Skip to main content

Expanse Unmanaged Cloud

This Playbook is part of the Cortex Xpanse by Palo Alto Networks Pack.#

Supported versions

Supported Cortex XSOAR versions: 6.0.0 and later.

Subplaybook for bringing rogue cloud accounts under management.


This playbook uses the following sub-playbooks, integrations, and scripts.


  • This does not use any sub-playbooks


  • ExpanseV2


  • This playbook does not use any scripts.


  • domain
  • certificate
  • expanse-get-issue
  • expanse-get-services

Playbook Inputs#

NameDescriptionDefault ValueRequired
ExpanseCloudManagedIssueIdID of Expanse Issueincident.expanseissueidOptional
ExpanseCloudManagedIPv4IPv4 of Cloud assetincident.labels.ipOptional
ExpanseCloudManagedEmailBodyEmail body to send to potential ownerInfosec has identified a security issue on a cloud service we believe may belong to you or your team. This asset or service does not appear to be behind proper compliance controls. \n\nPlease get in touch with your Infosec team to define proper remediation access.Optional

Playbook Outputs#

There are no outputs for this playbook.

Playbook Image#

Expanse Check ServiceNow CMDB