Skip to main content

Palo Alto Networks Cortex XDR - Investigation and Response

This Integration is part of the Palo Alto Networks Cortex XDR - Investigation and Response Pack.#

Cortex XDR is the world's first detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks. This integration was integrated and tested with version 2.6.5 of Cortex XDR - IR

Configure Palo Alto Networks Cortex XDR - Investigation and Response on Cortex XSOAR#

  1. Navigate to Settings > Integrations > Servers & Services.

  2. Search for Palo Alto Networks Cortex XDR - Investigation and Response.

  3. Click Add instance to create and configure a new integration instance.

    ParameterDescriptionRequired
    Fetch incidentsFalse
    Incident typeFalse
    Incident Mirroring DirectionFalse
    Server URL (copy URL from XDR - click ? to see more info.)True
    API Key IDTrue
    API KeyTrue
    Only fetch starred incidentsFalse
    Starred incidents fetch window (<number> <time unit>, e.g., 12 hours, 7 days)False
    HTTP TimeoutThe timeout of the HTTP requests sent to Cortex XDR API (in seconds).False
    Maximum number of incidents per fetchThe maximum number of incidents per fetch. Cannot exceed 100.False
    First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)False
    Sync Incident OwnersFor Cortex XSOAR version 6.0.0 and above. If selected, for every incident fetched from Cortex XDR to Cortex XSOAR, the incident owners will be synced. Note that once this value is changed and synchronized between the systems, additional changes will not be reflected. For example, if you change the owner in Cortex XSOAR, the new owner will also be changed in Cortex XDR. However, if you now change the owner back in Cortex XDR, this additional change will not be reflected in Cortex XSOAR. In addition, for this change to be reflected, the owners must exist in both Cortex XSOAR and Cortex XDR.False
    Trust any certificate (not secure)False
    Use system proxy settingsFalse
    Incident Statuses to FetchThe statuses of the incidents that will be fetched. If no status is provided then incidents of all the statuses will be fetched. Note: An incident whose status was changed to a filtered status after its creation time will not be fetched.False
  4. Click Test to validate the URLs, token, and connection.

Configuration#


You need to collect several pieces of information in order to configure the integration on Cortex XSOAR.

Generate an API Key and API Key ID#

  1. In your Cortex XDR platform, go to Settings.
  2. Click the +New Key button in the top right corner.
  3. Generate a key of type Advanced.
  4. Copy and paste the key.
  5. From the ID column, copy the Key ID.

URL#

  1. In your Cortex XDR platform, go to Settings.
  2. Click the Copy URL button in the top right corner.

Playbooks#


Cortex XDR Incident Handling#

The playbook syncs and updates new XDR alerts that construct the incident. It enriches indicators using Threat Intelligence integrations and Palo Alto Networks AutoFocus. The incident's severity is then updated based on the indicators reputation and an analyst is assigned for manual investigation. If chosen, automated remediation with Palo Alto Networks FireWall is initiated. After a manual review by the SOC analyst, the XDR incident is closed automatically.

Use Cases#


  • Fetch incidents from XDR
  • Enrich incident with alerts and incident from XDR
  • Update incident in XDR
  • Search for endpoints
  • Isolate/unisolate endpoints
  • Insert parsed alerts into XDR
  • Insert CEF alerts into XDR
  • Query for agent audit reports
  • Query for audit management logs
  • Create distribution
  • Get distribution download URL
  • Get distribution versions

Automation#


To sync incidents between Cortex XSOAR and Cortex XDR, you should use the XDRSyncScript script, which you can find in the automation page.

Fetched Incidents Data#


incident_id:31
creation_time:1564594008755
modification_time:1566339537617
detection_time:null
status:new
severity:low
description:6 'Microsoft Windows RPC Fragment Evasion Attempt' alerts detected by PAN NGFW on 6 hosts
assigned_user_mail:null
assigned_user_pretty_name:null
alert_count:6
low_severity_alert_count:0
med_severity_alert_count:6
high_severity_alert_count:0
user_count:1
host_count:6
notes:null
resolve_comment:null
manual_severity:low
manual_description:null
xdr_url:https://1111.paloaltonetworks.com/incident-view/31
  • Note: By checking the Fetch incident alerts and artifacts integration configuration parameter, fetched incidents will include additional data.

XDR Incident Mirroring#

Note this feature is available from Cortex XSOAR version 6.0.0

You can enable incident mirroring between Cortex XSOAR incidents and Cortex XDR incidents. To setup the mirroring follow these instructions:

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Cortex XDR - IR and select your integration instance.
  3. Enable Fetches incidents.
  4. Under Mapper (incoming), select XDR - Incoming Mapper.
  5. Under Mapper (outgoing), select Cortex XDR - Outgoing Mapper.
  6. In the Incident Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:
  • Incoming - Any changes in XDR incidents will be reflected in XSOAR incidents.
  • Outgoing - Any changes in XSOAR incidents will be reflected in XDR incidents.
  • Both - Changes in XSOAR and XDR incidents will be reflected in both directions.
  • None - Choose this to turn off incident mirroring.
  1. Optional: Check the Sync Incident Owners integration parameter to sync the incident owners in both XDR and XSOAR.
  • Note: This feature will only work if the same users are registered in both Cortex XSOAR and Cortex XDR.
  1. Newly fetched incidents will be mirrored in the chosen direction.
  • Note: This will not effect existing incidents.

XDR Mirroring Notes, limitations and Troubleshooting#

  • While you can mirror changes in incident fields both in and out in each incident, you can only mirror in a single direction at a time. For example: If we have an incident with two fields (A and B) in XDR and XSOAR while Incoming And Outgoing mirroring is selected:

    • I can mirror field A from XDR to XSOAR and field B from XSOAR to XDR.
    • I cannot mirror changes from field A in both directions.

    Initially all fields are mirrored in from XDR to XSOAR. Once they are changed in XSOAR, they can only be mirrored out.

  • Do not use the XDRSyncScript automation nor any playbook that uses this automation (e.g Cortex XDR Incident Sync or Cortex XDR incident handling v2), as it impairs the mirroring functionality.

  • When migrating an existing instance to the mirroring feature, or in case the mirroring does not work as expected, make sure that:

    • The default playbook of the Cortex XDR Incident incident type is not Cortex XDR Incident Sync, change it to a different playbook that does not use XDRSyncScript.
    • The XDR integration instance incoming mapper is set to Cortex XDR - Incoming Mapper and the outgoing mapper is set to Cortex XDR - Outgoing Mapper.
  • The API includes a limit rate of 10 API requests per minute. Therefore, in a case of a limit rate exception, the sync loop will stop and will resume from the last incident.

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

xdr-get-incidents#


Returns a list of incidents, which you can filter by a list of incident IDs (max. 100), the time the incident was last modified, and the time the incident was created. If you pass multiple filtering arguments, they will be concatenated using the AND condition. The OR condition is not supported.

Base Command#

xdr-get-incidents

Input#

Argument NameDescriptionRequired
lte_creation_timeA date in the format 2019-12-31T23:59:00. Only incidents that were created on or before the specified date/time will be retrieved.Optional
gte_creation_timeA date in the format 2019-12-31T23:59:00. Only incidents that were created on or after the specified date/time will be retrieved.Optional
lte_modification_timeFilters returned incidents that were created on or before the specified date/time, in the format 2019-12-31T23:59:00.Optional
gte_modification_timeFilters returned incidents that were modified on or after the specified date/time, in the format 2019-12-31T23:59:00.Optional
incident_id_listAn array or CSV string of incident IDs.Optional
since_creation_timeFilters returned incidents that were created on or after the specified date/time range, for example, 1 month, 2 days, 1 hour, and so on.Optional
since_modification_timeFilters returned incidents that were modified on or after the specified date/time range, for example, 1 month, 2 days, 1 hour, and so on.Optional
sort_by_modification_timeSorts returned incidents by the date/time that the incident was last modified ("asc" - ascending, "desc" - descending). Possible values are: asc, desc.Optional
sort_by_creation_timeSorts returned incidents by the date/time that the incident was created ("asc" - ascending, "desc" - descending). Possible values are: asc, desc.Optional
pagePage number (for pagination). The default is 0 (the first page). Default is 0.Optional
limitMaximum number of incidents to return per page. The default and maximum is 100. Default is 100.Optional
statusFilters only incidents in the specified status. The options are: new, under_investigation, resolved_known_issue, resolved_false_positive, resolved_true_positive resolved_security_testing, resolved_other, resolved_auto.Optional
starredWhether the incident is starred or not (Boolean value: true or false).Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.Incident.incident_idStringUnique ID assigned to each returned incident.
PaloAltoNetworksXDR.Incident.manual_severityStringIncident severity assigned by the user. This does not affect the calculated severity. Can be "low", "medium", "high"
PaloAltoNetworksXDR.Incident.manual_descriptionStringIncident description provided by the user.
PaloAltoNetworksXDR.Incident.assigned_user_mailStringEmail address of the assigned user.
PaloAltoNetworksXDR.Incident.high_severity_alert_countStringNumber of alerts with the severity HIGH.
PaloAltoNetworksXDR.Incident.host_countnumberNumber of hosts involved in the incident.
PaloAltoNetworksXDR.Incident.xdr_urlStringA link to the incident view on XDR.
PaloAltoNetworksXDR.Incident.assigned_user_pretty_nameStringFull name of the user assigned to the incident.
PaloAltoNetworksXDR.Incident.alert_countnumberTotal number of alerts in the incident.
PaloAltoNetworksXDR.Incident.med_severity_alert_countnumberNumber of alerts with the severity MEDIUM.
PaloAltoNetworksXDR.Incident.user_countnumberNumber of users involved in the incident.
PaloAltoNetworksXDR.Incident.severityStringCalculated severity of the incident. Valid values are:

"low","medium","high" | | PaloAltoNetworksXDR.Incident.low_severity_alert_count | String | Number of alerts with the severity LOW. | | PaloAltoNetworksXDR.Incident.status | String | Current status of the incident. Valid values are: "new","under_investigation","resolved_known_issue","resolved_duplicate","resolved_false_positive","resolved_true_positive","resolved_security_testing" or "resolved_other". | | PaloAltoNetworksXDR.Incident.starred | Boolean | Incident starred. | | PaloAltoNetworksXDR.Incident.description | String | Dynamic calculated description of the incident. | | PaloAltoNetworksXDR.Incident.resolve_comment | String | Comments entered by the user when the incident was resolved. | | PaloAltoNetworksXDR.Incident.notes | String | Comments entered by the user regarding the incident. | | PaloAltoNetworksXDR.Incident.creation_time | date | Date and time the incident was created on XDR. | | PaloAltoNetworksXDR.Incident.detection_time | date | Date and time that the first alert occurred in the incident. | | PaloAltoNetworksXDR.Incident.modification_time | date | Date and time that the incident was last modified. |

Command Example#

!xdr-get-incidents gte_creation_time=2010-10-10T00:00:00 limit=3 sort_by_creation_time=desc

Context Example#
{
"PaloAltoNetworksXDR.Incident": [
{
"host_count": 1,
"incident_id": "4",
"manual_severity": "medium",
"description": "5 'This alert from content TestXDRPlaybook' alerts detected by Checkpoint - SandBlast ",
"severity": "medium",
"modification_time": 1579290004178,
"assigned_user_pretty_name": null,
"notes": null,
"creation_time": 1577276587937,
"alert_count": 5,
"med_severity_alert_count": 1,
"detection_time": null,
"assigned_user_mail": null,
"resolve_comment": "This issue was solved in Incident number 192304",
"status": "new",
"user_count": 1,
"xdr_url": "https://some.xdr.url.com/incident-view/4",
"starred": false,
"low_severity_alert_count": 0,
"high_severity_alert_count": 4,
"manual_description": null
},
{
"host_count": 1,
"incident_id": "3",
"manual_severity": "medium",
"description": "'test 1' generated by Virus Total - Firewall",
"severity": "medium",
"modification_time": 1579237974014,
"assigned_user_pretty_name": "woo@demisto.com",
"notes": null,
"creation_time": 1576100096594,
"alert_count": 1,
"med_severity_alert_count": 0,
"detection_time": null,
"assigned_user_mail": "woo@demisto.com",
"resolve_comment": null,
"status": "new",
"user_count": 1,
"xdr_url": "https://some.xdr.url.com/incident-view/3",
"starred": false,
"low_severity_alert_count": 0,
"high_severity_alert_count": 1,
"manual_description": null
},
{
"host_count": 1,
"incident_id": "2",
"manual_severity": "high",
"description": "'Alert Name Example 333' along with 1 other alert generated by Virus Total - VPN & Firewall-3 and Checkpoint - SandBlast",
"severity": "high",
"modification_time": 1579288790259,
"assigned_user_pretty_name": null,
"notes": null,
"creation_time": 1576062816474,
"alert_count": 2,
"med_severity_alert_count": 0,
"detection_time": null,
"assigned_user_mail": null,
"resolve_comment": null,
"status": "under_investigation",
"user_count": 1,
"xdr_url": "https://some.xdr.url.com/incident-view/2",
"starred": false,
"low_severity_alert_count": 0,
"high_severity_alert_count": 2,
"manual_description": null
}
]
}
Human Readable Output#

Incidents#

alert_countassigned_user_mailassigned_user_pretty_namecreation_timedescriptiondetection_timehigh_severity_alert_counthost_countincident_idlow_severity_alert_countmanual_descriptionmanual_severitymed_severity_alert_countmodification_timenotesresolve_commentseveritystarredstatususer_countxdr_url
515772765879375 'This alert from content TestXDRPlaybook' alerts detected by Checkpoint - SandBlast4140medium11579290004178This issue was solved in Incident number 192304mediumfalsenew1https://some.xdr.url.com/incident-view/4
1woo@demisto.comwoo@demisto.com1576100096594'test 1' generated by Virus Total - Firewall1130medium01579237974014mediumfalsenew1https://some.xdr.url.com/incident-view/3
21576062816474'Alert Name Example 333' along with 1 other alert generated by Virus Total - VPN & Firewall-3 and Checkpoint - SandBlast2120high01579288790259highfalseunder_investigation1https://some.xdr.url.com/incident-view/2

xdr-get-incident-extra-data#


Returns additional data for the specified incident, for example, related alerts, file artifacts, network artifacts, and so on.

Base Command#

xdr-get-incident-extra-data

Input#

Argument NameDescriptionRequired
incident_idThe ID of the incident for which to get additional data.Required
alerts_limitMaximum number of alerts to return. Default is 1,000. Default is 1000.Optional
return_only_updated_incidentReturn data only if the incident was changed since the last time it was mirrored in to XSOAR. This flag should be used only from within a XDR incident. Default is False.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.Incident.incident_idStringUnique ID assigned to each returned incident.
PaloAltoNetworksXDR.Incident.creation_timeDateDate and time the incident was created on XDR.
PaloAltoNetworksXDR.Incident.modification_timeDateDate and time that the incident was last modified.
PaloAltoNetworksXDR.Incident.detection_timeDateDate and time that the first alert occurred in the incident.
PaloAltoNetworksXDR.Incident.statusStringCurrent status of the incident. Valid values are:
"new","under_investigation","resolved_known_issue","resolved_duplicate","resolved_false_positive","resolved_true_positive","resolved_security_testing","resolved_other"
PaloAltoNetworksXDR.Incident.severityStringCalculated severity of the incident. Valid values are: "low","medium","high"
PaloAltoNetworksXDR.Incident.descriptionStringDynamic calculated description of the incident.
PaloAltoNetworksXDR.Incident.assigned_user_mailStringEmail address of the assigned user.
PaloAltoNetworksXDR.Incident.assigned_user_pretty_nameStringFull name of the user assigned to the incident.
PaloAltoNetworksXDR.Incident.alert_countNumberTotal number of alerts in the incident.
PaloAltoNetworksXDR.Incident.low_severity_alert_countNumberNumber of alerts with the severity LOW.
PaloAltoNetworksXDR.Incident.med_severity_alert_countNumberNumber of alerts with the severity MEDIUM.
PaloAltoNetworksXDR.Incident.high_severity_alert_countNumberNumber of alerts with the severity HIGH.
PaloAltoNetworksXDR.Incident.user_countNumberNumber of users involved in the incident.
PaloAltoNetworksXDR.Incident.host_countNumberNumber of hosts involved in the incident
PaloAltoNetworksXDR.Incident.notesUnknownComments entered by the user regarding the incident.
PaloAltoNetworksXDR.Incident.resolve_commentStringComments entered by the user when the incident was resolved.
PaloAltoNetworksXDR.Incident.manual_severityStringIncident severity assigned by the user. This does not affect the calculated severity of low, medium, or high.
PaloAltoNetworksXDR.Incident.manual_descriptionStringIncident description provided by the user.
PaloAltoNetworksXDR.Incident.xdr_urlStringA link to the incident view on XDR.
PaloAltoNetworksXDR.Incident.starredBooleanIncident starred.
PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_techniques_ids_and_namesStringIncident Mitre techniques ids and names.
PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_tactics_ids_and_namesStringIncident Mitre tactics ids and names.
PaloAltoNetworksXDR.Incident.alerts.alert_idStringUnique ID for each alert.
PaloAltoNetworksXDR.Incident.alerts.detection_timestampDateDate and time that the alert occurred.
PaloAltoNetworksXDR.Incident.alerts.sourceStringSource of the alert. The product/vendor this alert came from.
PaloAltoNetworksXDR.Incident.alerts.severityStringSeverity of the alert.Valid values are: "low","medium","high"""
PaloAltoNetworksXDR.Incident.alerts.nameStringCalculated name of the alert.
PaloAltoNetworksXDR.Incident.alerts.categoryStringCategory of the alert, for example, Spyware Detected via Anti-Spyware profile.
PaloAltoNetworksXDR.Incident.alerts.descriptionStringTextual description of the alert.
PaloAltoNetworksXDR.Incident.alerts.host_ip_listUnknownHost IP involved in the alert.
PaloAltoNetworksXDR.Incident.alerts.host_nameStringHost name involved in the alert.
PaloAltoNetworksXDR.Incident.alerts.user_nameStringUser name involved with the alert.
PaloAltoNetworksXDR.Incident.alerts.event_typeStringEvent type. Valid values are: "Process Execution","Network Event","File Event","Registry Event","Injection Event","Load Image Event","Windows Event Log"
PaloAltoNetworksXDR.Incident.alerts.actionStringThe action that triggered the alert. Valid values are: "REPORTED", "BLOCKED", "POST_DETECTED", "SCANNED", "DOWNLOAD", "PROMPT_ALLOW", "PROMPT_BLOCK", "DETECTED", "BLOCKED_1", "BLOCKED_2", "BLOCKED_3", "BLOCKED_5", "BLOCKED_6", "BLOCKED_7", "BLOCKED_8", "BLOCKED_9", "BLOCKED_10", "BLOCKED_11", "BLOCKED_13", "BLOCKED_14", "BLOCKED_15", "BLOCKED_16", "BLOCKED_17", "BLOCKED_24", "BLOCKED_25", "DETECTED_0", "DETECTED_4", "DETECTED_18", "DETECTED_19", "DETECTED_20", "DETECTED_21", "DETECTED_22", "DETECTED_23"
PaloAltoNetworksXDR.Incident.alerts.action_prettyStringThe action that triggered the alert. Valid values are: "Detected (Reported)" "Prevented (Blocked)" "Detected (Post Detected)" "Detected (Scanned)" "Detected (Download)" "Detected (Prompt Allow)" "Prevented (Prompt Block)" "Detected" "Prevented (Denied The Session)" "Prevented (Dropped The Session)" "Prevented (Dropped The Session And Sent a TCP Reset)" "Prevented (Blocked The URL)" "Prevented (Blocked The IP)" "Prevented (Dropped The Packet)" "Prevented (Dropped All Packets)" "Prevented (Terminated The Session And Sent a TCP Reset To Both Sides Of The Connection)" "Prevented (Terminated The Session And Sent a TCP Reset To The Client)" "Prevented (Terminated The Session And Sent a TCP Reset To The Server)" "Prevented (Continue)" "Prevented (Block-Override)" "Prevented (Override-Lockout)" "Prevented (Override)" "Prevented (Random-Drop)" "Prevented (Silently Dropped The Session With An ICMP Unreachable Message To The Host Or Application)" "Prevented (Block)" "Detected (Allowed The Session)" "Detected (Raised An Alert)" "Detected (Syncookie Sent)" "Detected (Forward)" "Detected (Wildfire Upload Success)" "Detected (Wildfire Upload Failure)" "Detected (Wildfire Upload Skip)" "Detected (Sinkhole)"
PaloAltoNetworksXDR.Incident.alerts.actor_process_image_nameStringImage name.
PaloAltoNetworksXDR.Incident.alerts.actor_process_command_lineStringCommand line.
PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_statusStringSignature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".
PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_vendorStringSingature vendor name.
PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_image_nameStringImage name.
PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_lineStringCommand line.
PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_statusStringSignature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash"
PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_vendorStringSignature vendor.
PaloAltoNetworksXDR.Incident.alerts.causality_actor_causality_idUnknownCausality id.
PaloAltoNetworksXDR.Incident.alerts.action_process_image_nameStringImage name.
PaloAltoNetworksXDR.Incident.alerts.action_process_image_command_lineStringCommand line.
PaloAltoNetworksXDR.Incident.alerts.action_process_image_sha256StringImage SHA256.
PaloAltoNetworksXDR.Incident.alerts.action_process_signature_statusStringSignature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash"
PaloAltoNetworksXDR.Incident.alerts.action_process_signature_vendorStringSignature vendor name.
PaloAltoNetworksXDR.Incident.alerts.action_file_pathStringFile path.
PaloAltoNetworksXDR.Incident.alerts.action_file_md5StringFile MD5.
PaloAltoNetworksXDR.Incident.alerts.action_file_sha256StringFile SHA256.
PaloAltoNetworksXDR.Incident.alerts.action_registry_dataStringRegistry data.
PaloAltoNetworksXDR.Incident.alerts.action_registry_full_keyStringRegistry full key.
PaloAltoNetworksXDR.Incident.alerts.action_local_ipStringLocal IP.
PaloAltoNetworksXDR.Incident.alerts.action_local_portNumberLocal port.
PaloAltoNetworksXDR.Incident.alerts.action_remote_ipStringRemote IP.
PaloAltoNetworksXDR.Incident.alerts.action_remote_portNumberRemote port.
PaloAltoNetworksXDR.Incident.alerts.action_external_hostnameStringExternal hostname.
PaloAltoNetworksXDR.Incident.alerts.fw_app_idUnknownFirewall app id.
PaloAltoNetworksXDR.Incident.alerts.is_whitelistedStringIs the alert on allow list. Valid values are: "Yes" "No"
PaloAltoNetworksXDR.Incident.alerts.starredBooleanAlert starred.
PaloAltoNetworksXDR.Incident.network_artifacts.typeStringNetwork artifact type.
PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_portnumberThe remote port related to the artifact.
PaloAltoNetworksXDR.Incident.network_artifacts.alert_countnumberNumber of alerts related to the artifact.
PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_ipStringThe remote IP related to the artifact.
PaloAltoNetworksXDR.Incident.network_artifacts.is_manualbooleanWhether the artifact was created by the user (manually).
PaloAltoNetworksXDR.Incident.network_artifacts.network_domainStringThe domain related to the artifact.
PaloAltoNetworksXDR.Incident.network_artifacts.typeStringThe artifact type. Valid values are: "META", "GID", "CID", "HASH", "IP", "DOMAIN", "REGISTRY", "HOSTNAME"
PaloAltoNetworksXDR.Incident.network_artifacts.network_countryStringThe country related to the artifact.
PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_statusStringDigital signature status of the file. Valid values are: "SIGNATURE_UNAVAILABLE" "SIGNATURE_SIGNED" "SIGNATURE_INVALID" "SIGNATURE_UNSIGNED" "SIGNATURE_WEAK_HASH"
PaloAltoNetworksXDR.Incident.file_artifacts.is_processbooleanWhether the file artifact is related to a process execution.
PaloAltoNetworksXDR.Incident.file_artifacts.file_nameStringName of the file.
PaloAltoNetworksXDR.Incident.file_artifacts.file_wildfire_verdictStringThe file verdict, calculated by Wildfire. Valid values are: "BENIGN" "MALWARE" "GRAYWARE" "PHISHING" "UNKNOWN".
PaloAltoNetworksXDR.Incident.file_artifacts.alert_countnumberNumber of alerts related to the artifact.
PaloAltoNetworksXDR.Incident.file_artifacts.is_maliciousbooleanWhether the artifact is malicious, as decided by the Wildfire verdict.
PaloAltoNetworksXDR.Incident.file_artifacts.is_manualbooleanWhether the artifact was created by the user (manually).
PaloAltoNetworksXDR.Incident.file_artifacts.typeStringThe artifact type. Valid values are: "META" "GID" "CID" "HASH" "IP" "DOMAIN" "REGISTRY" "HOSTNAME"
PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256StringSHA-256 hash of the file.
PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_vendor_nameStringFile signature vendor name.
Account.UsernameStringThe username in the relevant system.
Endpoint.HostnameStringThe hostname that is mapped to this endpoint.
File.PathStringThe path where the file is located.
File.MD5StringThe MD5 hash of the file.
File.SHA256StringThe SHA256 hash of the file.
File.NameStringThe full file name (including file extension).
Process.NameStringThe name of the process.
Process.MD5StringThe MD5 hash of the process.
Process.SHA256StringThe SHA256 hash of the process.
Process.PIDStringThe PID of the process.
Process.PathStringThe file system path to the binary file.
Process.Start TimeStringThe timestamp of the process start time.
Process.CommandLineStringThe full command line (including arguments).
IP.AddressStringIP address.
IP.Geo.CountryStringThe country in which the IP address is located.
Domain.NameStringThe domain name, for example: "google.com".
Command Example#

!xdr-get-incident-extra-data incident_id=4 alerts_limit=10

Context Example#
{
"Account": {
"Username": [
null
]
},
"Endpoint": {
"Hostname": [
null
]
},
"PaloAltoNetworksXDR.Incident": {
"host_count": 1,
"manual_severity": "medium",
"xdr_url": "https://some.xdr.url.com/incident-view/4",
"assigned_user_pretty_name": null,
"alert_count": 5,
"med_severity_alert_count": 1,
"detection_time": null,
"user_count": 1,
"severity": "medium",
"alerts": [
{
"action_process_signature_status": "N/A",
"action_pretty": [
"VALUE_NA",
"N/A"
],
"event_type": "Network Event",
"alert_id": "6",
"action_file_sha256": null,
"action_external_hostname": null,
"causality_actor_process_command_line": null,
"description": "Test - alert generated by Test XDR Playbook",
"category": null,
"severity": "medium",
"source": "Cisco - Sandblast",
"action_remote_port": 8000,
"causality_actor_process_signature_status": "N/A",
"fw_app_id": null,
"is_whitelisted": "No",
"action_local_ip": "196.168.0.1",
"action_registry_data": null,
"action_process_image_sha256": null,
"user_name": null,
"action_remote_ip": "2.2.2.2",
"action_process_signature_vendor": "N/A",
"actor_process_signature_status": "N/A",
"name": "Test - alert generated by Test XDR Playbook",
"causality_actor_causality_id": null,
"host_ip": null,
"host_ip_list": [],
"action_process_image_name": null,
"detection_timestamp": 1577276586921,
"action_file_md5": null,
"causality_actor_process_image_name": null,
"action_file_path": null,
"action_process_image_command_line": null,
"action_local_port": 7000,
"actor_process_image_name": null,
"action_registry_full_key": null,
"actor_process_signature_vendor": "N/A",
"actor_process_command_line": null,
"host_name": null,
"action": [
"VALUE_NA",
"N/A"
],
"starred": false,
"causality_actor_process_signature_vendor": "N/A"
},
{
"action_process_signature_status": "N/A",
"action_pretty": [
"VALUE_NA",
"N/A"
],
"event_type": "Network Event",
"alert_id": "7",
"action_file_sha256": null,
"action_external_hostname": null,
"causality_actor_process_command_line": null,
"description": "This alert from content TestXDRPlaybook description",
"category": null,
"severity": "high",
"source": "Checkpoint - SandBlast",
"action_remote_port": 6000,
"causality_actor_process_signature_status": "N/A",
"fw_app_id": null,
"is_whitelisted": "No",
"action_local_ip": "196.168.0.111",
"action_registry_data": null,
"action_process_image_sha256": null,
"user_name": null,
"action_remote_ip": "2.2.2.2",
"action_process_signature_vendor": "N/A",
"actor_process_signature_status": "N/A",
"name": "This alert from content TestXDRPlaybook",
"causality_actor_causality_id": null,
"host_ip": null,
"host_ip_list": [],
"action_process_image_name": null,
"detection_timestamp": 1577776701589,
"action_file_md5": null,
"causality_actor_process_image_name": null,
"action_file_path": null,
"action_process_image_command_line": null,
"action_local_port": 2000,
"actor_process_image_name": null,
"action_registry_full_key": null,
"actor_process_signature_vendor": "N/A",
"actor_process_command_line": null,
"host_name": null,
"action": [
"VALUE_NA",
"N/A"
],
"starred": false,
"causality_actor_process_signature_vendor": "N/A"
},
{
"action_process_signature_status": "N/A",
"action_pretty": [
"VALUE_NA",
"N/A"
],
"event_type": "Network Event",
"alert_id": "8",
"action_file_sha256": null,
"action_external_hostname": null,
"causality_actor_process_command_line": null,
"description": "This alert from content TestXDRPlaybook description",
"category": null,
"severity": "high",
"source": "Checkpoint - SandBlast",
"action_remote_port": 6000,
"causality_actor_process_signature_status": "N/A",
"fw_app_id": null,
"is_whitelisted": "No",
"action_local_ip": "196.168.0.111",
"action_registry_data": null,
"action_process_image_sha256": null,
"user_name": null,
"action_remote_ip": "2.2.2.2",
"action_process_signature_vendor": "N/A",
"actor_process_signature_status": "N/A",
"name": "This alert from content TestXDRPlaybook",
"causality_actor_causality_id": null,
"host_ip": null,
"host_ip_list": [],
"action_process_image_name": null,
"detection_timestamp": 1577958479843,
"action_file_md5": null,
"causality_actor_process_image_name": null,
"action_file_path": null,
"action_process_image_command_line": null,
"action_local_port": 2000,
"actor_process_image_name": null,
"action_registry_full_key": null,
"actor_process_signature_vendor": "N/A",
"actor_process_command_line": null,
"host_name": null,
"action": [
"VALUE_NA",
"N/A"
],
"starred": false,
"causality_actor_process_signature_vendor": "N/A"
},
{
"action_process_signature_status": "N/A",
"action_pretty": [
"VALUE_NA",
"N/A"
],
"event_type": "Network Event",
"alert_id": "9",
"action_file_sha256": null,
"action_external_hostname": null,
"causality_actor_process_command_line": null,
"description": "This alert from content TestXDRPlaybook description",
"category": null,
"severity": "high",
"source": "Checkpoint - SandBlast",
"action_remote_port": 6000,
"causality_actor_process_signature_status": "N/A",
"fw_app_id": null,
"is_whitelisted": "No",
"action_local_ip": "196.168.0.111",
"action_registry_data": null,
"action_process_image_sha256": null,
"user_name": null,
"action_remote_ip": "2.2.2.2",
"action_process_signature_vendor": "N/A",
"actor_process_signature_status": "N/A",
"name": "This alert from content TestXDRPlaybook",
"causality_actor_causality_id": null,
"host_ip": null,
"host_ip_list": [],
"action_process_image_name": null,
"detection_timestamp": 1578123895414,
"action_file_md5": null,
"causality_actor_process_image_name": null,
"action_file_path": null,
"action_process_image_command_line": null,
"action_local_port": 2000,
"actor_process_image_name": null,
"action_registry_full_key": null,
"actor_process_signature_vendor": "N/A",
"actor_process_command_line": null,
"host_name": null,
"action": [
"VALUE_NA",
"N/A"
],
"starred": false,
"causality_actor_process_signature_vendor": "N/A"
},
{
"action_process_signature_status": "N/A",
"action_pretty": [
"VALUE_NA",
"N/A"
],
"event_type": "Network Event",
"alert_id": "10",
"action_file_sha256": null,
"action_external_hostname": null,
"causality_actor_process_command_line": null,
"description": "This alert from content TestXDRPlaybook description",
"category": null,
"severity": "high",
"source": "Checkpoint - SandBlast",
"action_remote_port": 6000,
"causality_actor_process_signature_status": "N/A",
"fw_app_id": null,
"is_whitelisted": "No",
"action_local_ip": "196.168.0.111",
"action_registry_data": null,
"action_process_image_sha256": null,
"user_name": null,
"action_remote_ip": "2.2.2.2",
"action_process_signature_vendor": "N/A",
"actor_process_signature_status": "N/A",
"name": "This alert from content TestXDRPlaybook",
"causality_actor_causality_id": null,
"host_ip": null,
"host_ip_list": [],
"action_process_image_name": null,
"detection_timestamp": 1578927443615,
"action_file_md5": null,
"causality_actor_process_image_name": null,
"action_file_path": null,
"action_process_image_command_line": null,
"action_local_port": 2000,
"actor_process_image_name": null,
"action_registry_full_key": null,
"actor_process_signature_vendor": "N/A",
"actor_process_command_line": null,
"host_name": null,
"action": [
"VALUE_NA",
"N/A"
],
"starred": false,
"causality_actor_process_signature_vendor": "N/A"
}
],
"low_severity_alert_count": 0,
"status": "new",
"description": "5 'This alert from content TestXDRPlaybook' alerts detected by Checkpoint - SandBlast ",
"resolve_comment": "This issue was solved in Incident number 192304",
"creation_time": 1577276587937,
"modification_time": 1579290004178,
"network_artifacts": [
{
"network_remote_port": 8000,
"alert_count": 5,
"network_remote_ip": "2.2.2.2",
"is_manual": false,
"network_domain": null,
"type": "IP",
"network_country": null
}
],
"file_artifacts": [],
"manual_description": null,
"incident_id": "4",
"notes": null,
"assigned_user_mail": null,
"starred": false,
"high_severity_alert_count": 4
}
}
Human Readable Output#

Incident 4#

alert_countassigned_user_mailassigned_user_pretty_namecreation_timedescriptiondetection_timehigh_severity_alert_counthost_countincident_idlow_severity_alert_countmanual_descriptionmanual_severitymed_severity_alert_countmodification_timenotesresolve_commentseveritystarredstatususer_countxdr_url
515772765879375 'This alert from content TestXDRPlaybook' alerts detected by Checkpoint - SandBlast4140medium11579290004178This issue was solved in Incident number 192304mediumfalsenew1https://some.xdr.url.com/incident-view/4

Alerts#

actionaction_external_hostnameaction_file_md5action_file_pathaction_file_sha256action_local_ipaction_local_portaction_prettyaction_process_image_command_lineaction_process_image_nameaction_process_image_sha256action_process_signature_statusaction_process_signature_vendoraction_registry_dataaction_registry_full_keyaction_remote_ipaction_remote_portactor_process_command_lineactor_process_image_nameactor_process_signature_statusactor_process_signature_vendoralert_idcategorycausality_actor_causality_idcausality_actor_process_command_linecausality_actor_process_image_namecausality_actor_process_signature_statuscausality_actor_process_signature_vendordescriptiondetection_timestampevent_typefw_app_idhost_ip_listhost_nameis_whitelistednameseveritysourcestarreduser_name
VALUE_NA,
N/A
196.168.0.17000VALUE_NA,
N/A
N/AN/A2.2.2.28000N/AN/A6N/AN/ATest - alert generated by Test XDR Playbook1577276586921Network EventNoTest - alert generated by Test XDR PlaybookmediumCisco - Sandblastfalse
VALUE_NA,
N/A
196.168.0.1112000VALUE_NA,
N/A
N/AN/A2.2.2.26000N/AN/A7N/AN/AThis alert from content TestXDRPlaybook description1577776701589Network EventNoThis alert from content TestXDRPlaybookhighCheckpoint - SandBlastfalse
VALUE_NA,
N/A
196.168.0.1112000VALUE_NA,
N/A
N/AN/A2.2.2.26000N/AN/A8N/AN/AThis alert from content TestXDRPlaybook description1577958479843Network EventNoThis alert from content TestXDRPlaybookhighCheckpoint - SandBlastfalse
VALUE_NA,
N/A
196.168.0.1112000VALUE_NA,
N/A
N/AN/A2.2.2.26000N/AN/A9N/AN/AThis alert from content TestXDRPlaybook description1578123895414Network EventNoThis alert from content TestXDRPlaybookhighCheckpoint - SandBlastfalse
VALUE_NA,
N/A
196.168.0.1112000VALUE_NA,
N/A
N/AN/A2.2.2.26000N/AN/A10N/AN/AThis alert from content TestXDRPlaybook description1578927443615Network EventNoThis alert from content TestXDRPlaybookhighCheckpoint - SandBlastfalse

Network Artifacts#

alert_countis_manualnetwork_countrynetwork_domainnetwork_remote_ipnetwork_remote_porttype
5false2.2.2.28000IP

File Artifacts#

No entries.

Base Command#

xdr-update-incident

Input#

Argument NameDescriptionRequired
incident_idXDR incident ID. You can get the incident ID from the output of the 'xdr-get-incidents' command or the 'xdr-get-incident-extra-details' command.Required
manual_severitySeverity to assign to the incident (LOW, MEDIUM, or HIGH). Possible values are: HIGH, MEDIUM, LOW.Optional
assigned_user_mailEmail address of the user to assign to the incident.Optional
assigned_user_pretty_nameFull name of the user assigned to the incident.Optional
statusStatus of the incident. Valid values are: NEW, UNDER_INVESTIGATION, RESOLVED_KNOWN_ISSUE, RESOLVED_DUPLICATE, RESOLVED_FALSE_POSITIVE, RESOLVED_TRUE_POSITIVE, RESOLVED_SECURITY_TESTING, RESOLVED_OTHER. Possible values are: NEW, UNDER_INVESTIGATION, RESOLVED_KNOWN_ISSUE, RESOLVED_DUPLICATE, RESOLVED_FALSE_POSITIVE, RESOLVED_TRUE_POSITIVE, RESOLVED_SECURITY_TESTING, RESOLVED_OTHER.Optional
resolve_commentComment explaining why the incident was resolved. This should be set when the incident is resolved.Optional
unassign_userIf true, will remove all assigned users from the incident. Possible values are: true.Optional

Context Output#

There is no context output for this command.

xdr-insert-parsed-alert#


Upload alert from external alert sources in Cortex XDR format. Cortex XDR displays alerts that are parsed successfully in related incidents and views. You can send 600 alerts per minute. Each request can contain a maximum of 60 alerts.

Base Command#

xdr-insert-parsed-alert

Input#

Argument NameDescriptionRequired
productString value that defines the product.Required
vendorString value that defines the product.Required
local_ipString value for the source IP address.Optional
local_portInteger value for the source port.Required
remote_ipString value of the destination IP
address.
Required
remote_portInteger value for the destination
port.
Required
event_timestampInteger value representing the epoch of the time the alert occurred in milliseconds, or a string value in date format 2019-10-23T10:00:00. If not set, the event time will be defined as now.Optional
severityString value of alert severity. Valid values are:
Informational, Low, Medium or High. Possible values are: Informational, Low, Medium, High. Default is Medium.
Optional
alert_nameString defining the alert name.Required
alert_descriptionString defining the alert description.Optional

Context Output#

There is no context output for this command.

xdr-insert-cef-alerts#


Upload alerts in CEF format from external alert sources. After you map CEF alert fields to Cortex XDR fields, Cortex XDR displays the alerts in related incidents and views. You can send 600 requests per minute. Each request can contain a maximum of 60 alerts.

Base Command#

xdr-insert-cef-alerts

Input#

Argument NameDescriptionRequired
cef_alertsList of alerts in CEF format.Required

Context Output#

There is no context output for this command.

xdr-endpoint-isolate#


Isolates the specified endpoint.

Base Command#

xdr-endpoint-isolate

Input#

Argument NameDescriptionRequired
incident_idAllows to link the response action to the incident that triggered it.Optional
endpoint_idThe endpoint ID (string) to isolate. You can retrieve the string from the xdr-get-endpoints command.Required
suppress_disconnected_endpoint_errorWhether to suppress an error when trying to isolate a disconnected endpoint. When sets to false, an error will be returned. Possible values are: true, false. Default is false.Optional
interval_in_secondsInterval in seconds between each poll.Optional
timeout_in_secondsPolling timeout in seconds.Optional
action_idFor polling use.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.Isolation.endpoint_idStringThe endpoint ID.

xdr-endpoint-unisolate#


Reverses the isolation of an endpoint.

Base Command#

xdr-endpoint-unisolate

Input#

Argument NameDescriptionRequired
incident_idAllows to link the response action to the incident that triggered it.Optional
endpoint_idThe endpoint ID (string) for which to reverse the isolation. You can retrieve it from the xdr-get-endpoints command.Required
suppress_disconnected_endpoint_errorWhether to suppress an error when trying to unisolate a disconnected endpoint. When sets to false, an error will be returned. Possible values are: true, false. Default is false.Optional
interval_in_secondsInterval in seconds between each poll.Optional
timeout_in_secondsPolling timeout in seconds.Optional
action_idFor polling use.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.UnIsolation.endpoint_idStringIsolates the specified endpoint.

xdr-get-endpoints#


Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0).

Base Command#

xdr-get-endpoints

Input#

Argument NameDescriptionRequired
statusThe status of the endpoint to filter. Possible values are: connected, disconnected, lost, uninstalled.Optional
endpoint_id_listA comma-separated list of endpoint IDs.Optional
dist_nameA comma-separated list of distribution package names or installation package names.
Example: dist_name1,dist_name2.
Optional
ip_listA comma-separated list of IP addresses.
Example: 8.8.8.8,1.1.1.1.
Optional
group_nameThe group name to which the agent belongs.
Example: group_name1,group_name2.
Optional
platformThe endpoint platform. Valid values are\: "windows", "linux", "macos", or "android". . Possible values are: windows, linux, macos, android.Optional
alias_nameA comma-separated list of alias names.
Examples: alias_name1,alias_name2.
Optional
isolateSpecifies whether the endpoint was isolated or unisolated. Possible values are: isolated, unisolated.Optional
hostnameHostname
Example: hostname1,hostname2.
Optional
first_seen_gteAll the agents that were first seen after {first_seen_gte}.
Supported values:
1579039377301 (time in milliseconds)
"3 days" (relative date)
"2019-10-21T23:45:00" (date).
Optional
first_seen_lteAll the agents that were first seen before {first_seen_lte}.
Supported values:
1579039377301 (time in milliseconds)
"3 days" (relative date)
"2019-10-21T23:45:00" (date).
Optional
last_seen_gteAll the agents that were last seen before {last_seen_gte}.
Supported values:
1579039377301 (time in milliseconds)
"3 days" (relative date)
"2019-10-21T23:45:00" (date).
Optional
last_seen_lteAll the agents that were last seen before {last_seen_lte}.
Supported values:
1579039377301 (time in milliseconds)
"3 days" (relative date)
"2019-10-21T23:45:00" (date).
Optional
pagePage number (for pagination). The default is 0 (the first page). Default is 0.Optional
limitMaximum number of endpoints to return per page. The default and maximum is 30. Default is 30.Optional
sort_bySpecifies whether to sort endpoints by the first time or last time they were seen. Can be "first_seen" or "last_seen". Possible values are: first_seen, last_seen.Optional
sort_orderThe order by which to sort results. Can be "asc" (ascending) or "desc" ( descending). Default set to asc. Possible values are: asc, desc. Default is asc.Optional
usernameThe usernames to query for, accepts a single user, or comma-separated list of usernames.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.Endpoint.endpoint_idStringThe endpoint ID.
PaloAltoNetworksXDR.Endpoint.endpoint_nameStringThe endpoint name.
PaloAltoNetworksXDR.Endpoint.endpoint_typeStringThe endpoint type.
PaloAltoNetworksXDR.Endpoint.endpoint_statusStringThe status of the endpoint.
PaloAltoNetworksXDR.Endpoint.os_typeStringThe endpoint OS type.
PaloAltoNetworksXDR.Endpoint.ipUnknownA list of IP addresses.
PaloAltoNetworksXDR.Endpoint.usersUnknownA list of users.
PaloAltoNetworksXDR.Endpoint.domainStringThe endpoint domain.
PaloAltoNetworksXDR.Endpoint.aliasStringThe endpoint's aliases.
PaloAltoNetworksXDR.Endpoint.first_seenUnknownFirst seen date/time in Epoch (milliseconds).
PaloAltoNetworksXDR.Endpoint.last_seenDateLast seen date/time in Epoch (milliseconds).
PaloAltoNetworksXDR.Endpoint.content_versionStringContent version.
PaloAltoNetworksXDR.Endpoint.installation_packageStringInstallation package.
PaloAltoNetworksXDR.Endpoint.active_directoryStringActive directory.
PaloAltoNetworksXDR.Endpoint.install_dateDateInstall date in Epoch (milliseconds).
PaloAltoNetworksXDR.Endpoint.endpoint_versionStringEndpoint version.
PaloAltoNetworksXDR.Endpoint.is_isolatedStringWhether the endpoint is isolated.
PaloAltoNetworksXDR.Endpoint.group_nameStringThe name of the group to which the endpoint belongs.
PaloAltoNetworksXDR.Endpoint.countStringNumber of endpoints returned.
Endpoint.HostnameStringThe hostname that is mapped to this endpoint.
Endpoint.IDStringThe unique ID within the tool retrieving the endpoint.
Endpoint.IPAddressStringThe IP address of the endpoint.
Endpoint.DomainStringThe domain of the endpoint.
Endpoint.OSStringThe endpoint's operation system.
Account.UsernameStringThe username in the relevant system.
Account.DomainStringThe domain of the account.
Endpoint.StatusStringThe endpoint's status.
Endpoint.IsIsolatedStringThe endpoint's isolation status.
Endpoint.MACAddressStringThe endpoint's MAC address.
Endpoint.VendorStringThe integration name of the endpoint vendor.
Command Example#

!xdr-get-endpoints isolate="unisolated" first_seen_gte="3 month" page="0" limit="30" sort_order="asc"

Context Example#
{
"Endpoint": [
{
"Domain": "WORKGROUP",
"Hostname": "aaaaa.compute.internal",
"ID": "ea303670c76e4ad09600c8b346f7c804",
"IPAddress": [
"172.31.11.11"
],
"OS": "Windows",
"Status" : "Online",
"IsIsolated" : "No",
"Vendor": "Cortex XDR - IR"
},
{
"Domain": "WORKGROUP",
"Hostname": "EC2AMAZ-P7PPOI4",
"ID": "f8a2f58846b542579c12090652e79f3d",
"IPAddress": [
"2.2.2.2"
],
"OS": "Windows",
"Status" : "Online",
"IsIsolated" : "No",
"Vendor": "Cortex XDR - IR"
}
],
"PaloAltoNetworksXDR.Endpoint": [
{
"domain": "",
"users": [
"ec2-user"
],
"endpoint_name": "aaaaa.compute.internal",
"ip": [
"172.31.11.11"
],
"install_date": 1575795969644,
"endpoint_version": "7.0.0.1915",
"group_name": null,
"installation_package": "linux",
"alias": "",
"active_directory": null,
"endpoint_status": "CONNECTED",
"os_type": "AGENT_OS_LINUX",
"endpoint_id": "ea303670c76e4ad09600c8b346f7c804",
"content_version": "111-17757",
"first_seen": 1575795969644,
"endpoint_type": "AGENT_TYPE_SERVER",
"is_isolated": "AGENT_UNISOLATED",
"last_seen": 1579290023629
},
{
"domain": "WORKGROUP",
"users": [
"Administrator"
],
"endpoint_name": "EC2AMAZ-P7PPOI4",
"ip": [
"2.2.2.2"
],
"install_date": 1575796381739,
"endpoint_version": "7.0.0.27797",
"group_name": null,
"installation_package": "Windows Server 2016",
"alias": "",
"active_directory": null,
"endpoint_status": "CONNECTED",
"os_type": "AGENT_OS_WINDOWS",
"endpoint_id": "f8a2f58846b542579c12090652e79f3d",
"content_version": "111-17757",
"first_seen": 1575796381739,
"endpoint_type": "AGENT_TYPE_SERVER",
"is_isolated": "AGENT_UNISOLATED",
"last_seen": 1579289957412
}
]
}
Human Readable Output#

Endpoints#

active_directoryaliascontent_versiondomainendpoint_idendpoint_nameendpoint_statusendpoint_typeendpoint_versionfirst_seengroup_nameinstall_dateinstallation_packageipis_isolatedlast_seenos_typeusers
111-17757ea303670c76e4ad09600c8b346f7c804aaaaa.compute.internalCONNECTEDAGENT_TYPE_SERVER7.0.0.191515757959696441575795969644linux172.31.11.11AGENT_UNISOLATED1579290023629AGENT_OS_LINUXec2-user
111-17757WORKGROUPf8a2f58846b542579c12090652e79f3dEC2AMAZ-P7PPOI4CONNECTEDAGENT_TYPE_SERVER7.0.0.2779715757963817391575796381739Windows Server 20162.2.2.2AGENT_UNISOLATED1579289957412AGENT_OS_WINDOWSAdministrator

xdr-get-distribution-versions#


Gets a list of all the agent versions to use for creating a distribution list.

Base Command#

xdr-get-distribution-versions

Input#

There are no input arguments for this command.

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.DistributionVersions.windowsUnknownA list of Windows agent versions.
PaloAltoNetworksXDR.DistributionVersions.linuxUnknownA list of Linux agent versions.
PaloAltoNetworksXDR.DistributionVersions.macosUnknownA list of Mac agent versions.
Command Example#

!xdr-get-distribution-versions

Context Example#
{
"PaloAltoNetworksXDR.DistributionVersions": {
"windows": [
"5.0.8.29673",
"5.0.9.30963",
"6.1.4.28751",
"7.0.0.28644"
],
"macos": [
"6.1.4.1681",
"7.0.0.1914"
],
"linux": [
"6.1.4.1680",
"7.0.0.1916"
]
}
}
Human Readable Output#

windows#

versions
5.0.8.29673
5.0.9.30963
6.1.4.28751
7.0.0.28644

linux#

versions
6.1.4.1680
7.0.0.1916

macos#

versions
6.1.4.1681
7.0.0.1914

xdr-create-distribution#


Creates an installation package. This is an asynchronous call that returns the distribution ID. This does not mean that the creation succeeded. To confirm that the package has been created, check the status of the distribution by running the Get Distribution Status API.

Base Command#

xdr-create-distribution

Input#

Argument NameDescriptionRequired
nameA string representing the name of the installation package.Required
platformString, valid values are:
• windows
• linux
• macos
• android. Possible values are: windows, linux, macos, android.
Required
package_typeA string representing the type of package to create.
standalone - An installation for a new agent
upgrade - An upgrade of an agent from ESM. Possible values are: standalone, upgrade.
Required
agent_versionagent_version returned from xdr-get-distribution-versions. Not required for Android platfom.Required
descriptionInformation about the package.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.Distribution.idStringThe installation package ID.
PaloAltoNetworksXDR.Distribution.nameStringThe name of the installation package.
PaloAltoNetworksXDR.Distribution.platformStringThe installation OS.
PaloAltoNetworksXDR.Distribution.agent_versionStringAgent version.
PaloAltoNetworksXDR.Distribution.descriptionStringInformation about the package.
Command Example#

!xdr-create-distribution agent_version=6.1.4.1680 name="dist_1" package_type=standalone platform=linux description="some description"

Context Example#
{
"PaloAltoNetworksXDR.Distribution": {
"description": "some description",
"package_type": "standalone",
"platform": "linux",
"agent_version": "6.1.4.1680",
"id": "43aede7f846846fa92b50149663fbb25",
"name": "dist_1"
}
}
Human Readable Output#

Distribution 43aede7f846846fa92b50149663fbb25 created successfully

xdr-get-distribution-url#


Gets the distribution URL for downloading the installation package.

Base Command#

xdr-get-distribution-url

Input#

Argument NameDescriptionRequired
distribution_idThe ID of the installation package.
Copy the distribution_id from the "id" field on Endpoints > Agent Installation page.
Required
package_typeThe installation package type. Valid
values are:
• upgrade
• sh - For Linux
• rpm - For Linux
• deb - For Linux
• pkg - For Mac
• x86 - For Windows
• x64 - For Windows. Possible values are: upgrade, sh, rpm, deb, pkg, x86, x64.
Required

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.Distribution.idStringDistribution ID.
PaloAltoNetworksXDR.Distribution.urlStringURL for downloading the installation package.
Command Example#

!xdr-get-distribution-url distribution_id=2c74c11b63074653aa01d575a82bf52a package_type=sh

xdr-get-create-distribution-status#


Gets the status of the installation package.

Base Command#

xdr-get-create-distribution-status

Input#

Argument NameDescriptionRequired
distribution_idsA comma-separated list of distribution IDs to get the status of.Required

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.Distribution.idStringDistribution ID.
PaloAltoNetworksXDR.Distribution.statusStringThe status of installation package.
Command Example#

!xdr-get-create-distribution-status distribution_ids=2c74c11b63074653aa01d575a82bf52a

xdr-get-audit-management-logs#


Gets management logs. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of management logs from the start of the result set (start by counting from 0).

Context Example#
{
"PaloAltoNetworksXDR.Distribution": [
{
"status": "Completed",
"id": "2c74c11b63074653aa01d575a82bf52a"
}
]
}
Human Readable Output#

Distribution Status#

idstatus
2c74c11b63074653aa01d575a82bf52aCompleted

Base Command#

xdr-get-audit-management-logs

Input#

Argument NameDescriptionRequired
emailUser’s email address.Optional
typeThe audit log type. Possible values are: LIVE_TERMINAL, RULES, AUTH, RESPONSE, INCIDENT_MANAGEMENT, ENDPOINT_MANAGEMENT, ALERT_WHITELIST, PUBLIC_API, DISTRIBUTIONS, STARRED_INCIDENTS, POLICY_PROFILES, DEVICE_CONTROL_PROFILE, HOST_FIREWALL_PROFILE, POLICY_RULES, PROTECTION_POLICY, DEVICE_CONTROL_TEMP_EXCEPTIONS, DEVICE_CONTROL_GLOBAL_EXCEPTIONS, GLOBAL_EXCEPTIONS, MSSP, REPORTING, DASHBOARD, BROKER_VM.Optional
sub_typeThe audit log subtype.Optional
resultResult type. Possible values are: SUCCESS, FAIL, PARTIAL.Optional
timestamp_gteReturn logs for which the timestamp is after 'log_time_after'.
Supported values:
1579039377301 (time in milliseconds)
"3 days" (relative date)
"2019-10-21T23:45:00" (date).
Optional
timestamp_lteReturn logs for which the timestamp is before the 'log_time_after'.
Supported values:
1579039377301 (time in milliseconds)
"3 days" (relative date)
"2019-10-21T23:45:00" (date).
Optional
pagePage number (for pagination). The default is 0 (the first page). Default is 0.Optional
limitMaximum number of audit logs to return per page. The default and maximum is 30. Default is 30.Optional
sort_bySpecifies the field by which to sort the results. By default the sort is defined as creation-time and DESC. Can be "type", "sub_type", "result", or "timestamp". Possible values are: type, sub_type, result, timestamp.Optional
sort_orderThe sort order. Can be "asc" (ascending) or "desc" (descending). Default set to "desc". Possible values are: asc, desc. Default is desc.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_IDNumberAudit log ID.
PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_OWNER_NAMEStringAudit owner name.
PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_OWNER_EMAILStringAudit owner email address.
PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ASSET_JSONStringAsset JSON.
PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ASSET_NAMESStringAudit asset names.
PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_HOSTNAMEStringHost name.
PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_RESULTStringAudit result.
PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_REASONStringAudit reason.
PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_DESCRIPTIONStringDescription of the audit.
PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ENTITYStringAudit entity (e.g., AUTH, DISTRIBUTIONS).
PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ENTITY_SUBTYPEStringEntity subtype (e.g., Login, Create).
PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_CASE_IDNumberAudit case ID.
PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_INSERT_TIMEDateLog's insert time.

xdr-get-audit-agent-reports#


Gets agent event reports. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of reports from the start of the result set (start by counting from 0).

Base Command#

xdr-get-audit-agent-reports

Input#

Argument NameDescriptionRequired
endpoint_idsA comma-separated list of endpoint IDs.Optional
endpoint_namesA comma-separated list of endpoint names.Optional
typeThe report type. Can be "Installation", "Policy", "Action", "Agent Service", "Agent Modules", or "Agent Status". Possible values are: Installation, Policy, Action, Agent Service, Agent Modules, Agent Status.Optional
sub_typeThe report subtype. Possible values are: Install, Uninstall, Upgrade, Local Configuration, Content Update, Policy Update, Process Exception, Hash Exception, Scan, File Retrieval, File Scan, Terminate Process, Isolate, Cancel Isolation, Payload Execution, Quarantine, Restore, Stop, Start, Module Initialization, Local Analysis Model, Local Analysis Feature Extraction, Fully Protected, OS Incompatible, Software Incompatible, Kernel Driver Initialization, Kernel Extension Initialization, Proxy Communication, Quota Exceeded, Minimal Content, Reboot Required, Missing Disc Access.Optional
resultThe result type. Can be "Success" or "Fail". If not passed, returns all event reports. Possible values are: Success, Fail.Optional
timestamp_gteReturn logs that their timestamp is greater than 'log_time_after'.
Supported values:
1579039377301 (time in milliseconds)
"3 days" (relative date)
"2019-10-21T23:45:00" (date).
Optional
timestamp_lteReturn logs for which the timestamp is before the 'timestamp_lte'.

Supported values:
1579039377301 (time in milliseconds)
"3 days" (relative date)
"2019-10-21T23:45:00" (date).
Optional
pagePage number (for pagination). The default is 0 (the first page). Default is 0.Optional
limitThe maximum number of reports to return. Default and maximum is 30. Default is 30.Optional
sort_byThe field by which to sort results. Can be "type", "category", "trapsversion", "timestamp", or "domain"). Possible values are: type, category, trapsversion, timestamp, domain.Optional
sort_orderThe sort order. Can be "asc" (ascending) or "desc" (descending). Default is "asc". Possible values are: asc, desc. Default is asc.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.AuditAgentReports.ENDPOINTIDStringEndpoint ID.
PaloAltoNetworksXDR.AuditAgentReports.ENDPOINTNAMEStringEndpoint name.
PaloAltoNetworksXDR.AuditAgentReports.DOMAINStringAgent domain.
PaloAltoNetworksXDR.AuditAgentReports.TRAPSVERSIONStringTraps version.
PaloAltoNetworksXDR.AuditAgentReports.RECEIVEDTIMEDateReceived time in Epoch time.
PaloAltoNetworksXDR.AuditAgentReports.TIMESTAMPDateTimestamp in Epoch time.
PaloAltoNetworksXDR.AuditAgentReports.CATEGORYStringReport category (e.g., Audit).
PaloAltoNetworksXDR.AuditAgentReports.TYPEStringReport type (e.g., Action, Policy).
PaloAltoNetworksXDR.AuditAgentReports.SUBTYPEStringReport subtype (e.g., Fully Protected,Policy Update,Cancel Isolation).
PaloAltoNetworksXDR.AuditAgentReports.RESULTStringReport result.
PaloAltoNetworksXDR.AuditAgentReports.REASONStringReport reason.
PaloAltoNetworksXDR.AuditAgentReports.DESCRIPTIONStringAgent report description.
Endpoint.IDStringThe unique ID within the tool retrieving the endpoint.
Endpoint.HostnameStringThe hostname that is mapped to this endpoint.
Endpoint.DomainStringThe domain of the endpoint.

xdr-blocklist-files#


Block lists requested files which have not already been block listed or added to allow lists.

Base Command#

xdr-blocklist-files

Input#

Argument NameDescriptionRequired
incident_idLinks the response action to the triggered incident.Optional
hash_listString that represents a list of hashed files you want to block list. Must be a valid SHA256 hash.Required
commentString that represents additional information regarding the action.Optional
detailed_responseChoose either regular response or detailed response. Default value = false, regular response. Possible values are: true, false. Default is false.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.blocklist.added_hashesNumberAdded fileHash to blocklist
PaloAltoNetworksXDR.blocklist.excluded_hashesNumberAdded fileHash to blocklist

xdr-allowlist-files#


Adds requested files to allow list if they are not already on block list or allow list.

Base Command#

xdr-allowlist-files

Input#

Argument NameDescriptionRequired
incident_idLinks the response action to the triggered incident.Optional
hash_listString that represents a list of hashed files you want to add to allow lists. Must be a valid SHA256 hash.Required
commentString that represents additional information regarding the action.Optional
detailed_responseChoose either regular response or detailed response. Default value = false, regular response. Possible values are: true, false. Default is false.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.allowlist.added_hashesNumberAdded fileHash to allowlist
PaloAltoNetworksXDR.allowlist.excluded_hashesNumberAdded fileHash to allowlist

xdr-file-quarantine#


Quarantines a file on selected endpoints. You can select up to 1000 endpoints.

Base Command#

xdr-file-quarantine

Input#

Argument NameDescriptionRequired
incident_idAllows to link the response action to the incident that triggered it.Optional
endpoint_id_listList of endpoint IDs.Required
file_pathString that represents the path of the file you want to quarantine.Required
file_hashString that represents the file’s hash. Must be a valid SHA256 hash.Required
interval_in_secondsInterval in seconds between each poll.Optional
timeout_in_secondsPolling timeout in seconds.Optional
action_idFor polling use.Optional

Context Output#

There is no context output for this command.

xdr-get-quarantine-status#


Retrieves the quarantine status for a selected file.

Base Command#

xdr-get-quarantine-status

Input#

Argument NameDescriptionRequired
endpoint_idString the represents the endpoint ID.Required
file_hashString that represents the file hash. Must be a valid SHA256 hash.Required
file_pathString that represents the file path.Required

Context Output#

There is no context output for this command.

xdr-file-restore#


Restores a quarantined file on requested endpoints.

Base Command#

xdr-file-restore

Input#

Argument NameDescriptionRequired
incident_idAllows to link the response action to the incident that triggered it.Optional
file_hashString that represents the file in hash. Must be a valid SHA256 hash.Required
endpoint_idString that represents the endpoint ID. If you do not enter a specific endpoint ID, the request will run restore on all endpoints which relate to the quarantined file you defined.Optional
interval_in_secondsInterval in seconds between each poll.Optional
timeout_in_secondsPolling timeout in seconds.Optional
action_idFor polling use.Optional

Context Output#

There is no context output for this command.

xdr-endpoint-scan-execute#


Runs a scan on a selected endpoint. To scan all endpoints, run this command with argument all=true. Do note that scanning all the endpoints may cause performance issues and latency.

Base Command#

xdr-endpoint-scan-execute

Input#

Argument NameDescriptionRequired
incident_idAllows to link the response action to the incident that triggered it.Optional
endpoint_id_listList of endpoint IDs.Optional
dist_nameName of the distribution list.Optional
gte_first_seenEpoch timestamp in milliseconds.Optional
gte_last_seenEpoch timestamp in milliseconds.Optional
lte_first_seenEpoch timestamp in milliseconds.Optional
lte_last_seenEpoch timestamp in milliseconds.Optional
ip_listList of IP addresses.Optional
group_nameName of the endpoint group.Optional
platformType of operating system. Possible values are: windows, linux, macos, android.Optional
aliasEndpoint alias name.Optional
isolateWhether an endpoint has been isolated. Can be "isolated" or "unisolated". Possible values are: isolated, unisolated.Optional
hostnameName of the host.Optional
allWhether to scan all of the endpoints or not. Default is false. Scanning all of the endpoints may cause performance issues and latency. Possible values are: true, false. Default is false.Optional
action_idFor polling use.Optional
interval_in_secondsInterval in seconds between each poll.Optional
timeout_in_secondsPolling timeout in seconds.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.endpointScan.actionIdNumberThe action ID of the scan request.
PaloAltoNetworksXDR.endpointScan.abortedBooleanWas the scan aborted.

xdr-endpoint-scan-abort#


Cancel the scan of selected endpoints. A scan can only be aborted if the selected endpoints are Pending or In Progress. To scan all endpoints, run the command with the argument all=true. Note that scanning all of the endpoints may cause performance issues and latency.

Base Command#

xdr-endpoint-scan-abort

Input#

Argument NameDescriptionRequired
incident_idAllows to link the response action to the incident that triggered it.Optional
endpoint_id_listList of endpoint IDs.Optional
dist_nameName of the distribution list.Optional
gte_first_seenEpoch timestamp in milliseconds.Optional
gte_last_seenEpoch timestamp in milliseconds.Optional
lte_first_seenEpoch timestamp in milliseconds.Optional
lte_last_seenEpoch timestamp in milliseconds.Optional
ip_listList of IP addresses.Optional
group_nameName of the endpoint group.Optional
platformType of operating system. Possible values are: windows, linux, macos, android.Optional
aliasEndpoint alias name.Optional
isolateWhether an endpoint has been isolated. Can be "isolated" or "unisolated". Possible values are: isolated, unisolated.Optional
hostnameName of the host.Optional
allWhether to scan all of the endpoints or not. Default is false. Note that scanning all of the endpoints may cause performance issues and latency. Possible values are: true, false. Default is false.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.endpointScan.actionIdUnknownThe action id of the abort scan request.
PaloAltoNetworksXDR.endpointScan.abortedBooleanWas the scan aborted.

get-mapping-fields#


Get mapping fields from remote incident. Please note that this method will not update the current incident, it's here for debugging purposes.

Base Command#

get-mapping-fields

Input#

There are no input arguments for this command.

Context Output#

There is no context output for this command.

get-remote-data#


Get remote data from a remote incident. Please note that this method will not update the current incident, it's here for debugging purposes.

Base Command#

get-remote-data

Input#

Argument NameDescriptionRequired
idThe remote incident id.Required
lastUpdateUTC timestamp in seconds. The incident is only updated if it was modified after the last update time. Default is 0.Optional

Context Output#

There is no context output for this command.

get-modified-remote-data#


Get the list of incidents that were modified since the last update. Please note that this method is here for debugging purposes. get-modified-remote-data is used as part of a Mirroring feature, which is available since version 6.1.

Base Command#

get-modified-remote-data

Input#

Argument NameDescriptionRequired
lastUpdateDate string representing the local time.The incident is only returned if it was modified after the last update time.Optional

Context Output#

There is no context output for this command.

xdr-get-policy#


Gets the policy name for a specific endpoint.

Base Command#

xdr-get-policy

Input#

Argument NameDescriptionRequired
endpoint_idThe endpoint ID. Can be retrieved by running the xdr-get-endpoints command.Required

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.PolicystringThe policy allocated with the endpoint.
PaloAltoNetworksXDR.Policy.policy_namestringName of the policy allocated with the endpoint.
PaloAltoNetworksXDR.Policy.endpoint_idstringEndpoint ID.

xdr-get-scripts#


Gets a list of scripts available in the scripts library.

Base Command#

xdr-get-scripts

Input#

Argument NameDescriptionRequired
script_nameA comma-separated list of the script names.Optional
descriptionA comma-separated list of the script descriptions.Optional
created_byA comma-separated list of the users who created the script.Optional
limitThe maximum number of scripts returned to the War Room. Default is 50.Optional
offset(Int) Offset in the data set. Default is 0.Optional
windows_supportedWhether the script can be executed on a Windows operating system. Possible values are: true, false.Optional
linux_supportedWhether the script can be executed on a Linux operating system. Possible values are: true, false.Optional
macos_supportedWhether the script can be executed on a Mac operating system. Possible values are: true, false.Optional
is_high_riskWhether the script has a high-risk outcome. Possible values are: true, false.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.ScriptsUnknownThe scripts command results.
PaloAltoNetworksXDR.Scripts.script_idUnknownScript ID.
PaloAltoNetworksXDR.Scripts.namestringName of the script.
PaloAltoNetworksXDR.Scripts.descriptionstringDescription of the script.
PaloAltoNetworksXDR.Scripts.modification_dateUnknownTimestamp of when the script was last modified.
PaloAltoNetworksXDR.Scripts.created_bystringName of the user who created the script.
PaloAltoNetworksXDR.Scripts.windows_supportedbooleanWhether the script can be executed on a Windows operating system.
PaloAltoNetworksXDR.Scripts.linux_supportedbooleanWhether the script can be executed on a Linux operating system.
PaloAltoNetworksXDR.Scripts.macos_supportedbooleanWhether the script can be executed on Mac operating system.
PaloAltoNetworksXDR.Scripts.is_high_riskbooleanWhether the script has a high-risk outcome.
PaloAltoNetworksXDR.Scripts.script_uidstringGlobally Unique Identifier of the script, used to identify the script when executing.

xdr-delete-endpoints#


Deletes selected endpoints in the Cortex XDR app. You can delete up to 1000 endpoints.

Base Command#

xdr-delete-endpoints

Input#

Argument NameDescriptionRequired
endpoint_idsComma-separated list of endpoint IDs. You can retrieve the endpoint IDs from the xdr-get-endpoints command.Required

Context Output#

There is no context output for this command.

xdr-get-endpoint-device-control-violations#


Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.

Base Command#

xdr-get-endpoint-device-control-violations

Input#

Argument NameDescriptionRequired
endpoint_idsComma-separated list of endpoint IDs. You can retrieve the endpoint IDs from the xdr-get-endpoints command.Optional
typeType of violation. Possible values are: "cd-rom", "disk drive", "floppy disk", and "portable device". Possible values are: cd-rom, disk drive, floppy disk, portable device.Optional
timestamp_gteTimestamp of the violation. Violations that are greater than or equal to this timestamp will be returned. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00" (ISO date format), "3 days ago" (relative time) 1579039377301 (epoch time).Optional
timestamp_lteTimestamp of the violation. Violations that are less than or equal to this timestamp will be returned. Values can be in either ISO date format, relative time, or epoch timestamp. For example: "2019-10-21T23:45:00" (ISO date format), "3 days ago" (relative time) 1579039377301 (epoch time).Optional
ip_listComma-separated list of IP addresses.Optional
vendorName of the vendor.Optional
vendor_idVendor ID.Optional
productName of the product.Optional
product_idProduct ID.Optional
serialSerial number.Optional
hostnameHostname.Optional
violation_id_listComma-separated list of violation IDs.Optional
usernameUsername.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.EndpointViolationsUnknownEndpoint violations command results.
PaloAltoNetworksXDR.EndpointViolations.violationsUnknownA list of violations.
PaloAltoNetworksXDR.EndpointViolations.violations.os_typestringType of the operating system.
PaloAltoNetworksXDR.EndpointViolations.violations.hostnamestringHostname of the violation.
PaloAltoNetworksXDR.EndpointViolations.violations.usernamestringUsername of the violation.
PaloAltoNetworksXDR.EndpointViolations.violations.ipstringIP address of the violation.
PaloAltoNetworksXDR.EndpointViolations.violations.timestampnumberTimestamp of the violation.
PaloAltoNetworksXDR.EndpointViolations.violations.violation_idnumberViolation ID.
PaloAltoNetworksXDR.EndpointViolations.violations.typestringType of violation.
PaloAltoNetworksXDR.EndpointViolations.violations.vendor_idstringVendor ID of the violation.
PaloAltoNetworksXDR.EndpointViolations.violations.vendorstringName of the vendor of the violation.
PaloAltoNetworksXDR.EndpointViolations.violations.product_idstringProduct ID of the violation.
PaloAltoNetworksXDR.EndpointViolations.violations.productstringName of the product of the violation.
PaloAltoNetworksXDR.EndpointViolations.violations.serialstringSerial number of the violation.
PaloAltoNetworksXDR.EndpointViolations.violations.endpoint_idstringEndpoint ID of the violation.

xdr-file-retrieve#


Retrieves files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. At least one endpoint ID and one file path are necessary in order to run the command. After running this command, you can use the xdr-action-status-get command with returned action_id, to check the action status.

Base Command#

xdr-file-retrieve

Input#

Argument NameDescriptionRequired
incident_idAllows to link the response action to the incident that triggered it.Optional
endpoint_idsComma-separated list of endpoint IDs.Required
windows_file_pathsA comma-separated list of file paths on the Windows platform.Optional
linux_file_pathsA comma-separated list of file paths on the Linux platform.Optional
mac_file_pathsA comma-separated list of file paths on the Mac platform.Optional
generic_file_pathA comma-separated list of file paths in any platform. Can be used instead of the mac/windows/linux file paths. The order of the files path list must be parallel to the endpoints list order, therefore, the first file path in the list is related to the first endpoint and so on.Optional
interval_in_secondsInterval in seconds between each poll.Optional
timeout_in_secondsPolling timeout in seconds.Optional
action_idFor polling use.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.RetrievedFiles.action_idstringID of the action to retrieve files from selected endpoints.
PaloAltoNetworksXDR.RetrievedFiles.endpoint_idstringEndpoint ID. Added only when the operation is successful.
PaloAltoNetworksXDR.RetrievedFiles.file_linkstringLink to the file. Added only when the operation is successful.
PaloAltoNetworksXDR.RetrievedFiles.statusstringThe action status. Added only when the operation is unsuccessful.

xdr-retrieve-file-details#


View the file retrieved by the xdr-retrieve-files command according to the action ID. Before running this command, you can use the xdr-action-status-get command to check if this action completed successfully.

Base Command#

xdr-retrieve-file-details

Input#

Argument NameDescriptionRequired
action_idAction ID retrieved from the xdr-retrieve-files command.Required

Context Output#

PathTypeDescription
FileUnknownThe file details command results.
File.NameStringThe full file name (including the file extension).
File.EntryIDStringThe ID for locating the file in the War Room.
File.SizeNumberThe size of the file in bytes.
File.MD5StringThe MD5 hash of the file.
File.SHA1StringThe SHA1 hash of the file.
File.SHA256StringThe SHA256 hash of the file.
File.SHA512StringThe SHA512 hash of the file.
File.ExtensionStringThe file extension. For example: "xls".
File.TypeStringThe file type, as determined by libmagic (same as displayed in file entries).

xdr-get-script-metadata#


Gets the full definition of a specific script in the scripts library.

Base Command#

xdr-get-script-metadata

Input#

Argument NameDescriptionRequired
script_uidUnique identifier of the script, returned by the xdr-get-scripts command.Required

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.ScriptMetadataUnknownThe script metadata command results.
PaloAltoNetworksXDR.ScriptMetadata.script_idnumberScript ID.
PaloAltoNetworksXDR.ScriptMetadata.namestringScript name.
PaloAltoNetworksXDR.ScriptMetadata.descriptionstringScript description.
PaloAltoNetworksXDR.ScriptMetadata.modification_dateunknownTimestamp of when the script was last modified.
PaloAltoNetworksXDR.ScriptMetadata.created_bystringName of the user who created the script.
PaloAltoNetworksXDR.ScriptMetadata.is_high_riskbooleanWhether the script has a high-risk outcome.
PaloAltoNetworksXDR.ScriptMetadata.windows_supportedbooleanWhether the script can be executed on a Windows operating system.
PaloAltoNetworksXDR.ScriptMetadata.linux_supportedbooleanWhether the script can be executed on a Linux operating system.
PaloAltoNetworksXDR.ScriptMetadata.macos_supportedbooleanWhether the script can be executed on a Mac operating system.
PaloAltoNetworksXDR.ScriptMetadata.entry_pointstringName of the entry point selected for the script. An empty string indicates the script defined as just run.
PaloAltoNetworksXDR.ScriptMetadata.script_inputstringName and type for the specified entry point.
PaloAltoNetworksXDR.ScriptMetadata.script_output_typestringType of the output.
PaloAltoNetworksXDR.ScriptMetadata.script_output_dictionary_definitionsUnknownIf the script_output_type is a dictionary, an array with friendly name, name, and type for each output.

xdr-get-script-code#


Gets the code of a specific script in the script library.

Base Command#

xdr-get-script-code

Input#

Argument NameDescriptionRequired
script_uidUnique identifier of the script, returned by the xdr-get-scripts command.Required

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.ScriptCodeUnknownThe script code command results.
PaloAltoNetworksXDR.ScriptCode.codestringThe code of a specific script in the script library.
PaloAltoNetworksXDR.ScriptCode.script_uidstringUnique identifier of the script.

xdr-action-status-get#


Retrieves the status of the requested actions according to the action ID.

Base Command#

xdr-action-status-get

Input#

Argument NameDescriptionRequired
action_idThe action ID of the selected request. After performing an action, you will receive an action ID.Required

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.GetActionStatusUnknownThe action status command results.
PaloAltoNetworksXDR.GetActionStatus.endpoint_idstringEndpoint ID.
PaloAltoNetworksXDR.GetActionStatus.statusstringThe status of the specific endpoint ID.
PaloAltoNetworksXDR.GetActionStatus.action_idnumberThe specified action ID.

xdr-run-script#


Initiates a new endpoint script execution action using a script from the script library.

Base Command#

xdr-run-script

Input#

Argument NameDescriptionRequired
incident_idAllows to link the response action to the incident that triggered it.Optional
endpoint_idsComma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.Required
script_uidUnique identifier of the script. Can be retrieved by running the xdr-get-scripts command.Required
parametersDictionary contains the parameter name as key and its value for this execution as the value. For example, {"param1":"param1_value","param2":"param2_value"}.Optional
timeoutThe timeout in seconds for this execution. Default is 600.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.ScriptRun.action_idNumberID of the action initiated.
PaloAltoNetworksXDR.ScriptRun.endpoints_countNumberNumber of endpoints the action was initiated on.

xdr-snippet-code-script-execute#


Initiates a new endpoint script execution action using the provided snippet code.

Base Command#

xdr-snippet-code-script-execute

Input#

Argument NameDescriptionRequired
incident_idAllows to link the response action to the incident that triggered it.Optional
endpoint_idsComma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.Required
snippet_codeSection of a script you want to initiate on an endpoint (e.g., print("7")).Required
interval_in_secondsInterval in seconds between each poll.Optional
timeout_in_secondsPolling timeout in seconds.Optional
action_idFor polling use.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.ScriptRun.action_idNumberID of the action initiated.
PaloAltoNetworksXDR.ScriptRun.endpoints_countNumberNumber of endpoints the action was initiated on.

xdr-get-script-execution-status#


Retrieves the status of a script execution action.

Base Command#

xdr-get-script-execution-status

Input#

Argument NameDescriptionRequired
action_idAction IDs retrieved from the xdr-run-script command.Required

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.ScriptStatus.general_statusStringGeneral status of the action, considering the status of all the endpoints.
PaloAltoNetworksXDR.ScriptStatus.error_messageStringError message regarding permissions for running APIs or the action doesn’t exist.
PaloAltoNetworksXDR.ScriptStatus.endpoints_timeoutNumberNumber of endpoints in "timeout" status.
PaloAltoNetworksXDR.ScriptStatus.action_idNumberID of the action initiated.
PaloAltoNetworksXDR.ScriptStatus.endpoints_pending_abortNumberNumber of endpoints in "pending abort" status.
PaloAltoNetworksXDR.ScriptStatus.endpoints_pendingNumberNumber of endpoints in "pending" status.
PaloAltoNetworksXDR.ScriptStatus.endpoints_in_progressNumberNumber of endpoints in "in progress" status.
PaloAltoNetworksXDR.ScriptStatus.endpoints_failedNumberNumber of endpoints in "failed" status.
PaloAltoNetworksXDR.ScriptStatus.endpoints_expiredNumberNumber of endpoints in "expired" status.
PaloAltoNetworksXDR.ScriptStatus.endpoints_completed_successfullyNumberNumber of endpoints in "completed successfully" status.
PaloAltoNetworksXDR.ScriptStatus.endpoints_canceledNumberNumber of endpoints in "canceled" status.
PaloAltoNetworksXDR.ScriptStatus.endpoints_abortedNumberNumber of endpoints in "aborted" status.

xdr-get-script-execution-results#


Retrieve the results of a script execution action.

Base Command#

xdr-get-script-execution-results

Input#

Argument NameDescriptionRequired
action_idAction IDs retrieved from the xdr-run-script command.Required

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.ScriptResult.action_idNumberID of the action initiated.
PaloAltoNetworksXDR.ScriptResult.results.retrieved_filesNumberNumber of successfully retrieved files.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_ip_addressStringEndpoint IP address.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_nameStringNumber of successfully retrieved files.
PaloAltoNetworksXDR.ScriptResult.results.failed_filesNumberNumber of files failed to retrieve.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_statusStringEndpoint status.
PaloAltoNetworksXDR.ScriptResult.results.domainStringDomain to which the endpoint belongs.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_idStringEndpoint ID.
PaloAltoNetworksXDR.ScriptResult.results.execution_statusStringExecution status of this endpoint.
PaloAltoNetworksXDR.ScriptResult.results.return_valueStringValue returned by the script in case the type is not a dictionary.
PaloAltoNetworksXDR.ScriptResult.results.standard_outputStringThe STDOUT and the STDERR logged by the script during the execution.
PaloAltoNetworksXDR.ScriptResult.results.retention_dateDateTimestamp in which the retrieved files will be deleted from the server.

xdr-get-script-execution-result-files#


Gets the files retrieved from a specific endpoint during a script execution.

Base Command#

xdr-get-script-execution-result-files

Input#

Argument NameDescriptionRequired
action_idAction ID retrieved from the xdr-run-script command.Required
endpoint_idEndpoint ID. Can be retrieved by running the xdr-get-endpoints command.Required

Context Output#

PathTypeDescription
File.SizeStringThe size of the file.
File.SHA1StringThe SHA1 hash of the file.
File.SHA256StringThe SHA256 hash of the file.
File.SHA512StringThe SHA512 hash of the file.
File.NameStringThe name of the file.
File.SSDeepStringThe SSDeep hash of the file.
File.EntryIDStringEntryID of the file
File.InfoStringInformation about the file.
File.TypeStringThe file type.
File.MD5StringThe MD5 hash of the file.
File.ExtensionStringThe extension of the file.

xdr-script-commands-execute#


Initiate a new endpoint script execution of shell commands.

Base Command#

xdr-script-commands-execute

Input#

Argument NameDescriptionRequired
incident_idAllows to link the response action to the incident that triggered it.Optional
endpoint_idsComma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.Required
commandsComma-separated list of shell commands to execute.Required
timeoutThe timeout in seconds for this execution. Default is 600.Optional
interval_in_secondsInterval in seconds between each poll.Optional
timeout_in_secondsPolling timeout in seconds.Optional
action_idFor polling use.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.ScriptRun.action_idNumberID of the action initiated.
PaloAltoNetworksXDR.ScriptRun.endpoints_countNumberNumber of endpoints the action was initiated on.

xdr-file-delete-script-execute#


Initiates a new endpoint script execution to delete the specified file.

Base Command#

xdr-file-delete-script-execute

Input#

Argument NameDescriptionRequired
incident_idAllows to link the response action to the incident that triggered it.Optional
endpoint_idsComma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.Required
file_pathPaths of the files to delete, in a comma-separated list. Paths of the files to check for existence. All of the given file paths will run on all of the endpoints.Required
timeoutThe timeout in seconds for this execution. Default is 600.Optional
interval_in_secondsInterval in seconds between each poll.Optional
timeout_in_secondsPolling timeout in seconds.Optional
action_idFor polling use.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.ScriptRun.action_idNumberID of the action initiated.
PaloAltoNetworksXDR.ScriptRun.endpoints_countNumberNumber of endpoints the action was initiated on.

xdr-file-exist-script-execute#


Initiates a new endpoint script execution to check if file exists.

Base Command#

xdr-file-exist-script-execute

Input#

Argument NameDescriptionRequired
incident_idAllows to link the response action to the incident that triggered it.Optional
endpoint_idsComma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.Required
file_pathPaths of the files to check for existence, in a comma-separated list. All of the given file paths will run on all of the endpoints.Required
timeoutThe timeout in seconds for this execution. Default is 600.Optional
interval_in_secondsInterval in seconds between each poll.Optional
timeout_in_secondsPolling timeout in seconds.Optional
action_idFor polling use.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.ScriptRun.action_idNumberID of the action initiated.
PaloAltoNetworksXDR.ScriptRun.endpoints_countNumberNumber of endpoints the action was initiated on.

xdr-kill-process-script-execute#


Initiates a new endpoint script execution kill process.

Base Command#

xdr-kill-process-script-execute

Input#

Argument NameDescriptionRequired
incident_idAllows to link the response action to the incident that triggered it.Optional
endpoint_idsComma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.Required
process_nameNames of processes to kill. Will kill all of the given processes on all of the endpoints.Required
timeoutThe timeout in seconds for this execution. Default is 600.Optional
interval_in_secondsInterval in seconds between each poll.Optional
timeout_in_secondsPolling timeout in seconds.Optional
action_idFor polling use.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.ScriptRun.action_idNumberID of the action initiated.
PaloAltoNetworksXDR.ScriptRun.endpoints_countNumberNumber of endpoints the action was initiated on.

endpoint#


Returns information about an endpoint.

Base Command#

endpoint

Input#

Argument NameDescriptionRequired
idThe endpoint ID.Optional
ipThe endpoint IP address.Optional
hostnameThe endpoint hostname.Optional

Context Output#

PathTypeDescription
Endpoint.HostnameStringThe endpoint's hostname.
Endpoint.OSStringThe endpoint's operation system.
Endpoint.IPAddressStringThe endpoint's IP address.
Endpoint.IDStringThe endpoint's ID.
Endpoint.StatusStringThe endpoint's status.
Endpoint.IsIsolatedStringThe endpoint's isolation status.
Endpoint.MACAddressStringThe endpoint's MAC address.
Endpoint.VendorStringThe integration name of the endpoint vendor.

xdr-get-endpoints-by-status#


Returns the number of the connected\disconnected endpoints.

Base Command#

xdr-get-endpoints-by-status

Input#

Argument NameDescriptionRequired
statusThe status of the endpoint to filter. Possible values are: connected, disconnected, lost, uninstalled.Required
last_seen_gteAll the agents that were last seen before {last_seen_gte}. Supported
values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00"
(date).
Optional
last_seen_lteAll the agents that were last seen before {last_seen_lte}. Supported
values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00"
(date).
Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.EndpointsStatus.statusStringThe endpoint's status.
PaloAltoNetworksXDR.EndpointsStatus.countNumberThe number of endpoint's with this status.

xdr-get-cloud-original-alerts#


Returns information about each alert ID.

Base Command#

xdr-get-cloud-original-alerts

Input#

Argument NameDescriptionRequired
alert_idsA comma-separated list of alert IDs.Required

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.OriginalAlert.event._timeStringThe timestamp of the occurrence of the event.
PaloAltoNetworksXDR.OriginalAlert.event.vendorStringVendor name.
PaloAltoNetworksXDR.OriginalAlert.event.event_timestampNumberEvent timestamp.
PaloAltoNetworksXDR.OriginalAlert.event.event_typeNumberEvent type (static 500).
PaloAltoNetworksXDR.OriginalAlert.event.cloud_providerStringThe cloud provider - GCP, AZURE, or AWS.
PaloAltoNetworksXDR.OriginalAlert.event.projectStringThe project in which the event occurred.
PaloAltoNetworksXDR.OriginalAlert.event.cloud_provider_event_idStringThe ID given to the event by the cloud provider, if the ID exists.
PaloAltoNetworksXDR.OriginalAlert.event.cloud_correlation_idStringThe ID the cloud provider is using to aggregate events that are part of the same general event.
PaloAltoNetworksXDR.OriginalAlert.event.operation_name_origStringThe name of the operation that occurred, as supplied by the cloud provider.
PaloAltoNetworksXDR.OriginalAlert.event.operation_nameStringThe normalized name of the operation performed by the event.
PaloAltoNetworksXDR.OriginalAlert.event.identity_origStringContains the original identity related fields as provided by the cloud provider.
PaloAltoNetworksXDR.OriginalAlert.event.identity_nameStringThe name of the identity that initiated the action.
PaloAltoNetworksXDR.OriginalAlert.event.identity_uuidStringSame as identity_name but also contains the UUID of the identity if it exists.
PaloAltoNetworksXDR.OriginalAlert.event.identity_typeStringAn enum representing the type of the identity.
PaloAltoNetworksXDR.OriginalAlert.event.identity_sub_typeStringAn enum representing the sub-type of the identity, respective to its identity_type.
PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_nameStringThe name of the identity that invoked the action as it appears in the log.
PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_uuidStringThe UUID of the identity that invoked the action as it appears in the log.
PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_typeStringAn enum that represents the type of identity event that invoked the action.
PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_sub_typeStringAn enum that represents the respective sub_type of the type of identity (identity_type) that has invoked the action.
PaloAltoNetworksXDR.OriginalAlert.event.operation_statusStringStatus of whether the operation has succeed or failed, if provided.
PaloAltoNetworksXDR.OriginalAlert.event.operation_status_origStringThe operation status code as it appears in the log, including lookup from code number to code name.
PaloAltoNetworksXDR.OriginalAlert.event.operation_status_orig_codeStringThe operation status code as it appears in the log.
PaloAltoNetworksXDR.OriginalAlert.event.operation_status_reason_providedStringDescription of the error, if the log record indicates an error and the cloud provider supplied the reason.
PaloAltoNetworksXDR.OriginalAlert.event.resource_typeStringThe normalized type of the service that emitted the log row.
PaloAltoNetworksXDR.OriginalAlert.event.resource_type_origStringThe type of the service that omitted the log as provided by the cloud provider.
PaloAltoNetworksXDR.OriginalAlert.event.resource_sub_typeStringThe sub-type respective to the resource_type field, normalized across all cloud providers.
PaloAltoNetworksXDR.OriginalAlert.event.resource_sub_type_origStringThe sub-type of the service that emitted this log row as provided by the cloud provider.
PaloAltoNetworksXDR.OriginalAlert.event.regionStringThe cloud region of the resource that emitted the log.
PaloAltoNetworksXDR.OriginalAlert.event.zoneStringThe availability zone of the resource that emitted the log.
PaloAltoNetworksXDR.OriginalAlert.event.referenced_resourceStringThe cloud resource referenced in the audit log.
PaloAltoNetworksXDR.OriginalAlert.event.referenced_resource_nameStringSame as referenced_resource but provides only the substring that represents the resource name instead of the full asset ID.
PaloAltoNetworksXDR.OriginalAlert.event.referenced_resources_countNumberThe number of extracted resources referenced in this audit log.
PaloAltoNetworksXDR.OriginalAlert.event.user_agentStringThe user agent provided in the call to the API of the cloud provider.
PaloAltoNetworksXDR.OriginalAlert.event.caller_ipStringThe IP of the caller that performed the action in the log.
PaloAltoNetworksXDR.OriginalAlert.event.caller_ip_geolocationStringThe geolocation associated with the caller_ip's value.
PaloAltoNetworksXDR.OriginalAlert.event.caller_ip_asnNumberThe ASN of the caller_ip's value.
PaloAltoNetworksXDR.OriginalAlert.event.caller_projectStringThe project of the caller entity.
PaloAltoNetworksXDR.OriginalAlert.event.raw_logUnknownThe raw log that is being normalized.
PaloAltoNetworksXDR.OriginalAlert.event.log_nameStringThe name of the log that contains the log row.
PaloAltoNetworksXDR.OriginalAlert.event.caller_ip_asn_orgStringThe organization associated with the ASN of the caller_ip's value.
PaloAltoNetworksXDR.OriginalAlert.event.event_base_idStringEvent base ID.
PaloAltoNetworksXDR.OriginalAlert.event.ingestion_timeStringIngestion time.

xdr-remove-allowlist-files#


Removes requested files from allow list.

Base Command#

xdr-remove-allowlist-files

Input#

Argument NameDescriptionRequired
incident_idLinks the response action to the incident that triggered it.Optional
hash_listString that represents a list of hashed files you want to add to allow list. Must be a valid SHA256 hash.Required
commentString that represents additional information regarding the action.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.allowlist.removed_hashesNumberRemoved file hash

xdr-remove-blocklist-files#


Removes requested files from block list.

Base Command#

xdr-remove-blocklist-files

Input#

Argument NameDescriptionRequired
incident_idLinks the response action to the incident that triggered it.Optional
hash_listString that represents a list of hashed files you want to add to allow list. Must be a valid SHA256 hash.Required
commentString that represents additional information regarding the action.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.blocklist.removed_hashesNumberRemoved fileHash from blocklist

There is no context output for this command.

xdr-get-alerts#


Returns a list of alerts and their meta-data, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. Multiple filter arguments will be concatenated using AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value.

Base Command#

xdr-get-alerts

Input#

Argument NameDescriptionRequired
alert_idThe unique ID of the alert.Optional
severityThe severity of the alert. Possible values are: low, medium, high.Optional
custom_filtera custom filter, when using this argument, other filter arguments are not relevant except time_frame, start_time and end_time which are used to filter the time. example:
{<br/> "OR": [<br/> {<br/> "SEARCH_FIELD": "actor_process_command_line",<br/> "SEARCH_TYPE": "EQ",<br/> "SEARCH_VALUE": "path_to_file"<br/> }<br/> ]<br/> }.
Optional
Identity_typeAccount type. Possible values are: ANONYMOUS, APPLICATION, COMPUTE, FEDERATED_IDENTITY, SERVICE, SERVICE_ACCOUNT, TEMPORARY_CREDENTIALS, TOKEN, UNKNOWN, USER.Optional
agent_idA unique identifier per agent.Optional
action_external_hostnameThe hostname to connect to. In case of a proxy connection, this value will differ from action_remote_ip.Optional
rule_idA string identifying the user rule.Optional
rule_nameThe name of the user rule.Optional
alert_nameThe alert name.Optional
alert_sourceThe alert source.Optional
time_frameSupports relative times or “custom” time option. If you choose the "custom" option, you should use start_time and end_time arguments. Possible values are: 60 minutes, 3 hours, 12 hours, 24 hours, 2 days, 7 days, 14 days, 30 days, custom.Optional
user_nameThe name assigned to the user_id during agent runtime.Optional
actor_process_image_nameThe file name of the binary file.Optional
causality_actor_process_image_command_lineCGO CMD.Optional
actor_process_image_command_lineTrimmed to 128 unicode chars during event serialization.
Full value reported as part of the original process event.
Optional
action_process_image_command_lineThe command line of the process created.Optional
actor_process_image_sha256SHA256 of the binary file.Optional
causality_actor_process_image_sha256SHA256 of the binary file.Optional
action_process_image_sha256SHA256 of the binary file.Optional
action_file_image_sha256SHA256 of the file related to the event.Optional
action_registry_nameThe name of the registry.Optional
action_registry_key_dataThe key data of the registry.Optional
host_ipThe host IP.Optional
action_local_ipThe local IP address for the connection.Optional
action_remote_ipRemote IP address for the connection.Optional
action_local_portThe local IP address for the connection.Optional
action_remote_portThe remote port for the connection.Optional
dst_action_external_hostnameThe hostname we connect to. In case of a proxy connection, this value will differ from action_remote_ip.Optional
sort_fieldThe field by which we will sort the results. Default is source_insert_ts.Optional
sort_orderThe order in which we sort the results. Possible values are: DESC, ASC.Optional
offsetThe first page from which we bring the alerts. Default is 0.Optional
limitThe last page from which we bring the alerts. Default is 50.Optional
start_timeRelevant when "time_frame" argument is "custom". Supports Epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss.000Z).Optional
end_timeRelevant when "time_frame" argument is "custom". Supports Epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss.000Z).Optional
starredWhether the alert is starred or not. Possible values are: true, false.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.Alert.internal_idStringThe unique ID of the alert.
PaloAltoNetworksXDR.Alert.source_insert_tsNumberThe detection timestamp.
PaloAltoNetworksXDR.Alert.alert_nameStringThe name of the alert.
PaloAltoNetworksXDR.Alert.severityStringThe severity of the alert.
PaloAltoNetworksXDR.Alert.alert_categoryStringThe category of the alert.
PaloAltoNetworksXDR.Alert.alert_action_statusStringThe alert action.
PaloAltoNetworksXDR.Alert.alert_nameStringThe alert name.
PaloAltoNetworksXDR.Alert.alert_descriptionStringThe alert description.
PaloAltoNetworksXDR.Alert.agent_ip_addressesStringThe host IP
PaloAltoNetworksXDR.Alert.agent_hostnameStringThe host name
PaloAltoNetworksXDR.Alert.mitre_tactic_id_and_nameStringThe MITRE attack tactic.
PaloAltoNetworksXDR.Alert.mitre_technique_id_and_nameStringThe MITRE attack technique.
PaloAltoNetworksXDR.Alert.starredBooleanWhether the alert is starred or not.

xdr-get-contributing-event#


Retrieves contributing events for a specific alert.

Base Command#

xdr-get-contributing-event

Input#

Argument NameDescriptionRequired
alert_idsThe alert ID's from where to retrieve the contributing events.Required
limitThe maximum number of contributing events to retrieve. Default is 50.Optional
page_numberThe page number to retrieve. Default (and minimum) is 1.Optional
page_sizeThe page size. Default is 50.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.ContributingEvent.alertIDStringThe alert ID.
PaloAltoNetworksXDR.ContributingEvent.eventsUnknownContributing events per alert.

Command example#

``!xdr-get-contributing-event alert_ids=[123456 , 123457]````

Context Example#

{
"PaloAltoNetworksXDR": {
"ContributingEvent": [
{
"alertID": "123456",
"events": [
{
"Domain": "WIN10X64",
"Host_Name": "WIN10X64",
"Logon_Type": "7",
"Process_Name": "C:\\Windows\\System32\\svchost.exe",
"Raw_Message": "An account was successfully logged on.",
"Source_IP": "1.1.1.1",
"User_Name": "xsoar",
"111111": 15,
"222222": 165298280000,
"333333": "abcdef",
"444444": 1,
"555555": "ghijk",
"_is_cardable": true,
"_product": "XDR agent",
"_time": 165298280000,
"_vendor": "PANW",
"insert_timestamp": 165298280001
}
]
},
{
"alert_id": "123457",
"events": [
{
"Domain": "WIN10X64",
"Host_Name": "WIN10X64",
"Logon_Type": "7",
"Process_Name": "C:\\Windows\\System32\\svchost.exe",
"Raw_Message": "An account was successfully logged on",
"Source_IP": "1.1.1.1",
"User_Name": "xsoar",
"111111": 15,
"222222": 165298280000,
"333333": "abcdef",
"444444": 1,
"555555": "ghijk",
"_is_cardable": true,
"_product": "XDR agent",
"_time": 165298280000,
"_vendor": "PANW",
"insert_timestamp": 165298280001
}
]
}
]
}
}

Human Readable Output#

Contributing events#

Alert _ IdEvents
123456- Logon_Type: 7
User_Name: xsoar
Domain: WIN10X64
Source_IP: 1.1.1.1
Process_Name: C:\Windows\System32\svchost.exe
Host_Name: WIN10X64
Raw_Message: An account was successfully logged on. _time: 165298280000
555555: a1b2c3d4
222222: 165298280000
333333: abcdef
111111: 15
444444: 1
insert_timestamp: 165298280001
_vendor: PANW
_product: XDR agent
_is_cardable: true
123457- Logon_Type: 7
User_Name: xsoar
Domain: WIN10X64
Source_IP: 1.1.1.1
Process_Name: C:\Windows\System32\svchost.exe
Host_Name: WIN10X64
Raw_Message: An account was successfully logged on. _time: 165298280000
555555: ghijk
222222: 165298280000
333333: abcdef
111111: 15
444444: 1
insert_timestamp: 165298280001
_vendor: PANW
_product: XDR agent
_is_cardable: true

xdr-replace-featured-field#


Replace the featured hosts\users\ip addresses\active directory groups listed in your environment.

Base Command#

xdr-replace-featured-field

Input#

Argument NameDescriptionRequired
field_typeThe field type that should change. Possible values are: hosts, users, ip_addresses, ad_groups.Required
valuesString value that defines the new field. Maximum length is 256 characters.Required
commentsString that represents additional information regarding the featured alert field.Optional
ad_typeString value identifying if you want to replace to an active directory group or organizational unit.
Possible values are: group, ou. Default is group.
Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.FeaturedField.fieldTypeStringThe field type that changed.
PaloAltoNetworksXDR.FeaturedField.fieldsStringThe string value that defines the new field.

Command example#

``!xdr-replace-featured-field field_type=ip_addresses values=["1.1.1.1"] comments=new ip address````

Context Example#

{
"PaloAltoNetworksXDR": {
"FeaturedField": {
"fieldType": "ip_addresses",
"fields": [
{
"comment": "new ip address",
"value": "1.1.1.1"
}
]
}
}
}

Human Readable Output#

Replaced featured: ip_addresses#

CommentValue
new ip address1.1.1.1

xdr-script-run#


This command will soon be deprecated; prefer xdr-script-run instead. Initiates a new endpoint script execution action using a script from the script library.

Base Command#

xdr-script-run

Input#

Argument NameDescriptionRequired
incident_idAllows linking the response action to the incident that triggered it.Optional
endpoint_idsA comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.Required
script_uidUnique identifier of the script. Can be retrieved by running the xdr-get-scripts command.Required
parametersDictionary containing the parameter name as key and its value for this execution as the value. For example, {"param1":"param1_value","param2":"param2_value"}.Optional
timeoutThe timeout in seconds for this execution. Default is 600.Optional
polling_interval_in_secondsInterval in seconds between each poll. Default is 10.Optional
polling_timeout_in_secondsPolling timeout in seconds. Default is 600.Optional

Context Output#

PathTypeDescription
PaloAltoNetworksXDR.ScriptResult.action_idNumberID of the action initiated.
PaloAltoNetworksXDR.ScriptResult.results.retrieved_filesNumberNumber of successfully retrieved files.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_ip_addressStringEndpoint IP address.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_nameStringNumber of successfully retrieved files.
PaloAltoNetworksXDR.ScriptResult.results.failed_filesNumberNumber of files failed to retrieve.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_statusStringEndpoint status.
PaloAltoNetworksXDR.ScriptResult.results.domainStringDomain to which the endpoint belongs.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_idStringEndpoint ID.
PaloAltoNetworksXDR.ScriptResult.results.execution_statusStringExecution status of this endpoint.
PaloAltoNetworksXDR.ScriptResult.results.return_valueStringValue returned by the script in case the type is not a dictionary.
PaloAltoNetworksXDR.ScriptResult.results.standard_outputStringThe STDOUT and the STDERR logged by the script during the execution.
PaloAltoNetworksXDR.ScriptResult.results.retention_dateDateTimestamp in which the retrieved files will be deleted from the server.

Command example#

!xdr-script-run endpoint_ids=1 script_uid=123

Human Readable Output#

Waiting for the script to finish running on the following endpoints: ['1']...

Script Execution Results - 10368#

_return_valuedomainendpoint_idendpoint_ip_addressendpoint_nameendpoint_statusexecution_statusfailed_filesretention_dateretrieved_filesstandard_output
Name: return valueWORKGROUP11.1.1.1WIN10X64STATUS_010_CONNECTEDCOMPLETED_SUCCESSFULLY00

Context Example#

{
"PaloAltoNetworksXDR": {
"ScriptResult": {
"results": [
{
"domain": "WORKGROUP",
"endpoint_name": "WIN10X64",
"retrieved_files": 0,
"failed_files": 0,
"standard_output": "",
"_return_value": [
"return_value"
],
"command_output": [
"command_output"
],
"endpoint_status": "STATUS_010_CONNECTED",
"command": "_return_value",
"endpoint_id": "1",
"endpoint_ip_address": [
"1.1.1.1"
],
"execution_status": "COMPLETED_SUCCESSFULLY",
"retention_date": null
}
],
"action_id": 4444
}
}
}