About meshorer

meshorer

Hello, 1. Is there an option (built in or manually built) for a container to view history of the older containers with the same artifacts and details ? It can make an analyst work easier to see notes and how the older case was solved. 2. by enabling “logging” for a playbook, where opt logs are stored to access later on (beside vie debugging in the UI..) thank you in advance!

meshorer · ‎04-04-2024

thank you, is there a remediation for that issue? I mean ok I monitored and an alert was fired, now what?

meshorer · ‎04-04-2024

hello all, I noticed that timestamp in activity log is in UTC, and also while using timer app and in the event name adding "$now()" ,the timestamp is also UTC. it is not the time zone I defined in the user settings nor in the administration/company settings. is there a way to change the time zone from UTC to different time?

meshorer · ‎03-27-2024

Hi, I have an app that ingest offenses from a SIEM system (qradar). One time there were a few thousands offenses to ingest at the same time, and it caused to an error in the app ingestion. But none of the offenses were ingested for a few hours. Is there a way to alert when there is an ingestion error for an app, and maybe a way to fix it?

meshorer · ‎03-14-2024

@phanTom yeah I got confused with the escaped "{} ". you are the best!

meshorer · ‎03-14-2024

@phanTom thak you so much! could you also tell me how to add two fields in the same action?

meshorer · ‎03-14-2024

hello all! I am trying to add field to an artifact with "update artifact" action (phantom app). i am trying to add a 'message parameter' in the 'value' at the cef_json field: for example: {"new_field": {0}} but unfortunately I get "key_error" and the action failed. how can I solve it?

meshorer · ‎02-13-2024

hello all, I have an app that to perform an action I cant insert the required parameter as a list. but as a string. this is a bit issue because I am using data value from action results as the parameter to insert, for example: "my_App_action:action_result.data.*.device_id" and as far as I understand, action_result.data collection is always an array. so I can not use directly this action results returned parameter as a parameter to insert to my action. the only workaround I found is to add a code block that gets the datapath-parameter as input, and outputs the value_name[0]. is there a better workaround for this?

meshorer · ‎02-04-2024

hi @scelikok , understood, thank you. I would love to hear from you how you recommend to monitor system health. I thought of rest call "health" in a playbook to run every few minuets. if you have another idea, please do tell 🙂

meshorer · ‎02-04-2024

hi @scelikok so what happens when I reach the size limit in my server?

meshorer · ‎02-03-2024

hello all! is there a default time that events (containers/cases) are stored in the SOAR server to approach to? and if so, can I change the time? @phanTom Thank you in advance

meshorer · ‎01-21-2024

thank you for your answer, @jenniandthebets I did not want the playbook to run at at all but I see that there is no way out of it. if that is the case, why is there an option to choose tags when creating a playbook? 2. as for the datapath, I believe the filter should be [in] and not "==". anyway it did not work well for me all the time, I found that if I first create a simple code block that only gets the "container:tags" as input at outputs it as a variable, only then the filter works well. am I the only one it happens to?

meshorer · ‎01-18-2024

thank you @Carloszavala121 but I am not talking about labels, I am talking about tags. for me the labels with the “operate on” is great as I use a label called offense. but within the offense label, I categorize my offenses to tags. And there is an playbook that I want to automate to specific offenses with that tag

meshorer · ‎01-18-2024

Hello all, is there a way to automate playbook to work only on events with specific tag? I saw in playbook settings an option to choose tag but it stills run on every event thank you in advance @phanTom @SOARt_of_Lost

meshorer · ‎01-09-2024

Hi @phanTom my version is 6.1.1

meshorer · ‎01-09-2024

Hi, attached is a screen shot to show you what I mean is there a way to change the color if the text or the background in the console output? @inventsekar @phanTom

meshorer · ‎01-06-2024

Anyone? @phanTom

meshorer · ‎01-03-2024

hello, when I test actions in in app editor (view mode), the Console Output is shown with dark text over dark theme, so it makes it difficult to read the output. how can I turn the text or the theme to light? thank you in advance

meshorer · ‎12-06-2023

Hi @phanTom how can I map the output datapaths in the app's JSON file ? Is there any document link or video that can be assistance for that matter?

meshorer · ‎12-05-2023

hi, i built an app, when I run the app's action in a playbook, I dont have an option to get the data results. I used: action_result.add_data() but it didnt seem to make a difference, how can I solve it?

meshorer · ‎11-05-2023

hi, I have powershell script that does an API call to an external service. how can I use this script in phantom?

meshorer · ‎11-01-2023

@phanTom you are a genius! thank you very much

meshorer · ‎11-01-2023

Thank you, @phanTom a code block to check it and then outputs the relevant parameter did it. but now I have another problem- when I try to connect two blocks that are separated with a decision block, to the same prompt block or decision block, it doesn’t work. for one case it goes well, but for the second case the debug shows “join_ <block name> called”, but the playbook ends there. Why does it happen?

meshorer · ‎11-01-2023

Hi, during a playbook, I would like to check a parameter with a condition, and if the condition result true, I would like to use that parameter. But if the condition result is false, I would then use a different parameter. is there a way to do that without duplicating a lot of blocks?

meshorer · ‎10-30-2023

hi all, is there a way to demote a case to a container using a playbook? thank you in advance

Posts	36
Solutions	0
Karma Given	1
Karma Received	3
Member Since	‎10-23-2023

Online Status	Offline
Date Last Visited	3 weeks ago

View history of same containers

how to change timestamp in activity log from UTC?

Ingestion stuck due to overload

can't add artifact field with message parameter

get datapath variable as a string rather then a li...

for how much time events are stored in the server?

Run playbook on specific tag events

can't see results with dark theme

add data section to an app results

run powershell script as app in phantom

View history of same containers

Re: Ingestion stuck due to overload

how to change timestamp in activity log from UTC?

Ingestion stuck due to overload

Re: can't add artifact field with message paramete...

Re: can't add artifact field with message paramete...

can't add artifact field with message parameter

get datapath variable as a string rather then a li...

Re: for how much time events are stored in the ser...

Re: for how much time events are stored in the ser...

for how much time events are stored in the server?

Re: Run playbook on specific tag events

Re: Run playbook on specific tag events

Run playbook on specific tag events

Re: can't see results with dark theme

Re: can't see results with dark theme

Re: can't see results with dark theme

can't see results with dark theme

Re: add data section to an app results

add data section to an app results

run powershell script as app in phantom

Re: Change parameter dynamically In playbook

Re: Change parameter dynamically In playbook

Change parameter dynamically In playbook

demote a case during using playbook