Skip to main content

Limitations and Known Behaviors

Use this section to understand platform constraints and behaviors for using the integration.

Limitation

The Add-Remove IOC from Allowed List and Create IOCs on Cyware Intel Exchange playbooks only support IPV4, IPV6, Domain, URL, and Email IOC types. If you provide an unsupported IOC type, the playbook adds a comment to the case noting the limitation.

Known Behaviors

  • If a playbook fails, you can debug it by running it in Simulator Mode. This helps you identify which steps or actions caused the failure. For more information, see Google SecOps Playbooks - Simulator.

  • Script timeouts may not match your configured value. For example, setting a timeout to 10 seconds might result in a ~39-second execution. This occurs because the platform adds internal overhead, which can vary across SecOps SOAR instances.