System Diagnostics and Health Check (v3.1.7)
CS Health Check
- Author
- Cortex XSOAR Customer Success
- Support
- community
- URL
- https://live.paloaltonetworks.com/t5/cortex-xsoar-discussions/bd-p/Cortex_XSOAR_Discussions
- Categories
- Utilities
Incident fields (51)
- Health Check Actionable Items
- Health Check Auto Extraction based Incident Type
- Health Check Docker Containers
- Health Check Docker Containers Stats
- Health Check Docker Images
- Health Check Docker Paused
- Health Check Docker Running
- Health Check Docker Stop
- Health Check Docker Version
- Health Check Enabled Instances
- Health Check File System Directories
- Health Check Incidents Large Number Of Entries
- Health Check Installed Packs
- Health Check Investigations With Large Input / Output
- Health Check Large Files
- Health Check Large Investigations
- Health Check Log Since
- Health Check Log Until
- Health Check Number Of Dropped Incidents
- Health Check Number Of Engines
- Health Check Number of investigations bigger than 1MB
- Health Check Number of investigations input / output bigger than 1MB
- Health Check Panics
- Health Check Permitted Users
- Health Check Restart Count
- Health Check Risky Indexed Fields
- Health Check Top Used Playbooks
- Health Check Total Outdated Packs
- Health Check Total Packs Installed
- Health Check Used Users
- Health Check Workers Busy
- Health Check Workers Total
- XSOAR Architecture
- XSOAR Build
- XSOAR CPU
- XSOAR Content Version
- XSOAR Customer Name
- XSOAR DR
- XSOAR Dev-Prod
- XSOAR Dev-Prod Mode
- XSOAR Elastic Search
- XSOAR License
- XSOAR License Valid Till
- XSOAR Memory
- XSOAR Multi-Repo
- XSOAR Multi-Tenant
- XSOAR Number Of DB Partitions
- XSOAR OS
- XSOAR Server Configuration
- XSOAR Telemetry Status
- XSOAR Version
Layouts (2)
- System Diagnostics and Health Check
- System Diagnostics and Health Check
Scripts (32)
- HealthCheckAPIvalidation
- HealthCheckCommonIndicators
- HealthCheckExportSummaryData
- HealthCheckFields
- HealthCheckIncidentTypes
- HealthCheckIncidentsCreatedDaily
- HealthCheckIncidentsCreatedMonthly
- HealthCheckIncidentsCreatedWeekly
- HealthCheckInstalledPacks
- HealthCheckIntegrations
- HealthCheckNumberOfDroppedIncidents
- HealthCheckNumberOfEngines
- HealthCheckOutdatedPacks
- HealthCheckPacksInstalled
- HealthCheckPlaybookAnalysis
- HealthCheckServerConfiguration
- getAutomationsCount
- getContentPackStatus
- getCustomAutomations
- getCustomPlaybooks
- getDeprecatedAutomations
- getDeprecatedIntegrations
- getDeprecatedPlaybooks
- getDetachedAutomations
- getDetachedPlaybooks
- getDiskSpaceStatus
- getDockerContainersCount
- getInvHealthStatus
- getPlaybooksCount
- getPlaybooksHealthStatus
- getSystemHealthStatus
- getWorkersCount
README
The XSOAR Health Check pack automatically reviewing the current server and content for issues and best practices.
The pack goal is to identify potential issues and remediate them before they become a real issue.
The resulting layout tabs will provide the current system status and system diagnostics to identify issues to resolve.
The actionable items report will contain recommendations based on errors found or best practices.
Prerequisites
Single Server Deployment
- Configure “Core REST API” Integration Instance with Admin user
Multi-Tenants Deployment
- Create API Key on Main Tenant
- Create Core REST API integration on Main Tenant and use the API Key you created in previous step.
On instance settings define in URL field https://127.0.0.1
make sure not to set the tenant name in the URL. - Propogate Core REST API instance to All tenants or to the required tenant using propogation labels.
How to:
- Create new manual Incident
- pick System Diagnostics and Health Check incident type and create new incident.
- Once the playbook is completed, the incident layout will contain the collected data and some improvement suggestions.