From 9a1997f89183c929be2dde9fafc0ac437c98ebd5 Mon Sep 17 00:00:00 2001 From: samuelFain <65926551+samuelFain@users.noreply.github.com> Date: Tue, 5 Nov 2024 15:40:32 +0200 Subject: [PATCH 1/4] Add EWSv2 skip_unparsable_emails parameter docs --- .../articles/EWS_V2_Troubleshooting.md | 40 ++++++++++++------- 1 file changed, 26 insertions(+), 14 deletions(-) diff --git a/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md b/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md index 9c7976a8d..4d930577a 100644 --- a/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md +++ b/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md @@ -1,6 +1,6 @@ --- id: EWS_V2_Troubleshooting -title: EWS V2 Troubleshooting +title: EWS V2 Troubleshooting description: The following provides EWS V2 troubleshooting steps to perform before contacting Cortex XSOAR customer support for help. --- @@ -16,7 +16,7 @@ The following are possible Docker issues that may occur. If you are not running - [Not Running Docker](#not-running-docker) - [How to Install Docker](#how-to-install-docker) -### Not Running Docker +### Not Running Docker To run Office 365 non-compliance search commands without running Docker, install the following python packages: - asn1crypto==0.24.0 @@ -50,7 +50,7 @@ To run Office 365 non-compliance search commands without running Docker, install -### How to Install Docker +### How to Install Docker 1. If Cortex XSOAR is installed on Red Hat (RHEL), install Docker CE on RHEL. 1. Run ***sudo yum-config-manager --enable rhel-7-server-extras-rpms***. 2. Download the following rpms: @@ -73,11 +73,18 @@ To run Office 365 non-compliance search commands without running Docker, install ## Instance Test Failed The following are common EWS V2 error messages indicating that the instance test failed. To fix the problem, perform the applicable troubleshooting steps. -- [Import error: No module named ExchangeLib](#import-error-no-module-named-exchangelib) -- [Max timeout reached](#max-timeout-reached) -- [Got unauthorized from the server](#got-unauthorized-from-the-server) -- [No such folder](#no-such-folder) -- [Got timeout from the server](#got-timeout-from-the-server) +- [Docker Issues](#docker-issues) + - [Not Running Docker](#not-running-docker) + - [How to Install Docker](#how-to-install-docker) +- [Instance Test Failed](#instance-test-failed) + - [Import error: No module named ExchangeLib](#import-error-no-module-named-exchangelib) + - [Max timeout reached](#max-timeout-reached) + - [Got unauthorized from the server](#got-unauthorized-from-the-server) + - [No such folder](#no-such-folder) + - [Got timeout from the server](#got-timeout-from-the-server) +- [Instance Test is Successful but Error Occurs](#instance-test-is-successful-but-error-occurs) +- [Problem Fetching Incidents](#problem-fetching-incidents) +- [Fetching Incidents crash due to unparsable emails](#fetching-incidents-crash-due-to-unparsable-emails) If your instance failed and none of these error messages appear, contact Cortex XSOAR customer support. @@ -93,7 +100,7 @@ If this error occurs, follow the instructions in [How to Install Docker](#how-to 5. Locate the line: *RateLimitError: Max timeout reached (gave up after X seconds. URL Y returned status code Z)* - 2. If the status code is *401*, continue. Otherwise, contact Cortex XSOAR customer support. + 2. If the status code is *401*, continue. Otherwise, contact Cortex XSOAR customer support. 2. If the status code is *401*, 1. Check the exchange server version. - For Office 365, the version should be 2016. @@ -106,9 +113,9 @@ If this error occurs, follow the instructions in [How to Install Docker](#how-to - For Office 365, the authentication method should be *Basic*. - For On-Premise Exchange Server, the authentication method should be *NTLM*. - **Note:** + **Note:** - Configure the authentication method even if SAML is being used. - - Check if Digest authentication is required. + - Check if Digest authentication is required. 4. Run the instance test again. 5. If the error still occurs, contact Cortex XSOAR customer support. @@ -148,13 +155,18 @@ The following are examples of error messages that may occur even if the instance - ***sudo yum check-update*** - ***sudo yum update*** 3. Update the Docker service and restart it. -4. In the integration settings, +4. In the integration settings, 1. Click *Reset the "last run" timestamp*. 2. Click *Reset Now*. 5. If the error still occurs, contact Cortex XSOAR customer support. +## Fetching Incidents crash due to unparsable emails +If you find that your fetch incidents command is unable to parse a specific invalid email due to various parsing issues, you can follow these steps: +1. In the instance configuration, navigate to the *Collect* section and click on *Advanced Settings*. +2. Check the box labeled *Skip unparsable emails during fetch incidents*. - - +By enabling this option, the integration can catch and skip unparsable emails without causing the fetch incidents command to crash. +When this parameter is active, a message will appear in the "Fetch History" panel of the instance whenever an unparsable email is recognized and skipped. +This allows customers to be informed that a specific email was skipped and gives them the opportunity to open a support ticket if necessary. \ No newline at end of file From c6fae85b1ecc3ffb2512e8adc07c295a9309c103 Mon Sep 17 00:00:00 2001 From: samuelFain <65926551+samuelFain@users.noreply.github.com> Date: Tue, 5 Nov 2024 15:53:03 +0200 Subject: [PATCH 2/4] Add new line --- content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md b/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md index 4d930577a..a2b9fe8f5 100644 --- a/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md +++ b/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md @@ -169,4 +169,4 @@ If you find that your fetch incidents command is unable to parse a specific inva By enabling this option, the integration can catch and skip unparsable emails without causing the fetch incidents command to crash. When this parameter is active, a message will appear in the "Fetch History" panel of the instance whenever an unparsable email is recognized and skipped. -This allows customers to be informed that a specific email was skipped and gives them the opportunity to open a support ticket if necessary. \ No newline at end of file +This allows customers to be informed that a specific email was skipped and gives them the opportunity to open a support ticket if necessary. From 175248ff3200d01fcd9f6a5099ef4c72eb1cc96b Mon Sep 17 00:00:00 2001 From: samuelFain <65926551+samuelFain@users.noreply.github.com> Date: Tue, 5 Nov 2024 15:57:31 +0200 Subject: [PATCH 3/4] Revert change to origin --- .../articles/EWS_V2_Troubleshooting.md | 40 +++++++------------ 1 file changed, 14 insertions(+), 26 deletions(-) diff --git a/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md b/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md index a2b9fe8f5..9c7976a8d 100644 --- a/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md +++ b/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md @@ -1,6 +1,6 @@ --- id: EWS_V2_Troubleshooting -title: EWS V2 Troubleshooting +title: EWS V2 Troubleshooting description: The following provides EWS V2 troubleshooting steps to perform before contacting Cortex XSOAR customer support for help. --- @@ -16,7 +16,7 @@ The following are possible Docker issues that may occur. If you are not running - [Not Running Docker](#not-running-docker) - [How to Install Docker](#how-to-install-docker) -### Not Running Docker +### Not Running Docker To run Office 365 non-compliance search commands without running Docker, install the following python packages: - asn1crypto==0.24.0 @@ -50,7 +50,7 @@ To run Office 365 non-compliance search commands without running Docker, install -### How to Install Docker +### How to Install Docker 1. If Cortex XSOAR is installed on Red Hat (RHEL), install Docker CE on RHEL. 1. Run ***sudo yum-config-manager --enable rhel-7-server-extras-rpms***. 2. Download the following rpms: @@ -73,18 +73,11 @@ To run Office 365 non-compliance search commands without running Docker, install ## Instance Test Failed The following are common EWS V2 error messages indicating that the instance test failed. To fix the problem, perform the applicable troubleshooting steps. -- [Docker Issues](#docker-issues) - - [Not Running Docker](#not-running-docker) - - [How to Install Docker](#how-to-install-docker) -- [Instance Test Failed](#instance-test-failed) - - [Import error: No module named ExchangeLib](#import-error-no-module-named-exchangelib) - - [Max timeout reached](#max-timeout-reached) - - [Got unauthorized from the server](#got-unauthorized-from-the-server) - - [No such folder](#no-such-folder) - - [Got timeout from the server](#got-timeout-from-the-server) -- [Instance Test is Successful but Error Occurs](#instance-test-is-successful-but-error-occurs) -- [Problem Fetching Incidents](#problem-fetching-incidents) -- [Fetching Incidents crash due to unparsable emails](#fetching-incidents-crash-due-to-unparsable-emails) +- [Import error: No module named ExchangeLib](#import-error-no-module-named-exchangelib) +- [Max timeout reached](#max-timeout-reached) +- [Got unauthorized from the server](#got-unauthorized-from-the-server) +- [No such folder](#no-such-folder) +- [Got timeout from the server](#got-timeout-from-the-server) If your instance failed and none of these error messages appear, contact Cortex XSOAR customer support. @@ -100,7 +93,7 @@ If this error occurs, follow the instructions in [How to Install Docker](#how-to 5. Locate the line: *RateLimitError: Max timeout reached (gave up after X seconds. URL Y returned status code Z)* - 2. If the status code is *401*, continue. Otherwise, contact Cortex XSOAR customer support. + 2. If the status code is *401*, continue. Otherwise, contact Cortex XSOAR customer support. 2. If the status code is *401*, 1. Check the exchange server version. - For Office 365, the version should be 2016. @@ -113,9 +106,9 @@ If this error occurs, follow the instructions in [How to Install Docker](#how-to - For Office 365, the authentication method should be *Basic*. - For On-Premise Exchange Server, the authentication method should be *NTLM*. - **Note:** + **Note:** - Configure the authentication method even if SAML is being used. - - Check if Digest authentication is required. + - Check if Digest authentication is required. 4. Run the instance test again. 5. If the error still occurs, contact Cortex XSOAR customer support. @@ -155,18 +148,13 @@ The following are examples of error messages that may occur even if the instance - ***sudo yum check-update*** - ***sudo yum update*** 3. Update the Docker service and restart it. -4. In the integration settings, +4. In the integration settings, 1. Click *Reset the "last run" timestamp*. 2. Click *Reset Now*. 5. If the error still occurs, contact Cortex XSOAR customer support. -## Fetching Incidents crash due to unparsable emails -If you find that your fetch incidents command is unable to parse a specific invalid email due to various parsing issues, you can follow these steps: -1. In the instance configuration, navigate to the *Collect* section and click on *Advanced Settings*. -2. Check the box labeled *Skip unparsable emails during fetch incidents*. -By enabling this option, the integration can catch and skip unparsable emails without causing the fetch incidents command to crash. -When this parameter is active, a message will appear in the "Fetch History" panel of the instance whenever an unparsable email is recognized and skipped. -This allows customers to be informed that a specific email was skipped and gives them the opportunity to open a support ticket if necessary. + + From ce8b5903edafa8b0cdfa76132878a6f9e16f2cfe Mon Sep 17 00:00:00 2001 From: samuelFain <65926551+samuelFain@users.noreply.github.com> Date: Tue, 5 Nov 2024 15:59:01 +0200 Subject: [PATCH 4/4] Return only new docs changes --- .../extra-docs/articles/EWS_V2_Troubleshooting.md | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md b/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md index 9c7976a8d..4524f5805 100644 --- a/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md +++ b/content-repo/extra-docs/articles/EWS_V2_Troubleshooting.md @@ -154,7 +154,12 @@ The following are examples of error messages that may occur even if the instance 5. If the error still occurs, contact Cortex XSOAR customer support. +## Fetching Incidents crash due to unparsable emails +If you find that your fetch incidents command is unable to parse a specific invalid email due to various parsing issues, you can follow these steps: +1. In the instance configuration, navigate to the *Collect* section and click on *Advanced Settings*. +2. Check the box labeled *Skip unparsable emails during fetch incidents*. - - +By enabling this option, the integration can catch and skip unparsable emails without causing the fetch incidents command to crash. +When this parameter is active, a message will appear in the "Fetch History" panel of the instance whenever an unparsable email is recognized and skipped. +This allows customers to be informed that a specific email was skipped and gives them the opportunity to open a support ticket if necessary.