This website uses cookies essential to its operation, for analytics, and for personalized content. By continuing to browse this site, you acknowledge the use of cookies.
For details on cookie usage on our site, read our Privacy Policy
For details on cookie usage on our site, read our Privacy Policy
About gyldz
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- LIVEcommunity
- About gyldz
06-01-2023
14Posts
3Likes
3Solutions
Jun 01, 2023Last Visited
User
Activity
User
Profile
Latest posts by gyldz
| Subject | Views | Posted |
|---|---|---|
| 82 | 06-01-2023 12:31 AM | |
| 83 | 05-31-2023 12:27 AM | |
| 95 | 05-30-2023 06:33 AM | |
| 134 | 05-30-2023 05:21 AM | |
| 119 | 05-30-2023 03:26 AM | |
| 155 | 05-26-2023 12:16 AM | |
| 198 | 05-24-2023 07:57 AM | |
| 168 | 05-23-2023 12:20 AM | |
| 244 | 05-22-2023 06:23 AM | |
| 278 | 05-22-2023 01:23 AM |
My Liked Posts
| Subject | Likes | Posted |
|---|---|---|
| 1 Like | 06-01-2023 12:31 AM | |
| 2 Likes | 05-22-2023 01:23 AM |
User Badges
Community Statistics
| Member Since | 04-26-2023 05:57 AM |
| Date Last Visited | 06-01-2023 03:52 AM |
| Posts | 14 |
| Total Likes Received | 3 |
06-01-2023
12:31 AM
1 Kudo
Hi @Bar_Magnezi ,
If you filter by occurred in the query section, you will be presented time picker as below; you can select the hours according to your needs. Please be informed that the time picker next to the query bar takes precedence over the occurred filter.
I hope this helps.
... View more
05-31-2023
12:27 AM
Yes building your automation for this purpose is another solution. You can use the built-in command "/docker_image_create" and specify other parameters. The only potential issue is you won't be able to delete dockers from the UI. You will need to go into the server to delete them. /docker_image_create name=<name_here> base=<base_image> dependencies=<comma_seperated_deps>
I hope this helps.
... View more
05-30-2023
06:33 AM
It seems that your API integration does not work properly. Could you please share the screenshot of API integration?
... View more
05-30-2023
05:21 AM
Hi @Josep , if you use zipfile instead of 7z while unzipping, the error will be provided if the zip file is protected. You can handle the error in the playbook to catch if the zip is password protected.
!UnzipFile entryID=${File.EntryID} zipTool="zipfile"
Reason
zipfile couldn't extract this file - try using zipTool=7z If you already tried both zipfile and 7z check that the zip file is valid. File <ZipInfo filename=filename compress_type=deflate filemode='-rw-r--r--' file_size=1118 compress_size=624> is encrypted, password required for extraction
... View more
05-30-2023
03:26 AM
hi @IAwadiya , Can you please also provide what kind of inputs you provided? Also, did it use to work and stop working, or is it the first time you are testing? Can you please try to run the first command in your playground to see if it is going to throw the same error? If it still gives an error can you also run the second one and provide the output? !ContentPackInstaller packs_data="[{\"packid\":\"Base\",\"packversion\":\"latest\"}]" pack_id_key="packid" pack_version_key="packversion"
!demisto-api-get uri='/contentpacks/metadata/installed'
... View more
05-26-2023
12:16 AM
You can use different API endpints. Please see the below example, which will retrieve the incidents under the tenant customer1. You can change the query according to your needs.
query="account:customer1"
body = {
"filter":{
"page":0,"size":200,"query":query,
"period":{"byFrom":"days","fromValue":7,"byTo":"days"}
}
}
incidents = demisto.executeCommand("demisto-api-post", {'uri': f"/incidents/search/", 'body': body})[0]["Contents"]["response"]["data"]
demisto.results(incidents)
... View more
05-24-2023
07:57 AM
Hi, what kind of script do you want to run? You can make use of API calls for this purpose.
... View more
05-23-2023
12:20 AM
If the mirroring configuration works as expected, the incident should automatically be closed in XSOAR. Did you select the below option from the instance configuration?
... View more
05-22-2023
06:23 AM
Not that I know. If you have access to Beacon platform, you can find TIP training content.
... View more
05-22-2023
01:23 AM
2 Kudos
Hey @KavitaK ,
You can follow below playlist on YouTube.
https://www.youtube.com/watch?v=BhpkZA9t1HA&list=PLD6FJ8WNiIqUVEA2e5LZhmqNnwFcFhDTZ
... View more
05-19-2023
02:12 AM
Hi @Bar_Magnezi ,
Can you see any errors in the logs? Also, did you define any query in the integration? If you are only getting open offendes, closed ones cannot be mirrored.
... View more
05-16-2023
06:33 AM
Hi @michaelsysec242 ,
How are you making the data collection possible without the Submit button?
It seems that SlackBlockBuilder adds Submit button by default and provides no option to disable it. As a workaround, you can Duplicate the SlackBlockBuilder Automation script, comment out the below line, and use the modified version. Please be informed that this is only a workaround and may require testing in your use case to prevent any workflow failure.
code to comment out/remove: self._add_submit_button()
... View more
05-08-2023
12:57 AM
Hi @EnesOzdemir,
Did you enable the below option from the integration settings?
... View more
04-26-2023
06:19 AM
Hi @abdulazizh,
If your script works as expected, post-processing should work as well. You cannot run any command on the closed incidents. If you want to test before implementing it, I would recommend having another pre-process rule for fake alerts and doing the testing on those ones by triggering some fake alerts on Splunk. I could not reproduce the issue due to the lack of Splunk integration, but Slack notification with incident details worked. So, you need to make sure the below command works as expected.
demisto.executeCommand("splunk-notable-event-edit", {"eventIDs": EID,'owner': user, "comment": nota ,"status":"5" })
... View more
Contact Me
| Online Status |
Offline
|
| Date Last Visited |
06-01-2023
03:52 AM
|
Latest Tags
No tags yet
LEGAL NOTICES
Copyright 2007 - 2023 - Palo Alto Networks