create-a-custom-indicator-field) and adding that field to your IP indicator layout (https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-9/cortex-xsoar-admin/incidents/customize-incident-view-layouts/customize-incident-layouts). Since the data will be displayed in a tabular format, you can use a field of either of these two types: grid field or markdown. For this example we will be using a markdown as it is easier to work with.     Once you have the field in your indicator layout, it can be populated in few different ways, i.e. using an enhancement scripts, using a button in the layout, using reputation scripts. For this example and for simplicity, we will use a button in the indicator layout that will trigger our script. On how to add a button to the layout -> (https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-9/cortex-xsoar-admin/manage-indicators/understand-indicators/customize-indicator-view-layouts/customize-an-indicator-type-layout). The script will basically get the data from the integration command (vt-passive-dns-data), format it in a table (using tableToMarkdown built-in function) and populate the field using setIndicator built in command.  Find below a sample script to do this, as well as a screenshot of the layout.     ... View more

Hi @MKececioglu, what version of XSOAR are you running in your multi-tenant environment?  You might want to check the time range for your dashboards... You can try setting it to different time ranges and see if it makes any difference. Also, does it pull any information if you select individual tenants?  Thanks.   ... View more