-
Notifications
You must be signed in to change notification settings - Fork 1.6k
/
CortexXDRIR.yml
3487 lines (3484 loc) · 146 KB
/
CortexXDRIR.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
694
695
696
697
698
699
700
701
702
703
704
705
706
707
708
709
710
711
712
713
714
715
716
717
718
719
720
721
722
723
724
725
726
727
728
729
730
731
732
733
734
735
736
737
738
739
740
741
742
743
744
745
746
747
748
749
750
751
752
753
754
755
756
757
758
759
760
761
762
763
764
765
766
767
768
769
770
771
772
773
774
775
776
777
778
779
780
781
782
783
784
785
786
787
788
789
790
791
792
793
794
795
796
797
798
799
800
801
802
803
804
805
806
807
808
809
810
811
812
813
814
815
816
817
818
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
837
838
839
840
841
842
843
844
845
846
847
848
849
850
851
852
853
854
855
856
857
858
859
860
861
862
863
864
865
866
867
868
869
870
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
887
888
889
890
891
892
893
894
895
896
897
898
899
900
901
902
903
904
905
906
907
908
909
910
911
912
913
914
915
916
917
918
919
920
921
922
923
924
925
926
927
928
929
930
931
932
933
934
935
936
937
938
939
940
941
942
943
944
945
946
947
948
949
950
951
952
953
954
955
956
957
958
959
960
961
962
963
964
965
966
967
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
983
984
985
986
987
988
989
990
991
992
993
994
995
996
997
998
999
1000
category: Endpoint
sectionorder:
- Connect
- Collect
commonfields:
id: Cortex XDR - IR
version: -1
configuration:
- display: Fetch incidents
name: isFetch
defaultvalue: 'true'
type: 8
section: Collect
required: false
- display: Incident type
name: incidentType
type: 13
section: Connect
required: false
- defaultvalue: 'false'
display: Remove legacy incident fields
name: dont_format_sublists
type: 8
section: Collect
required: false
additionalinfo: Unchecked for backwards compatibility, recommended to check. This will remove duplicated incident fields under file_artifacts, network_artifacts, and alerts (like client_id, clientid.)
- display: Incident Mirroring Direction
name: mirror_direction
required: false
type: 15
section: Collect
defaultvalue: None
options:
- None
- Incoming
- Outgoing
- Both
- name: url
type: 0
display: 'Server URL (copy URL from XDR)'
section: Connect
required: true
- displaypassword: API Key ID
name: apikey_id_creds
type: 9
hiddenusername: true
display: ''
section: Connect
required: false
- display: ''
name: apikey_creds
type: 9
section: Connect
required: false
displaypassword: API Key
hiddenusername: true
- display: API Key ID
name: apikey_id
type: 4
hidden: true
section: Connect
required: false
- display: API Key
name: apikey
type: 4
section: Connect
required: false
hidden: true
- additionalinfo: The timeout of the HTTP requests sent to Cortex XDR API (in seconds).
defaultvalue: '120'
display: HTTP Timeout
name: timeout
type: 0
section: Connect
required: false
advanced: true
- display: Maximum number of incidents per fetch
name: max_fetch
type: 0
section: Collect
required: false
additionalinfo: The maximum number of incidents per fetch. Cannot exceed 100.
defaultvalue: '10'
- display: Only fetch starred incidents
name: starred
type: 8
section: Collect
advanced: true
required: false
- defaultvalue: 3 days
display: Starred incidents fetch window
name: starred_incidents_fetch_window
type: 0
section: Collect
required: false
additionalinfo: Starred fetch window timestamp (<number> <time unit>, e.g., 12 hours, 7 days). Fetches only starred incidents within the specified time range.
advanced: true
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
name: fetch_time
type: 0
section: Collect
required: false
defaultvalue: 3 days
- display: Sync Incident Owners
name: sync_owners
type: 8
section: Collect
advanced: true
required: false
additionalinfo: For Cortex XSOAR version 6.0.0 and above. If selected, for every incident fetched from Cortex XDR to Cortex XSOAR, the incident owners will be synced. Note that once this value is changed and synchronized between the systems, additional changes will not be reflected. For example, if you change the owner in Cortex XSOAR, the new owner will also be changed in Cortex XDR. However, if you now change the owner back in Cortex XDR, this additional change will not be reflected in Cortex XSOAR. In addition, for this change to be reflected, the owners must exist in both Cortex XSOAR and Cortex XDR.
- display: Trust any certificate (not secure)
name: insecure
type: 8
section: Connect
advanced: true
required: false
- display: Use system proxy settings
name: proxy
type: 8
section: Connect
advanced: true
required: false
- additionalinfo: 'Whether the XDR tenant Mode is prevent only'
display: Prevent Only Mode
name: prevent_only
type: 8
section: Connect
advanced: true
required: false
- additionalinfo: 'The statuses of the incidents that will be fetched. If no status is provided then incidents of all the statuses will be fetched. Note: An incident whose status was changed to a filtered status after its creation time will not be fetched.'
display: Incident Statuses to Fetch
name: status
options:
- new
- under_investigation
- resolved_known_issue
- resolved_false_positive
- resolved_true_positive
- resolved_security_testing
- resolved_other
- resolved_auto
type: 16
section: Collect
advanced: true
required: false
description: Cortex XDR is the world's first detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks.
display: Palo Alto Networks Cortex XDR - Investigation and Response
name: Cortex XDR - IR
script:
commands:
- arguments:
- description: A date in the format 2019-12-31T23:59:00. Only incidents that were created on or before the specified date/time will be retrieved.
name: lte_creation_time
- description: A date in the format 2019-12-31T23:59:00. Only incidents that were created on or after the specified date/time will be retrieved.
name: gte_creation_time
- description: Filters returned incidents that were created on or before the specified date/time, in the format 2019-12-31T23:59:00.
name: lte_modification_time
- description: Filters returned incidents that were modified on or after the specified date/time, in the format 2019-12-31T23:59:00.
name: gte_modification_time
- description: An array or CSV string of incident IDs.
isArray: true
name: incident_id_list
- description: Filters returned incidents that were created on or after the specified date/time range, for example, 1 month, 2 days, 1 hour, and so on.
name: since_creation_time
- description: Filters returned incidents that were modified on or after the specified date/time range, for example, 1 month, 2 days, 1 hour, and so on.
name: since_modification_time
- auto: PREDEFINED
description: Sorts returned incidents by the date/time that the incident was last modified ("asc" - ascending, "desc" - descending).
name: sort_by_modification_time
predefined:
- asc
- desc
- auto: PREDEFINED
description: Sorts returned incidents by the date/time that the incident was created ("asc" - ascending, "desc" - descending).
name: sort_by_creation_time
predefined:
- asc
- desc
- defaultValue: '0'
description: Page number (for pagination). The default is 0 (the first page).
name: page
- defaultValue: '100'
description: Maximum number of incidents to return per page. The default and maximum is 100.
name: limit
- description: 'Filters only incidents in the specified status. The options are: new, under_investigation, resolved_known_issue, resolved_false_positive, resolved_true_positive resolved_security_testing, resolved_other, resolved_auto.'
name: status
- auto: PREDEFINED
description: 'Whether the incident is starred (Boolean value: true or false).'
name: starred
predefined:
- 'true'
- 'false'
- description: Starred fetch window timestamp (<number> <time unit>, e.g., 12 hours, 7 days).
defaultValue: 3 days
name: starred_incidents_fetch_window
description: |-
Returns a list of incidents, which you can filter by a list of incident IDs (max. 100), the time the incident was last modified, and the time the incident was created.
If you pass multiple filtering arguments, they will be concatenated using the AND condition. The OR condition is not supported.
name: xdr-get-incidents
outputs:
- contextPath: PaloAltoNetworksXDR.Incident.incident_id
description: Unique ID assigned to each returned incident.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.manual_severity
description: Incident severity assigned by the user. This does not affect the calculated severity. Can be "low", "medium", "high".
type: String
- contextPath: PaloAltoNetworksXDR.Incident.manual_description
description: Incident description provided by the user.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.assigned_user_mail
description: Email address of the assigned user.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.high_severity_alert_count
description: Number of alerts with the severity HIGH.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.host_count
description: Number of hosts involved in the incident.
type: number
- contextPath: PaloAltoNetworksXDR.Incident.xdr_url
description: A link to the incident view on Cortex XDR.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.assigned_user_pretty_name
description: Full name of the user assigned to the incident.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alert_count
description: Total number of alerts in the incident.
type: number
- contextPath: PaloAltoNetworksXDR.Incident.med_severity_alert_count
description: Number of alerts with the severity MEDIUM.
type: number
- contextPath: PaloAltoNetworksXDR.Incident.user_count
description: Number of users involved in the incident.
type: number
- contextPath: PaloAltoNetworksXDR.Incident.severity
description: |-
Calculated severity of the incident. Valid values are:
"low","medium","high".
type: String
- contextPath: PaloAltoNetworksXDR.Incident.low_severity_alert_count
description: Number of alerts with the severity LOW.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.status
description: |
Current status of the incident. Valid values are: "new","under_investigation","resolved_known_issue","resolved_duplicate","resolved_false_positive","resolved_true_positive","resolved_security_testing" or "resolved_other".
type: String
- contextPath: PaloAltoNetworksXDR.Incident.description
description: Dynamic calculated description of the incident.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.resolve_comment
description: Comments entered by the user when the incident was resolved.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.notes
description: Comments entered by the user regarding the incident.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.creation_time
description: Date and time the incident was created on Cortex XDR.
type: date
- contextPath: PaloAltoNetworksXDR.Incident.detection_time
description: Date and time that the first alert occurred in the incident.
type: date
- contextPath: PaloAltoNetworksXDR.Incident.modification_time
description: Date and time that the incident was last modified.
type: date
- arguments:
- description: The ID of the incident for which to get additional data.
name: incident_id
required: true
- defaultValue: '1000'
description: Maximum number of alerts to return.
name: alerts_limit
- defaultValue: 'False'
description: Return data only if the incident was changed since the last time it was mirrored into Cortex XSOAR. This flag should be used only from within a Cortex XDR incident.
name: return_only_updated_incident
description: Returns additional data for the specified incident, for example, related alerts, file artifacts, network artifacts, and so on.
name: xdr-get-incident-extra-data
outputs:
- contextPath: PaloAltoNetworksXDR.Incident.incident_id
description: Unique ID assigned to each returned incident.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.creation_time
description: Date and time the incident was created on Cortex XDR.
type: Date
- contextPath: PaloAltoNetworksXDR.Incident.modification_time
description: Date and time that the incident was last modified.
type: Date
- contextPath: PaloAltoNetworksXDR.Incident.detection_time
description: Date and time that the first alert occurred in the incident.
type: Date
- contextPath: PaloAltoNetworksXDR.Incident.status
description: |-
Current status of the incident. Valid values are:
"new","under_investigation","resolved_known_issue","resolved_duplicate","resolved_false_positive","resolved_true_positive","resolved_security_testing","resolved_other".
type: String
- contextPath: PaloAltoNetworksXDR.Incident.severity
description: 'Calculated severity of the incident. Valid values are: "low","medium","high".'
type: String
- contextPath: PaloAltoNetworksXDR.Incident.description
description: Dynamic calculated description of the incident.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.assigned_user_mail
description: Email address of the assigned user.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.assigned_user_pretty_name
description: Full name of the user assigned to the incident.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alert_count
description: Total number of alerts in the incident.
type: Number
- contextPath: PaloAltoNetworksXDR.Incident.low_severity_alert_count
description: Number of alerts with the severity LOW.
type: Number
- contextPath: PaloAltoNetworksXDR.Incident.med_severity_alert_count
description: Number of alerts with the severity MEDIUM.
type: Number
- contextPath: PaloAltoNetworksXDR.Incident.high_severity_alert_count
description: Number of alerts with the severity HIGH.
type: Number
- contextPath: PaloAltoNetworksXDR.Incident.user_count
description: Number of users involved in the incident.
type: Number
- contextPath: PaloAltoNetworksXDR.Incident.host_count
description: Number of hosts involved in the incident.
type: Number
- contextPath: PaloAltoNetworksXDR.Incident.notes
description: Comments entered by the user regarding the incident.
type: Unknown
- contextPath: PaloAltoNetworksXDR.Incident.resolve_comment
description: Comments entered by the user when the incident was resolved.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.manual_severity
description: Incident severity assigned by the user. This does not affect the calculated severity of low, medium, or high.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.manual_description
description: Incident description provided by the user.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.xdr_url
description: A link to the incident view on Cortex XDR.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.starred
description: Incident starred.
type: Boolean
- contextPath: PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_techniques_ids_and_names
description: Incident Mitre techniques IDs and names.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_tactics_ids_and_names
description: Incident Mitre tactics ids and names.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.alert_id
description: Unique ID for each alert.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.detection_timestamp
description: Date and time that the alert occurred.
type: Date
- contextPath: PaloAltoNetworksXDR.Incident.alerts.source
description: Source of the alert. The product/vendor this alert came from.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.severity
description: 'Severity of the alert.Valid values are: "low","medium","high""".'
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.name
description: Calculated name of the alert.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.category
description: Category of the alert, for example, Spyware Detected via Anti-Spyware profile.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.description
description: Textual description of the alert.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.host_ip_list
description: Host IP involved in the alert.
type: Unknown
- contextPath: PaloAltoNetworksXDR.Incident.alerts.host_name
description: Host name involved in the alert.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.user_name
description: User name involved with the alert.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.event_type
description: 'Event type. Valid values are: "Process Execution","Network Event","File Event","Registry Event","Injection Event","Load Image Event","Windows Event Log".'
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action
description: 'The action that triggered the alert. Valid values are: "REPORTED", "BLOCKED", "POST_DETECTED", "SCANNED", "DOWNLOAD", "PROMPT_ALLOW", "PROMPT_BLOCK", "DETECTED", "BLOCKED_1", "BLOCKED_2", "BLOCKED_3", "BLOCKED_5", "BLOCKED_6", "BLOCKED_7", "BLOCKED_8", "BLOCKED_9", "BLOCKED_10", "BLOCKED_11", "BLOCKED_13", "BLOCKED_14", "BLOCKED_15", "BLOCKED_16", "BLOCKED_17", "BLOCKED_24", "BLOCKED_25", "DETECTED_0", "DETECTED_4", "DETECTED_18", "DETECTED_19", "DETECTED_20", "DETECTED_21", "DETECTED_22", "DETECTED_23".'
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_pretty
description: 'The action that triggered the alert. Valid values are: "Detected (Reported)" "Prevented (Blocked)" "Detected (Post Detected)" "Detected (Scanned)" "Detected (Download)" "Detected (Prompt Allow)" "Prevented (Prompt Block)" "Detected" "Prevented (Denied The Session)" "Prevented (Dropped The Session)" "Prevented (Dropped The Session And Sent a TCP Reset)" "Prevented (Blocked The URL)" "Prevented (Blocked The IP)" "Prevented (Dropped The Packet)" "Prevented (Dropped All Packets)" "Prevented (Terminated The Session And Sent a TCP Reset To Both Sides Of The Connection)" "Prevented (Terminated The Session And Sent a TCP Reset To The Client)" "Prevented (Terminated The Session And Sent a TCP Reset To The Server)" "Prevented (Continue)" "Prevented (Block-Override)" "Prevented (Override-Lockout)" "Prevented (Override)" "Prevented (Random-Drop)" "Prevented (Silently Dropped The Session With An ICMP Unreachable Message To The Host Or Application)" "Prevented (Block)" "Detected (Allowed The Session)" "Detected (Raised An Alert)" "Detected (Syncookie Sent)" "Detected (Forward)" "Detected (Wildfire Upload Success)" "Detected (Wildfire Upload Failure)" "Detected (Wildfire Upload Skip)" "Detected (Sinkhole)".'
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_name
description: Image name.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_command_line
description: Command line.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_status
description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_vendor
description: Signature vendor name.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_image_name
description: Image name.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_line
description: Command line.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_status
description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_vendor
description: Signature vendor.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_causality_id
description: Causality ID.
type: Unknown
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_name
description: Image name.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_command_line
description: Command line.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_sha256
description: Image SHA256.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_signature_status
description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_signature_vendor
description: Signature vendor name.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_path
description: File path.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_md5
description: File MD5.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_sha256
description: File SHA256.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_registry_data
description: Registry data.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_registry_full_key
description: Registry full key.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_local_ip
description: Local IP.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_local_port
description: Local port.
type: Number
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_remote_ip
description: Remote IP.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_remote_port
description: Remote port.
type: Number
- contextPath: PaloAltoNetworksXDR.Incident.alerts.action_external_hostname
description: External hostname.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.fw_app_id
description: Firewall app id.
type: Unknown
- contextPath: PaloAltoNetworksXDR.Incident.alerts.is_whitelisted
description: 'Is the alert on allow list. Valid values are: "Yes" "No".'
type: String
- contextPath: PaloAltoNetworksXDR.Incident.alerts.starred
description: Alert starred.
type: Boolean
- contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.type
description: Network artifact type.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_port
description: The remote port related to the artifact.
type: number
- contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.alert_count
description: Number of alerts related to the artifact.
type: number
- contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_ip
description: The remote IP related to the artifact.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.is_manual
description: Whether the artifact was created by the user (manually).
type: boolean
- contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_domain
description: The domain related to the artifact.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.type
description: 'The artifact type. Valid values are: "META", "GID", "CID", "HASH", "IP", "DOMAIN", "REGISTRY", "HOSTNAME".'
type: String
- contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_country
description: The country related to the artifact.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_status
description: 'Digital signature status of the file. Valid values are: "SIGNATURE_UNAVAILABLE" "SIGNATURE_SIGNED" "SIGNATURE_INVALID" "SIGNATURE_UNSIGNED" "SIGNATURE_WEAK_HASH".'
type: String
- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_process
description: Whether the file artifact is related to a process execution.
type: boolean
- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_name
description: Name of the file.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_wildfire_verdict
description: 'The file verdict, calculated by Wildfire. Valid values are: "BENIGN" "MALWARE" "GRAYWARE" "PHISHING" "UNKNOWN".'
type: String
- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.alert_count
description: Number of alerts related to the artifact.
type: number
- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_malicious
description: Whether the artifact is malicious, as decided by the Wildfire verdict.
type: boolean
- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_manual
description: Whether the artifact was created by the user (manually).
type: boolean
- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.type
description: 'The artifact type. Valid values are: "META" "GID" "CID" "HASH" "IP" "DOMAIN" "REGISTRY" "HOSTNAME".'
type: String
- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256
description: SHA256 hash of the file.
type: String
- contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_vendor_name
description: File signature vendor name.
type: String
- contextPath: Account.Username
description: The username in the relevant system.
type: String
- contextPath: Endpoint.Hostname
description: The hostname that is mapped to this endpoint.
type: String
- contextPath: Endpoint.ID
description: The agent ID of the endpoint.
type: String
- contextPath: File.Path
description: The path where the file is located.
type: String
- contextPath: File.MD5
description: The MD5 hash of the file.
type: String
- contextPath: File.SHA256
description: The SHA256 hash of the file.
type: String
- contextPath: File.Name
description: The full file name (including file extension).
type: String
- contextPath: Process.Name
description: The name of the process.
type: String
- contextPath: Process.MD5
description: The MD5 hash of the process.
type: String
- contextPath: Process.SHA256
description: The SHA256 hash of the process.
type: String
- contextPath: Process.PID
description: The PID of the process.
type: String
- contextPath: Process.Path
description: The file system path to the binary file.
type: String
- contextPath: Process.Start Time
description: The timestamp of the process start time.
type: String
- contextPath: Process.CommandLine
description: The full command line (including arguments).
type: String
- contextPath: IP.Address
description: IP address.
type: String
- contextPath: IP.Geo.Country
description: The country in which the IP address is located.
type: String
- contextPath: Domain.Name
description: 'The domain name, for example: "google.com".'
type: String
- arguments:
- description: XDR incident ID. You can get the incident ID from the output of the 'xdr-get-incidents' command or the 'xdr-get-incident-extra-details' command.
name: incident_id
required: true
- auto: PREDEFINED
description: Severity to assign to the incident (LOW, MEDIUM, or HIGH).
name: manual_severity
predefined:
- HIGH
- MEDIUM
- LOW
- description: Email address of the user to assign to the incident.
name: assigned_user_mail
- description: Full name of the user assigned to the incident.
name: assigned_user_pretty_name
- auto: PREDEFINED
description: 'Status of the incident. Valid values are: NEW, UNDER_INVESTIGATION, RESOLVED_KNOWN_ISSUE, RESOLVED_DUPLICATE, RESOLVED_FALSE_POSITIVE, RESOLVED_TRUE_POSITIVE, RESOLVED_SECURITY_TESTING, RESOLVED_OTHER.'
name: status
predefined:
- NEW
- UNDER_INVESTIGATION
- RESOLVED_KNOWN_ISSUE
- RESOLVED_DUPLICATE
- RESOLVED_FALSE_POSITIVE
- RESOLVED_TRUE_POSITIVE
- RESOLVED_SECURITY_TESTING
- RESOLVED_OTHER
- description: Comment explaining why the incident was resolved. This should be set when the incident is resolved.
name: resolve_comment
- auto: PREDEFINED
description: If true, will remove all assigned users from the incident.
name: unassign_user
predefined:
- 'true'
- description: Add a comment to the incident.
name: add_comment
description: Updates one or more fields of a specified incident. Missing fields will be ignored. To remove the assignment for an incident, pass a null value in the assignee email argument.
name: xdr-update-incident
- arguments:
- description: String value that defines the product.
name: product
required: true
- description: String value that defines the vendor.
name: vendor
required: true
- description: String value for the source IP address.
name: local_ip
- description: Integer value for the source port.
name: local_port
required: true
- description: |-
String value of the destination IP
address.
name: remote_ip
required: true
- description: |-
Integer value for the destination
port.
name: remote_port
required: true
- description: Integer value representing the time the alert occurred in milliseconds, or a string value in date format 2019-10-23T10:00:00. If not set, the event time will be defined as now.
name: event_timestamp
- auto: PREDEFINED
defaultValue: Medium
description: |-
String value of alert severity. Valid values are:
Informational, Low, Medium or High.
name: severity
predefined:
- Informational
- Low
- Medium
- High
- description: String defining the alert name.
name: alert_name
required: true
- description: String defining the alert description.
name: alert_description
description: |-
Uploads an alert from external alert sources in Cortex XDR format. Cortex XDR displays alerts that are parsed
successfully in related incidents and views. You can send 600 alerts per minute. Each request can contain a
maximum of 60 alerts.
name: xdr-insert-parsed-alert
- arguments:
- description: List of alerts in CEF format.
isArray: true
name: cef_alerts
required: true
description: Upload alerts in CEF format from external alert sources. After you map CEF alert fields to Cortex XDR fields, Cortex XDR displays the alerts in related incidents and views. You can send 600 requests per minute. Each request can contain a maximum of 60 alerts.
name: xdr-insert-cef-alerts
- arguments:
- description: Allows linking the response action to the incident that triggered it.
name: incident_id
- description: The endpoint ID (string) to isolate. You can retrieve the string from the xdr-get-endpoints command.
name: endpoint_id
required: true
- auto: PREDEFINED
defaultValue: 'false'
description: Whether to suppress an error when trying to isolate a disconnected endpoint. When sets to false, an error will be returned.
name: suppress_disconnected_endpoint_error
predefined:
- 'true'
- 'false'
- description: Interval in seconds between each poll.
name: interval_in_seconds
- description: Polling timeout in seconds.
name: timeout_in_seconds
- description: For polling use.
isArray: true
name: action_id
deprecated: true
description: Isolates the specified endpoint.
execution: true
name: xdr-endpoint-isolate
outputs:
- contextPath: PaloAltoNetworksXDR.Isolation.endpoint_id
description: The endpoint ID.
type: String
polling: true
- arguments:
- description: Allows linking the response action to the incident that triggered it.
name: incident_id
- description: The endpoint ID (string) to isolate. You can retrieve the string from the xdr-get-endpoints command.
name: endpoint_id
required: true
- auto: PREDEFINED
defaultValue: 'false'
description: Whether to suppress an error when trying to isolate a disconnected endpoint. When sets to false, an error will be returned.
name: suppress_disconnected_endpoint_error
predefined:
- 'true'
- 'false'
deprecated: true
description: Deprecated. Use `xdr-endpoint-isolate` instead.
execution: true
name: xdr-isolate-endpoint
outputs:
- contextPath: PaloAltoNetworksXDR.Isolation.endpoint_id
description: The endpoint ID.
type: String
- arguments:
- description: Allows linking the response action to the incident that triggered it.
name: incident_id
- description: The endpoint ID (string) for which to reverse the isolation. You can retrieve it from the xdr-get-endpoints command.
name: endpoint_id
required: true
- description: |-
Whether to suppress an error when trying to unisolate a disconnected endpoint. When sets to false, an error will be returned.
name: suppress_disconnected_endpoint_error
auto: PREDEFINED
defaultValue: 'false'
predefined:
- 'true'
- 'false'
- description: |-
Interval in seconds between each poll.
name: interval_in_seconds
- description: Polling timeout in seconds.
name: timeout_in_seconds
- description: |-
For polling use.
isArray: true
name: action_id
deprecated: true
description: Reverses the isolation of an endpoint.
execution: true
name: xdr-endpoint-unisolate
outputs:
- contextPath: PaloAltoNetworksXDR.UnIsolation.endpoint_id
description: Isolates the specified endpoint.
type: String
polling: true
- deprecated: true
description: Deprecated. Use `xdr-endpoint-unisolate` instead.
execution: true
name: xdr-unisolate-endpoint
outputs:
- contextPath: PaloAltoNetworksXDR.UnIsolation.endpoint_id
description: Isolates the specified endpoint.
type: String
arguments:
- description: Allows linking the response action to the incident that triggered it.
name: incident_id
- description: The endpoint ID (string) for which to reverse the isolation. You can retrieve it from the xdr-get-endpoints command.
name: endpoint_id
required: true
- auto: PREDEFINED
defaultValue: 'false'
description: Whether to suppress an error when trying to unisolate a disconnected endpoint. When sets to false, an error will be returned.
name: suppress_disconnected_endpoint_error
predefined:
- 'true'
- 'false'
- arguments:
- description: 'A comma-separated list of endpoints statuses to filter. Valid values are: connected, disconnected, lost, uninstalled, windows, linux, macos, android, isolated, unisolated.'
name: status
isArray: true
- description: A comma-separated list of endpoint IDs.
isArray: true
name: endpoint_id_list
- description: |-
A comma-separated list of distribution package names or installation package names.
Example: dist_name1,dist_name2.
isArray: true
name: dist_name
- description: |-
A comma-separated list of private IP addresses.
Example: 10.1.1.1,192.168.1.1.
isArray: true
name: ip_list
- description: |-
A comma-separated list of public IP addresses that correlate to the last IPv4 address from which the XDR agent connected (know as `Last Origin IP`).
Example: 8.8.8.8,1.1.1.1.
isArray: true
name: public_ip_list
- description: |-
The group name to which the agent belongs.
Example: group_name1,group_name2.
isArray: true
name: group_name
- description: 'The endpoint platform. Valid values are\: "windows", "linux", "macos", or "android". '
isArray: true
name: platform
auto: PREDEFINED
predefined:
- windows
- linux
- macos
- android
- description: |-
A comma-separated list of alias names.
Examples: alias_name1,alias_name2.
name: alias_name
isArray: true
- description: |-
Specifies whether the endpoint was isolated or unisolated.
name: isolate
auto: PREDEFINED
predefined:
- isolated
- unisolated
- description: |-
Hostname
Example: hostname1,hostname2.
name: hostname
isArray: true
- description: |-
All the agents that were first seen after {first_seen_gte}.
Supported values:
1579039377301 (time in milliseconds)
"3 days" (relative date)
"2019-10-21T23:45:00" (date).
name: first_seen_gte
- description: |-
All the agents that were first seen before {first_seen_lte}.
Supported values:
1579039377301 (time in milliseconds)
"3 days" (relative date)
"2019-10-21T23:45:00" (date).
name: first_seen_lte
- description: |-
All the agents that were last seen before {last_seen_gte}.
Supported values:
1579039377301 (time in milliseconds)
"3 days" (relative date)
"2019-10-21T23:45:00" (date).
name: last_seen_gte
- description: |-
All the agents that were last seen before {last_seen_lte}.
Supported values:
1579039377301 (time in milliseconds)
"3 days" (relative date)
"2019-10-21T23:45:00" (date).
name: last_seen_lte
- defaultValue: '0'
description: Page number (for pagination). The default is 0 (the first page).
name: page
- description: Maximum number of endpoints to return per page. The default and maximum is 30.
name: limit
defaultValue: '30'
- auto: PREDEFINED
description: Specifies whether to sort endpoints by the first time or last time they were seen. Can be "first_seen" or "last_seen".
name: sort_by
predefined:
- first_seen
- last_seen
- name: sort_order
description: The order by which to sort results. Can be "asc" (ascending) or "desc" ( descending). Default set to asc.
auto: PREDEFINED
defaultValue: asc
predefined:
- asc
- desc
- name: username
description: The usernames to query for, accepts a single user, or comma-separated list of usernames.
isArray: true
description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0).
name: xdr-get-endpoints
outputs:
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_id
description: The endpoint ID.
type: String
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_name
description: The endpoint name.
type: String
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_type
description: The endpoint type.
type: String
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_status
description: The status of the endpoint.
type: String
- contextPath: PaloAltoNetworksXDR.Endpoint.os_type
description: The endpoint OS type.
type: String
- contextPath: PaloAltoNetworksXDR.Endpoint.ip
description: A list of IP addresses.
type: Unknown
- contextPath: PaloAltoNetworksXDR.Endpoint.users
description: A list of users.
type: Unknown
- contextPath: PaloAltoNetworksXDR.Endpoint.domain
description: The endpoint domain.
type: String
- contextPath: PaloAltoNetworksXDR.Endpoint.alias
description: The endpoint's aliases.
type: String
- contextPath: PaloAltoNetworksXDR.Endpoint.first_seen
description: First seen date/time in Epoch (milliseconds).
type: Unknown
- contextPath: PaloAltoNetworksXDR.Endpoint.last_seen
description: Last seen date/time in Epoch (milliseconds).
type: Date
- contextPath: PaloAltoNetworksXDR.Endpoint.content_version
description: Content version.
type: String
- contextPath: PaloAltoNetworksXDR.Endpoint.installation_package
description: Installation package.
type: String
- contextPath: PaloAltoNetworksXDR.Endpoint.active_directory
description: Active directory.
type: String
- contextPath: PaloAltoNetworksXDR.Endpoint.install_date
description: Install date in Epoch (milliseconds).
type: Date
- contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_version
description: Endpoint version.
type: String
- contextPath: PaloAltoNetworksXDR.Endpoint.is_isolated
description: Whether the endpoint is isolated.
type: String
- contextPath: PaloAltoNetworksXDR.Endpoint.group_name
description: The name of the group to which the endpoint belongs.
type: String
- contextPath: PaloAltoNetworksXDR.Endpoint.count
description: Number of endpoints returned.
type: String
- contextPath: Endpoint.Hostname
description: The hostname that is mapped to this endpoint.
type: String
- contextPath: Endpoint.ID
description: The unique ID within the tool retrieving the endpoint.
type: String
- contextPath: Endpoint.IPAddress
description: The IP address of the endpoint.
type: String
- contextPath: Endpoint.Domain
description: The domain of the endpoint.
type: String
- contextPath: Endpoint.OS
description: The endpoint's operation system.
type: String
- contextPath: Account.Username
description: The username in the relevant system.
type: String
- contextPath: Account.Domain
description: The domain of the account.
type: String
- contextPath: Endpoint.Status
description: The endpoint's status.
type: String
- contextPath: Endpoint.IsIsolated
description: The endpoint's isolation status.
type: String
- contextPath: Endpoint.MACAddress
description: The endpoint's MAC address.
type: String
- contextPath: Endpoint.Vendor
description: The integration name of the endpoint vendor.
type: String
- arguments:
- description: The status of the endpoint to use as a filter.
name: status
auto: PREDEFINED
predefined:
- connected
- disconnected
- description: A comma-separated list of endpoint IDs to use as a filter.
isArray: true
name: endpoint_id_list
- description: |-
A comma-separated list of distribution package names or installation package names to use as a filter.
Example: dist_name1,dist_name2.
isArray: true
name: dist_name
- description: |-
A comma-separated list of IP addresses to use as a filter.
Example: 8.8.8.8,1.1.1.1.
isArray: true
name: ip_list
- description: A comma-separated list of group names to which the agent belongs to use as a filter.
isArray: true
name: group_name
- description: The endpoint platform to use as a filter.
isArray: true
name: platform
auto: PREDEFINED
predefined:
- windows
- linux
- macos
- android
- description: |-
A comma-separated list of alias names to use as a filter.
Examples: alias_name1,alias_name2.
isArray: true
name: alias_name
- auto: PREDEFINED
description: Specifies whether the endpoint was isolated or unisolated to use as a filter.