PCSAE Questions and Answers

Main Account

Tenants

Agent tools

Marketplace

Min, Max, Count, Average, Custom Transformers

Min, Max, Count, Average, Custom Group By

Count, Average, Sum, Min, Max

Count, Sum, Min, Max, Transformers

Open a ticket with the XSOAR support team

Create a pull request directly on Github

Contribute through the XSOAR UI

Send an email to contributions@xsoar.com

The playbook assigned to the incident type

The playbook assigned to the indicator type

The playbook assigned during pre-processing

The playbook assigned by the integration

1E56733826E5035233A097FCEA2046AF96EC616C

E6EF5142E2553C1E442A0FFAC07636EAC61E6EDD

8D193FA162A305E4859BA8C45F5121F7265E3ABB

e6ef5142e2553c1e442a0ffac07636eac61e6edd

By default, every 24 hours, the system closes any debugger sessions that have been open for more than 180 minutes.

The session must be stopped during 180 minutes manually by administrator, user will receive notification automatically.

The session will be running till stopped manually by administrator.

By default, the system closes automatically any debugger session that have been open 180 minutes.

C++, Python, Powershell

Ruby, C++, Python

Javascript, Powershell, C++

Python, Powershell, Javascript

Short Text

HTML

Long Text

Markdown

Read/Write from context data

Over war room results

Input from the indicator page

Directly from a previous task

The integration’s source code

A summary of each version history

A test instance for the content pack

The source code of each playbook

${incident.sourceip}

${incident.Source_IP}

${incident.srcip}

${incident.Source IP}

To loop the sub-playbook over all context values present in the investigation

To loop the sub-playbook over all incident fields for the given incident

To loop the sub-playbook over all the fields marked as important

To loop the sub-playbook over all defined sub-playbook inputs

Run the command !GetIndicatorsByQuery in CLI with its default arguments and export all indicators in the last 90 days.

SSH into the server and copy the indicator's database.

In the Threat Intel page, add query firstSeen:>="90 days ago", select All columns in Table View, and click Export to export as a CSV.

Run the command !findIndicators in CLI with the query firstSeen:>="90 days ago" and export to CSV.

Sub-playbook

Task

Field

Incident

To track SLA breaches per playbook

To run a script that executes on SLA assignment

To automatically alert the analyst on SLA breach

To count the time between one or more tasks

10,080 minutes (7 days)

20,160 minutes (14 days)

21,600 minutes (15 days)

4,320 minutes (3 days)

Inputs are data pieces that are present in the playbook

Inputs are data pieces that are present in the task

Outputs are used as incident trigger for playbook

Outputs can be derived from the result of a task or command

Inputs are the data fields parsed by the Classifier

Mark ignore output = true

Use extend-context

Use raw-response = save

Mark ignore input = true