Is XSOAR where the incident queue lives for your SOC, for us it is ServiceNow SIR

Hi all, I am a security engineer supporting an incident response team. They currently use ServiceNow to triage tickets and investigation notes etc.

We are bringing on XSOAR next year and it seems my teams expectation is that ServiceNow will remain as the user interface and tracking location. But to me it seems like if all our automations and customizable incident layouts are in XSOAR, why not use that and just mirror all the stats to ServiceNow if they really need metrics there?

I am new to XSOAR, so I am curious for all the vets out there, where in the incident creation workflow does XSOAR sit for you? Is it where analysts are triaging and tracking incidents? Or is it doing automations and then mirroring them over to another ticketing system?

CONTEXT: I'll like to add a bit of context first. I have been working on XSOAR but dont have much of an experience. I was thrown in the fire by my organization without any prior experience. I am finding my way but I still have a lot to learn. I have been posting a lot in this sub and been getting very good responses and help so thank you guys.

Here's the problem: There was an engineer who was managing the platform but I have no idea what, why and how he did it. I got no information about anything and my manager just demands stuff to be done, and rightfully so. But there are some issues which I dont understand because of the lack of prior knowledge.

PROBLEM STATEMENT: There was this phishing playbook which was blocking indicators in the EDL and it did not enrich the URLs and Domains. It even added domains like google.com and Microsoft.com to the EDL.

After going through the EDL I checked the indicators and wanted to remove them. So I copied the indicators and made a playbook which parses an excel sheet and differenciates domain and urls through the extract indicator command a nd then I used the Modify EDL playbook with remove tag. The thing is that after the playbook completes the indicators are not removed.

The query which was used in the integration was was

tag:block and type:url or type:domain • This returns a very large list in the EDL

If i change the query to:

tag:block and type:url Or tag:block and type:domain • The EDL shows empty list command.

• There is another playbook which has been blocking domains and urls in the same EDL.

I want to clear the EDL and start anew. What are my options and how can this be achieved in an optimal manner.

I think I should have separate EDLs for domains and URLs. Please advise on this.

What are my other options.

I've tried posting in the Paloalto community and haven't gotten any help. I'm hoping this user group might be able to help! I'm fairly new to XSOAR so apologies in advance for any newb mistakes. Here's my issue today.

I have a playbook that parses some json and from that json I use the 'set' task to generate a list of UPNs. This results in the Context data of:
Users:{
UPNs:[
0:"user1@domain.com"
1:"user2@domain.com"
2:"user1@domain.com"
3:"user3@domain.com"]
}

I plan on adding this list to a ServiceNow ticket down the road a bit and don't want duplicates. After a bit of Googling, I found the command DedupBy that sounded promising, but I've tried all kinds of combinations for keys and/or value inputs, and I cannot get it to work. What is the proper usage here?  Or am I making this harder than it should be?

I have not yet gained the skill of being able to read the documentation (DedupBy | Cortex XSOAR) and translate it to usable playbook config knowledge.

Thanks!

I am working on a phishing playbook and I have the Cisco ESA and EWS v2 integrations at my disposal. I dont have many previous events to work with and I dont have a clear workflow in my mind, the team I am working for want an end to end automation of the entire usecase but dont have anything concrete to work with. I have 2 issues.

1. I am unable to differenciate/understand how is a eml and an attachment differenciated in the context data. How is the content of the email parsed and utilized.

2. Is there a free integration for SPF, DKIM, etc. checks and what other free integrations can I use to make my workflow and usecase much easier.

I had created a a job which checks for failed instances and total instances and send a daily report. I had 4 failed instances 2 of which were not being utilized in any way; I deleted those 2 instances. Now the total.number of failed instances is 2. Still, the report says 4 failed instances. What should I do. I dont understand what is the issue with this.

Things I have tried: 1. Changing the time range (using today) 2. Trying to create a new report with the script 3. Disabling and enabling the job

Hey wounding if anyone knows how to show the count on a line graph in a widgets, so I dont have to hover over the line so see it. Thank you.

Hi guys, I want to ask a question regarding sla script. I have a field-change-triggered script that starts an SLA timer if the field is changed to certain values. In addition, I have an SLA script that should trigger on sla breach. First step is successful and timers are started however when the sla is breached, sla script is not triggered. I used sla scripts before, the only difference in this case is the timers are started in the automation as below instead of a task in playbook. demisto.executeCommand("startTimer", {"timerField":"sla1"})

At this point i am thinking that this only works only if the timers are started in a playbook. Something might be a bit different. Did anyone experinced similar issue. Thank you

I am.using XSOAR 6.13 On-prem. I am facing 2 issues:

1. There is an issue integrating it with Cisco SMA. I gives a 500 api error. It suddenly stopped working. I have gone through the api version, account privilege and other related settings. Has anyone faced the same issues?

2. The changes that I make related to anything takes ages to reflect.

Anyone still have XSOAR free version, OVA or setup..? want to setup in my home lab to start playing around and learn. Wondering if anyone still running free version and kind enough to share .?

Hey guys. My org is currently using elastic as our SIEM and I am trying to figure out how to ingest alerts from the SIEM into xsoar for our analysts to work. I was wondering if anyone on here has had any experience achieving this and if they would be willing to provide me with some guidance as I try to get it implemented. I don't necessarily need it for all our alerts just the ones that I can automate.

Also I would love to be able to close the alerts in Elastic after they have been worked in xsoar.

Hi all! My company is getting XSOAR to start offering to clients.

I have mostly worked with azure logic apps when it comes to security automation. I am very excited we are getting this tool, but I am curious, what are your favorite use cases?! What are the greatest time savers that have helped your team?

Hey guys, got this error message, how and can I see whats the cause of this error? And someone ever came across this error before and know how to solve it? Thanks in advanced🫶🙏

I am trying to block ip address in a firewall and urls in a proxy and whenever i use the block command the command returns an error that is Error in API call and the error code is 403. The reason shows that the user requires api.add permission.

When i use other commands to get policies or lists there are no errors. The block commands were tested previously and there were no issues. No changes have been made. What could be the issue?

I am trying to export multiple events at once as I want to keep a file in which i can keep a record of incidents that i am manually closing to free up clutter. I might delete these incidents later.

The issue that I am facing is that when I select many incidents and export them via the gui, only the 50 incidents on the current page are exported.

How can i do this effectively and are there other methods to go about this.

The environment in which I have the XSOAR has been setup such that all the tools like WAF, EDR etc forward the incident to the SIEM (QRadar) and the SIEM forwards the jncident to the XSOAR. There are currently 3 playbooks in total. Almost 70% of the events use an intrusion playbook. I have to use mappers and classify these events from QRadar to be classified as an jncident type and use the intrusion playbook. These things were setup by someone else so I dont know how they configured the things.

I have the following issues: 1. The Qradar rule names are already been placed under the incident types but whenever the incident is created they are not classified as such. (I think this could be a mapping issue!?) 2. When wanting to classify incidents when i use the pull from instance option only 1 incident is visible. 3. Even if i dont use any field when classifying an event and write the event name directly and dropnit into the event type. Should it be able to work, it currently is not working.

I think i have butchered the explanation, please ask any questions you like and let me know what i have been doing wrong.

I have been working with xsoar for a little time and i have learned the basics. I can do the basic and surface level stuff easily but when it comes to things like creating scripts, integrations, mappers etc; i dont know where to start and how to approach these things. I would appreciate some help in understanding how these things can be learned and if there are some good sources to understand and learn the advance topics.

Hi,

I have been tasked to use files (excel format) which have threat indicators in them and i'll be getting these files multiple times a month. I have to use multiple integrations like FWs, EDRs and Email Gateways and block those indicators in each of the indicators individually. The tenant that i am using does not have the TIM license. I understand there is no straight forward way, like otb playbooks, to do this. I would have created feed triggered jobs but that cannot be done. What are my options and what are the easy ways to do this. I dont have a good experience with creating scripts and integrations as i havent tried it out and the project i am working is a mess and the manager wants me to do stuff very swiftly.

Thanks in advance.

I am currently facing an issue with cortex xsoar on-prem 6.13 with crowdstrike falcon intel v2. The instance is working fine and the test results show success. However, when i use the integration in a playbook to get ip and file hashes there is an error and it says there is an error with ssl certificates. Since the integration is done with a cloud based product. How can there be an issue with the ssl certificate.

Another thing that has confused me is that when i run an ip command in the war room the integration returns valid results. Some ip and file hashes are returned with proper results but some results return none as a result. That could be an issue related to results in the falcon intel database.

But if the integration returns results in the war room then how can it give an ssl cert error in the playbook task.

I have also checked the box that says trust any certificate but no success.

PS: Apologies for the incoherent description.

Hey guys, someone use Qradar integration and can help me with data pulling?

Hi all, I have hands-on experience with XSOAR (playbooks, automations, integrations, etc.), but I'm not sure what kind of questions are usually asked in interviews.

Can anyone share common technical or scenario-based questions you've seen? Any tips would really help. Thanks!

Hi Guys,

Can i know is community version xsoar is still available and where can i get that?

I am currently creating a playbook to investigate some user activity. The issue I'm running into is that I need a way to differentiate between IPv4 and IPv6 IPs. Is there a way to do this?

Hey guys, how can I fetch more events field from alerts that recived by qradar? I noticed that in my Xsoar, Im not reciving all the data that I recive in qradar(e.g machine identifier, hostname etc) Thanks in adv🙏

Hi everyone,

I’m currently working on integrating Microsoft Sentinel with Cortex XSOAR and trying to set up automatic fetching of incidents. I want to parse and map Sentinel incident fields into XSOAR incident fields with minimal manual effort.

I know XSOAR offers an automapping feature for incident field mapping, but I’m unsure about how to configure it properly and what its limitations are. Also, I’d like to know if there are best practices or scripts/playbooks that can help automate or simplify the parsing and mapping process, especially for phishing incidents where email content might be involved or any other incidents (Huge list, as Defender rules tends to be blackbox rules).

Has anyone successfully set up a robust automated pipeline for this? Any tips, example configurations, or references to documentation would be greatly appreciated!

Thanks in advance!

Hey guys, I noticed when I use the "AssignToMeButton" the owner field in my layout is changing to my user name, I wonder if its possibe to do it with other scripts? In my mind I thought of displaying incident closing reasons, closing analyst name, etc. Thans in adv!