Cortex XDR - Classifier

Classifies Cortex XDR incidents.

Cortex XDR by Palo Alto Networks Classification

Details

ID	`Cortex XDR - IR`
Type	classification
Version	-1
From Version	6.0.0
Default Incident Type	—
Feed	No

Key Type Map

Key	Incident Type
`PortScan`	Cortex XDR Port Scan
`XDR Incident`	Cortex XDR Incident

Source

classifier-PaloAltoNetworks_CortexXDR.json

Download History Raw

{
	"fromVersion": "6.0.0",
	"name": "Cortex XDR - Classifier",
	"type": "classification",
	"id": "Cortex XDR - IR",
	"description": "Classifies Cortex XDR incidents.",
	"defaultIncidentType": "",
	"keyTypeMap": {
		"PortScan": "Cortex XDR Port Scan",
		"XDR Incident": "Cortex XDR Incident"
	},
	"transformer": {
		"complex": {
			"accessor": "",
			"filters": [],
			"root": "description",
			"transformers": [
				{
					"args": {
						"dt": {
							"isContext": false,
							"value": {
								"complex": null,
								"simple": ".=val \u0026\u0026 val.toLowerCase().indexOf(\"port scan\") \u003e -1 ? \"PortScan\" : \"XDR Incident\""
							}
						}
					},
					"operator": "DT"
				}
			]
		},
		"simple": ""
	},
	"version": -1
}