Cortex Core - IR

The Cortex Core IR integration uses the Cortex API for detection and response, by natively integrating network, endpoint, and cloud data to stop sophisticated attacks.

Configure Investigation & Response in Cortex

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

core-isolate-endpoint

Isolates the specified endpoint.

Base Command

core-isolate-endpoint

Input

Context Output

core-unisolate-endpoint

Reverses the isolation of an endpoint.

Base Command

core-unisolate-endpoint

Input

Context Output

core-get-endpoints

Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0).

Base Command

core-get-endpoints

Input

Context Output

Command example

!core-get-endpoints isolate="unisolated" first_seen_gte="3 month" page="0" limit="30" sort_order="asc"

Context Example

{
  "Account": [
    {
      "Domain": "xdrdummyurl.com",
      "Username": "xdrdummyurl.com"
    }
  ],
  "Core": {
    "Endpoint": [
      {
        "active_directory": null,
        "alias": "",
        "content_release_timestamp": 1643023344000,
        "content_version": "360-81029",
        "domain": "xdrdummyurl.com",
        "endpoint_id": "87ae5fc622604ea4809dd28f01c436d0",
        "endpoint_name": "dummy_new_name2",
        "endpoint_status": "DISCONNECTED",
        "endpoint_type": "AGENT_TYPE_SERVER",
        "endpoint_version": "1.1.1.1",
        "first_seen": 1642943216960,
        "group_name": [],
        "install_date": 1642943217006,
        "installation_package": "",
        "ip": [
          "1.1.1.1"
        ],
        "is_isolated": "AGENT_UNISOLATED",
        "isolated_date": null,
        "last_content_update_time": 1643026320796,
        "last_seen": 1643026320166,
        "operational_status": "PROTECTED",
        "operational_status_description": null,
        "os_type": "AGENT_OS_WINDOWS",
        "os_version": "1.1.1",
        "scan_status": "SCAN_STATUS_NONE",
        "users": [
          "woo@demisto.com"
        ]
      }
    ]
  }
}

Human Readable Output

Endpoints

active_directory	alias	content_release_timestamp	content_version	domain	endpoint_id	endpoint_name	endpoint_status	endpoint_type	endpoint_version	first_seen	group_name	install_date	installation_package	ip	is_isolated	isolated_date	last_content_update_time	last_seen	operational_status	operational_status_description	os_type	os_version	scan_status	users
		1643023344000	360-81029	api.xdrurl.com	87ae5fc622604ea4809dd28f01c436d0	dummy_new_name2	DISCONNECTED	AGENT_TYPE_SERVER	1.1.1.1	1642943216960		1642943217006	HOLODECK_1	1.1.1.1	AGENT_UNISOLATED		1643026320796	1643026320166	PROTECTED		AGENT_OS_WINDOWS	1.1.1.	SCAN_STATUS_NONE	woo@demisto.com

core-get-distribution-versions

Gets a list of all the agent versions to use for creating a distribution list.

Base Command

core-get-distribution-versions

Input

There are no input arguments for this command.

Context Output

Command example

#### Context Example

```json
{
    "Core": {
        "DistributionVersions": {
            "container": [
                "1.1.1.1"
            ],
            "linux": [
                "1.1.1.1"
            ],
            "macos": [
                "1.1.1.1"
            ],
            "windows": [
                "1.1.1.1"
            ]
        }
    }
}

Human Readable Output

windows

versions
1.1.1.1

linux

versions
1.1.1.1

macos

versions
1.1.1.1

container

versions
1.1.1.1

core-create-distribution

Creates an installation package. This is an asynchronous call that returns the distribution ID. This does not mean that the creation succeeded. To confirm that the package has been created, check the status of the distribution by running the Get Distribution Status API.

Base Command

core-create-distribution

Input

Context Output

Command example

!core-create-distribution agent_version=6.1.4.1680 name="dist_1" package_type=standalone platform=linux description="some description"

Context Example

{
    "Core": {
        "Distribution": {
            "agent_version": "6.1.4.1680",
            "description": "some description",
            "id": "52c0e7988a024cbab32d4cd888e44dfb",
            "name": "dist_1",
            "package_type": "standalone",
            "platform": "linux"
        }
    }
}

Human Readable Output

Distribution 52c0e7988a024cbab32d4cd888e44dfb created successfully

core-get-distribution-url

Gets the distribution URL for downloading the installation package.

Base Command

core-get-distribution-url

Input

Context Output

core-get-create-distribution-status

Gets the status of the installation package.

Base Command

core-get-create-distribution-status

Input

Context Output

core-get-audit-management-logs

Gets management logs. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of management logs from the start of the result set (start by counting from 0).

Base Command

core-get-audit-management-logs

Input

Context Output

Command example

!core-get-audit-management-logs result=SUCCESS type=DISTRIBUTIONS limit=2 timestamp_gte="3 month"

Context Example

{
    "Core": {
        "AuditManagementLogs": [
            {
                "AUDIT_ASSET_JSON": null,
                "AUDIT_ASSET_NAMES": "",
                "AUDIT_CASE_ID": null,
                "AUDIT_DESCRIPTION": "Created a Windows Standalone installer installation package 'HOLODECK_3' with agent version 7.5.1.38280",
                "AUDIT_ENTITY": "DISTRIBUTIONS",
                "AUDIT_ENTITY_SUBTYPE": "Create",
                "AUDIT_HOSTNAME": null,
                "AUDIT_ID": 1002,
                "AUDIT_INSERT_TIME": 1636017216034,
                "AUDIT_OWNER_EMAIL": "moo@demisto.com",
                "AUDIT_OWNER_NAME": "",
                "AUDIT_REASON": null,
                "AUDIT_RESULT": "SUCCESS",
                "AUDIT_SESSION_ID": null,
                "AUDIT_SEVERITY": "SEV_010_INFO"
            }
        ]
    }
}

Human Readable Output

Audit Management Logs

AUDIT_ID	AUDIT_RESULT	AUDIT_DESCRIPTION	AUDIT_OWNER_NAME	AUDIT_OWNER_EMAIL	AUDIT_ASSET_JSON	AUDIT_ASSET_NAMES	AUDIT_HOSTNAME	AUDIT_REASON	AUDIT_ENTITY	AUDIT_ENTITY_SUBTYPE	AUDIT_SESSION_ID	AUDIT_CASE_ID	AUDIT_INSERT_TIME
1002	SUCCESS	Created a Windows Standalone installer installation package ‘HOLODECK_3’ with agent version 1.1.1.1	Moo	moo@demisto.com					DISTRIBUTIONS	Create			1636017216034
1001	SUCCESS	Edited installation package ‘HOLODECK_1’	Moo	moo@demisto.com					DISTRIBUTIONS	Edit			1636017119505

core-get-audit-agent-reports

Gets agent event reports. You can filter by multiple fields, which are combined using an AND condition (OR is not supported). The maximum result set size is 100. The offset specifies the zero-based index of reports from the start of the result set (start by counting from 0).

Base Command

core-get-audit-agent-reports

Input

Context Output

Command example

!core-get-audit-agent-reports result=Success timestamp_gte="100 days" endpoint_ids=ea303670c76e4ad09600c8b346f7c804 type=Policy limit=2

core-blocklist-files

Blocks requested files that are not already on the block list or the allow list.

Base Command

core-blocklist-files

Input

Context Output

Command example

!core-blocklist-files hash_list=11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a252

Context Example

{
    "Core": {
        "blocklist": {
            "added_hashes": {
                "fileHash": [
                    "11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a252"
                ]
            }
        }
    }
}

Human Readable Output

Blocklist Files

Added _ Hashes
11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a252

core-allowlist-files

Adds requested files to the allow list if they are not already on the block list or the allow list.

Base Command

core-allowlist-files

Input

Context Output

Command example

!core-allowlist-files hash_list=11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a252

Context Example

{
    "Core": {
        "allowlist": {
            "added_hashes": {
                "fileHash": [
                    "11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a252"
                ]
            }
        }
    }
}

Human Readable Output

Allowlist Files

Added _ Hashes
11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a252

core-quarantine-files

Quarantines a file on selected endpoints. You can select up to 1000 endpoints.

Base Command

core-quarantine-files

Input

Context Output

core-get-quarantine-status

Retrieves the quarantine status of a selected file.

Base Command

core-get-quarantine-status

Input

Context Output

There is no context output for this command.

Command example

!core-get-quarantine-status endpoint_id=f8a2f58846b542579c12090652e79f3d file_hash=55f8718109829bf506b09d8af615b9f107a266e19f7a311039d1035f180b22d4 file_path=/home/ec2-user/test_file.txt

Context Example

{
    "Core": {
        "quarantineFiles": {
            "status": {
                "endpointId": "f8a2f58846b542579c12090652e79f3d",
                "fileHash": "55f8718109829bf506b09d8af615b9f107a266e19f7a311039d1035f180b22d4",
                "filePath": "/home/ec2-user/test_file.txt",
                "status": false
            }
        }
    }
}

Human Readable Output

Quarantine files status

Status	Endpoint Id	File Path	File Hash
false	f8a2f58846b542579c12090652e79f3d	/home/ec2-user/test_file.txt	55f8718109829bf506b09d8af615b9f107a266e19f7a311039d1035f180b22d4

core-restore-file

Restores a quarantined file on the requested endpoints.

Base Command

core-restore-file

Input

Context Output

core-endpoint-scan

Runs a scan on a selected endpoint. To scan all endpoints, use the argument all=true. Scanning all endpoints may affect performance and cause latency.

Base Command

core-endpoint-scan

Input

Context Output

core-endpoint-scan-abort

Cancels the scan on the selected endpoints. A scan can only be canceled if the selected endpoints are Pending or In Progress. To scan all endpoints, run the command with the argument all=true. Scanning all endpoints may impact performance and cause latency.

Base Command

core-endpoint-scan-abort

Input

Context Output

core-get-policy

Gets the policy name for a specific endpoint.

Base Command

core-get-policy

Input

Context Output

core-get-scripts

Gets a list of scripts available in the scripts library.

Base Command

core-get-scripts

Input

Context Output

Command example

!core-get-scripts created_by="Palo Alto Networks" is_high_risk=true

Context Example

{
    "Core": {
        "Scripts": [
            {
                "created_by": "Palo Alto Networks",
                "description": "Delete a file by path",
                "is_high_risk": true,
                "linux_supported": true,
                "macos_supported": true,
                "modification_date": "2021-05-04T14:33:48",
                "modification_date_timestamp": 1620138828748,
                "name": "delete_file",
                "script_id": 1,
                "script_uid": "548023b6e4a01ec51a495ba6e5d2a15d",
                "windows_supported": true
            },
            {
                "created_by": "Palo Alto Networks",
                "description": "Execute list of shell commands",
                "is_high_risk": true,
                "linux_supported": true,
                "macos_supported": true,
                "modification_date": "2022-01-05T10:14:14",
                "modification_date_timestamp": 1641377654469,
                "name": "execute_commands",
                "script_id": 2,
                "script_uid": "a6f7683c8e217d85bd3c398f0d3fb6bf",
                "windows_supported": true
            },
            {
                "created_by": "Palo Alto Networks",
                "description": "Kill all processes with a CPU usage higher than specified",
                "is_high_risk": true,
                "linux_supported": true,
                "macos_supported": true,
                "modification_date": "2022-01-05T10:14:14",
                "modification_date_timestamp": 1641377654480,
                "name": "process_kill_cpu",
                "script_id": 6,
                "script_uid": "3d928a24f61cd3c1116544900c424098",
                "windows_supported": true
            },
            {
                "created_by": "Palo Alto Networks",
                "description": "Kill all processes with a RAM usage higher than specified",
                "is_high_risk": true,
                "linux_supported": true,
                "macos_supported": true,
                "modification_date": "2021-05-04T14:33:48",
                "modification_date_timestamp": 1620138828795,
                "name": "process_kill_mem",
                "script_id": 7,
                "script_uid": "87d4547df6d4882a3c006ec58c3b8bf4",
                "windows_supported": true
            },
            {
                "created_by": "Palo Alto Networks",
                "description": "Kill processes by name",
                "is_high_risk": true,
                "linux_supported": true,
                "macos_supported": true,
                "modification_date": "2021-05-04T14:33:48",
                "modification_date_timestamp": 1620138828803,
                "name": "process_kill_name",
                "script_id": 8,
                "script_uid": "fd0a544a99a9421222b4f57a11839481",
                "windows_supported": true
            },
            {
                "created_by": "Palo Alto Networks",
                "description": "Delete registry value or delete registry key with all its values",
                "is_high_risk": true,
                "linux_supported": false,
                "macos_supported": false,
                "modification_date": "2021-05-04T14:33:48",
                "modification_date_timestamp": 1620138828812,
                "name": "registry_delete",
                "script_id": 9,
                "script_uid": "ad36488a20cdbdd1604ec4bec9da5c41",
                "windows_supported": true
            },
            {
                "created_by": "Palo Alto Networks",
                "description": "Set registry value",
                "is_high_risk": true,
                "linux_supported": false,
                "macos_supported": false,
                "modification_date": "2021-05-04T14:33:48",
                "modification_date_timestamp": 1620138828829,
                "name": "registry_set",
                "script_id": 11,
                "script_uid": "896392a13b2ef0ae75b3f2396125037d",
                "windows_supported": true
            }
        ]
    }
}

Human Readable Output

Scripts

Name	Description	Script Uid	Modification Date	Created By	Windows Supported	Linux Supported	Macos Supported	Is High Risk
delete_file	Delete a file by path	548023b6e4a01ec51a495ba6e5d2a15d	2021-05-04T14:33:48	Palo Alto Networks	true	true	true	true
execute_commands	Execute list of shell commands	a6f7683c8e217d85bd3c398f0d3fb6bf	2022-01-05T10:14:14	Palo Alto Networks	true	true	true	true
process_kill_cpu	Kill all processes with a CPU usage higher than specified	3d928a24f61cd3c1116544900c424098	2022-01-05T10:14:14	Palo Alto Networks	true	true	true	true
process_kill_mem	Kill all processes with a RAM usage higher than specified	87d4547df6d4882a3c006ec58c3b8bf4	2021-05-04T14:33:48	Palo Alto Networks	true	true	true	true
process_kill_name	Kill processes by name	fd0a544a99a9421222b4f57a11839481	2021-05-04T14:33:48	Palo Alto Networks	true	true	true	true
registry_delete	Delete registry value or delete registry key with all its values	ad36488a20cdbdd1604ec4bec9da5c41	2021-05-04T14:33:48	Palo Alto Networks	true	false	false	true
registry_set	Set registry value	896392a13b2ef0ae75b3f2396125037d	2021-05-04T14:33:48	Palo Alto Networks	true	false	false	true

core-delete-endpoints

Deletes selected endpoints in the Cortex app. You can delete up to 1000 endpoints.

Base Command

core-delete-endpoints

Input

Context Output

There is no context output for this command.

core-get-endpoint-device-control-violations

Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.

Base Command

core-get-endpoint-device-control-violations

Input

Context Output

Command example

!core-get-endpoint-device-control-violations violation_id_list=100,90,80

Context Example

{
    "Core": {
        "EndpointViolations": null
    }
}

Human Readable Output

Endpoint Device Control Violation

No entries.

core-retrieve-files

Retrieves files from selected endpoints. You can retrieve up to 20 files from no more than 10 endpoints. At least one endpoint ID and one file path are required to run the command. After running the command, use the core-action-status-get command with the returned action_id to check the action status.

Base Command

core-retrieve-files

Input

Context Output

core-retrieve-file-details

Views the file retrieved by the core-retrieve-files command using the action ID. Before running this command, use the core-action-status-get command to check if the action completed successfully.

Base Command

core-retrieve-file-details

Input

Context Output

Command example

!core-retrieve-file-details action_id=1763

Human Readable Output

Action id : 1763

Retrieved 0 files from 0 endpoints.
To get the exact action status run the core-action-status-get command

core-get-script-metadata

Gets the full definition of a specific script in the scripts library.

Base Command

core-get-script-metadata

Input

Context Output

Command example

!core-get-script-metadata script_uid=43973479d389f2ac7e99b6db88eaee40

Context Example

{
    "Core": {
        "ScriptMetadata": {
            "created_by": "Palo Alto Networks",
            "description": "List all directories under path",
            "entry_point": "run",
            "is_high_risk": false,
            "linux_supported": true,
            "macos_supported": true,
            "modification_date": 1620138828771,
            "name": "list_directories",
            "script_id": 4,
            "script_input": [
                {
                    "name": "path",
                    "type": "string"
                },
                {
                    "name": "number_of_levels",
                    "type": "number"
                }
            ],
            "script_output_dictionary_definitions": null,
            "script_output_type": "string_list",
            "script_uid": "43973479d389f2ac7e99b6db88eaee40",
            "windows_supported": true
        }
    }
}

Human Readable Output

Script Metadata

Created By	Description	Entry Point	Is High Risk	Linux Supported	Macos Supported	Modification Date	Modification Date Timestamp	Name	Script Id	Script Input	Script Output Type	Script Uid	Windows Supported
Palo Alto Networks	List all directories under path	run	false	true	true	2021-05-04T14:33:48	1620138828771	list_directories	4	{‘name’: ‘path’, ‘type’: ‘string’}, {‘name’: ‘number_of_levels’, ‘type’: ‘number’}	string_list	43973479d389f2ac7e99b6db88eaee40	true

core-get-script-code

Gets the code of a specific script in the script library.

Base Command

core-get-script-code

Input

Context Output

Command example

!core-get-script-code script_uid=548023b6e4a01ec51a495ba6e5d2a15d

Context Example

{
    "Core": {
        "ScriptCode": {
            "code": "import os\nimport sys\nimport traceback\n\n\ndef run(file_path):\n    path = os.path.expanduser(file_path)\n    path = os.path.expandvars(path)\n    if os.path.isabs(path):\n        try:\n            os.remove(path)\n        except IOError:\n            sys.stderr.write(f\"File not accessible: {path}\")\n            return False\n        except Exception as e:\n            sys.stderr.write(f\"Exception occured: {traceback.format_exc()}\")\n            return False\n    return True\n",
            "script_uid": "548023b6e4a01ec51a495ba6e5d2a15d"
        }
    }
}

Human Readable Output

Script code

``` import os
import sys
import traceback

def run(file_path):
path = os.path.expanduser(file_path)
path = os.path.expandvars(path)
if os.path.isabs(path):
try:
os.remove(path)
except IOError:
sys.stderr.write(f”File not accessible: {path}”)
return False
except Exception as e:
sys.stderr.write(f”Exception occured: {traceback.format_exc()}”)
return False
return True
```

core-action-status-get

Retrieves the status of the requested actions using the action ID.

Base Command

core-action-status-get

Input

Context Output

Command example

!core-action-status-get action_id="1819"

Context Example

{
    "Core": {
        "GetActionStatus": null
    }
}

Human Readable Output

Get Action Status

No entries.

core-run-script (Deprecated)

Deprecated. Use the core-script-run command instead.

Base Command

core-run-script

Input

Context Output

core-run-snippet-code-script

Initiates a new endpoint script execution using the provided snippet code.

Base Command

core-run-snippet-code-script

Input

Context Output

core-get-script-execution-status

Retrieves the status of a script execution.

Base Command

core-get-script-execution-status

Input

Context Output

core-get-script-execution-results

Retrieve the results of a script execution.

Base Command

core-get-script-execution-results

Input

Context Output

core-get-script-execution-result-files

Gets the files retrieved from a specific endpoint during a script execution.

Base Command

core-get-script-execution-result-files

Input

Context Output

core-run-script-execute-commands

Initiates a new endpoint script execution of shell commands.

Base Command

core-run-script-execute-commands

Input

Context Output

core-run-script-delete-file

Initiates a new endpoint script execution to delete the specified file.

Base Command

core-run-script-delete-file

Input

Context Output

core-run-script-file-exists

Initiates a new endpoint script execution to check if a file exists.

Base Command

core-run-script-file-exists

Input

Context Output

core-run-script-kill-process

Initiates a new endpoint script execution to kill a process.

Base Command

core-run-script-kill-process

Input

Context Output

endpoint

Returns information about an endpoint.

Base Command

endpoint

Input

Context Output

core-report-incorrect-wildfire

Reports to WildFire about incorrect hash verdict through Cortex.

Base Command

core-report-incorrect-wildfire

Input

Context Output

core-remove-allowlist-files

Removes the requested files from the allow list.

Base Command

core-remove-allowlist-files

Input

Context Output

Command example

!core-remove-allowlist-files hash_list=11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a252

Context Example

{
    "Core": {
        "allowlist": [
            {
                "removed_hashes": "11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a252"
            }
        ]
    }
}

Human Readable Output

Allowlist Files Removed

Removed _ Hashes
11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a252

core-remove-blocklist-files

Removes the requested files from the block list.

Base Command

core-remove-blocklist-files

Input

Context Output

Command example

!core-remove-blocklist-files hash_list=11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a252

Context Example

{
    "Core": {
        "blocklist": [
            {
                "removed_hashes": "11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a252"
            }
        ]
    }
}

Human Readable Output

Blocklist Files Removed

Removed _ Hashes
11d69fb388ff59e5ba6ca217ca04ecde6a38fa8fb306aa5f1b72e22bb7c3a252

core-add-exclusion

Adds alert exclusion rule based on filterObject.

Base Command

core-add-exclusion

Input

Context Output

Command example

!core-add-exclusion filterObject={\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"alert_category\",\"SEARCH_TYPE\":\"NEQ\",\"SEARCH_VALUE\":\"Phishing\"}]}} name=test1

Context Example

{
    "Core": {
        "exclusion": {
            "rule_id": 45
        }
    }
}

Human Readable Output

Add Exclusion

rule_id
45

core-delete-exclusion

Delete an alert exclusion rule based on rule ID.

Base Command

core-delete-exclusion

Input

Context Output

Command example

!core-delete-exclusion alert_exclusion_id=36

Context Example

{
    "Core": {
        "deletedExclusion": {
            "rule_id": null
        }
    }
}

Human Readable Output

Successfully deleted the following exclusion: 36

core-get-exclusion

Get a list of the alerts exclusion.

Base Command

core-get-exclusion

Input

Context Output

Command example

!core-get-exclusion filterObject={\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"ALERT_WHITELIST_COMMENT\",\"SEARCH_TYPE\":\"NEQ\",\"SEARCH_VALUE\":\"Phishing\"}]}}

Context Example

{
    "Core": {
        "exclusion": [
            {
                "ALERT_WHITELIST_BACKWARDS_SCAN_STATUS": "DISABLED",
                "ALERT_WHITELIST_BACKWARDS_SCAN_TIMESTAMP": null,
                "ALERT_WHITELIST_COMMENT": "",
                "ALERT_WHITELIST_HITS": 0,
                "ALERT_WHITELIST_ID": 45,
                "ALERT_WHITELIST_INDICATOR": {
                    "filter": {
                        "AND": [
                            {
                                "SEARCH_FIELD": "alert_category",
                                "SEARCH_TYPE": "NEQ",
                                "SEARCH_VALUE": "Phishing"
                            }
                        ]
                    }
                },
                "ALERT_WHITELIST_INDICATOR_TEXT": [
                    {
                        "data_type": "TEXT",
                        "dml_type": null,
                        "entity_map": null,
                        "pretty_name": "category",
                        "render_type": "attribute"
                    },
                    {
                        "data_type": null,
                        "entity_map": null,
                        "pretty_name": "!=",
                        "render_type": "operator"
                    },
                    {
                        "data_type": null,
                        "entity_map": null,
                        "pretty_name": "Phishing",
                        "render_type": "value"
                    }
                ],
                "ALERT_WHITELIST_MIGRATED_FROM_ANALYTICS": 0,
                "ALERT_WHITELIST_MODIFY_TIME": 1645102011552,
                "ALERT_WHITELIST_NAME": "test1",
                "ALERT_WHITELIST_PRETTY_USER": "Public API - 3",
                "ALERT_WHITELIST_STATUS": "ENABLED",
                "ALERT_WHITELIST_USER": "N/A"
            }
        ]
    }
}

Human Readable Output

Exclusion

ALERT_WHITELIST_BACKWARDS_SCAN_STATUS	ALERT_WHITELIST_BACKWARDS_SCAN_TIMESTAMP	ALERT_WHITELIST_COMMENT	ALERT_WHITELIST_HITS	ALERT_WHITELIST_ID	ALERT_WHITELIST_INDICATOR	ALERT_WHITELIST_INDICATOR_TEXT	ALERT_WHITELIST_MIGRATED_FROM_ANALYTICS	ALERT_WHITELIST_MODIFY_TIME	ALERT_WHITELIST_NAME	ALERT_WHITELIST_PRETTY_USER	ALERT_WHITELIST_STATUS	ALERT_WHITELIST_USER
DISABLED			0	45	filter: {“AND”: [{“SEARCH_FIELD”: “alert_category”, “SEARCH_TYPE”: “NEQ”, “SEARCH_VALUE”: “Phishing”}]}	{‘pretty_name’: ‘category’, ‘data_type’: ‘TEXT’, ‘render_type’: ‘attribute’, ‘entity_map’: None, ‘dml_type’: None}, {‘pretty_name’: ‘!=’, ‘data_type’: None, ‘render_type’: ‘operator’, ‘entity_map’: None}, {‘pretty_name’: ‘Phishing’, ‘data_type’: None, ‘render_type’: ‘value’, ‘entity_map’: None}	0	1645102011552	test1	Public API - 3	ENABLED	N/A

core-get-cloud-original-alerts

Returns information about each alert ID.

Base Command

core-get-cloud-original-alerts

Input

Context Output

core-get-dynamic-analysis

Returns dynamic analysis of each alert ID.

Base Command

core-get-dynamic-analysis

Input

Context Output

core-get-hash-analytics-prevalence

Get the prevalence of a file, identified by sha256.

Base Command

core-get-hash-analytics-prevalence

Input

Context Output

core-get-IP-analytics-prevalence

Get the prevalence of an ip, identified by ip_address.

Base Command

core-get-IP-analytics-prevalence

Input

Context Output

core-get-domain-analytics-prevalence

Get the prevalence of a domain, identified by domain_name.

Base Command

core-get-domain-analytics-prevalence

Input

Context Output

core-get-process-analytics-prevalence

Get the prevalence of a process, identified by process_name.

Base Command

core-get-process-analytics-prevalence

Input

Context Output

core-get-registry-analytics-prevalence

Get the prevalence of a registry_path, identified by key_name, value_name.

Base Command

core-get-registry-analytics-prevalence

Input

Context Output

core-get-cmd-analytics-prevalence

Get the prevalence of a process_command_line, identified by process_command_line.

Base Command

core-get-cmd-analytics-prevalence

Input

Context Output

core-add-endpoint-tag

Add a tag to one or more endpoints.

Base Command

core-add-endpoint-tag

Input

Context Output

There is no context output for this command.

Command example

!core-add-endpoint-tag endpoint_ids=1234 tag=test

Human Readable Output

Successfully added tag test to endpoint(s) [‘1234’]

core-remove-endpoint-tag

Remove a tag from one or more endpoints.

Base Command

core-remove-endpoint-tag

Input

Context Output

There is no context output for this command.

Command example

!core-remove-endpoint-tag endpoint_ids=1234 tag=test

Human Readable Output

Successfully removed tag test from endpoint(s) [‘1234’]

core-endpoint-alias-change

Gets a list of endpoints according to the passed filters, and changes their alias name. Filtering by multiple fields will be concatenated using the AND condition (OR is not supported).

Base Command

core-endpoint-alias-change

Input

Context Output

There is no context output for this command.

Command example

!core-endpoint-alias-change new_alias_name=test scan_status=success ip_list=1.1.1.1

Human Readable Output

The endpoint alias was changed successfully.
Note: If there is no error in the process, then this is the output even when the specific endpoint does not exist.

core-list-users

Retrieve a list of the current users in the environment.
Required license: Cortex XDR Pro per Endpoint, Cortex XDR Pro, or Cortex XDR Pro per TB.

Base Command

core-list-users

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Command example

#### Context Example

```json
{
    "dummy": {
        "User": [
            {
                "groups": [],
                "last_logged_in": 1648158415051,
                "role_name": "dummy",
                "scope": [],
                "user_email": "dummy@dummy.com",
                "user_first_name": "dummy",
                "user_last_name": "dummy",
                "user_type": "dummy"
            },
             {
                "groups": [],
                "last_logged_in": null,
                "role_name": "dummy",
                "scope": [],
                "user_email": "dummy@dummy.com",
                "user_first_name": "dummy",
                "user_last_name": "dummy",
                "user_type": "dummy"
            }            
        ]
    }
}

Human Readable Output

Users

First Name	Groups	Last Name	Role	Type	User email
dummy		dummy	dummy	dummy	dummy
dummy		dummy	dummy	dummy	dummy

core-list-risky-users

Retrieve the risk score of a specific user or list of users with the highest risk score in the environment along with the reason affecting each score.
Required license: Cortex XDR Pro per Endpoint, Cortex XDR Pro, or Cortex XDR Pro per TB.

Base Command

core-list-risky-users

Input

Context Output

Command example

!core-list-risky-users user_id=dummy

Context Example

{
    "Core": {
        "RiskyUser": {
            "id": "dummy",
            "reasons": [],
            "score": 0,
            "type": "user"
        }
    }
}

Human Readable Output

Risky Users

User ID	Score	Description
dummy	0

core-list-risky-hosts

Retrieve the risk score of a specific host or list of hosts with the highest risk score in the environment along with the reason affecting each score.
Required license: Cortex XDR Pro per Endpoint, Cortex XDR Pro, or Cortex XDR Pro per TB.

Base Command

core-list-risky-hosts

Input

Context Output

Command example

!core-list-risky-hosts host_id=dummy

Context Example

{
    "Core": {
        "RiskyHost": {
            "id": "dummy",
            "reasons": [],
            "score": 0,
            "type": "dummy"
        }
    }
}

Human Readable Output

Risky Hosts

Host ID	Score	Description
dummy	0

core-list-user-groups

Retrieve a list of the current user emails associated with one or more user groups in the environment.
Required license: Cortex XDR Pro per Endpoint, Cortex XDR Pro, or Cortex XDR Pro per TB.

Base Command

core-list-user-groups

Input

Context Output

Command example

!core-list-user-groups group_names=test

Context Example

{
    "Core": {
        "UserGroup": {
            "description": "test",
            "group_name": "test",
            "insert_time": 1684746187678,
            "pretty_name": null,
            "source": "Custom",
            "update_time": 1684746209062,
            "user_email": [
                null
            ]
        }
    }
}

Human Readable Output

Groups

Group Name	Group Description	User email
test	test for demo

core-get-incidents

Returns a list of incidents, which you can filter by a list of incident IDs (max. 100), the time the incident was last modified, and the time the incident was created.
If you pass multiple filtering arguments, they will be concatenated using the AND condition. The OR condition is not supported.

Required Permissions

Required Permissions For API call:
Alerts And Incidents –> View
Builtin Roles with this permission includes: “Investigator”, “Responder”, “Privileged Investigator”, “Privileged Responder”, “Viewer”, and “Instance Admin”.

Base Command

core-get-incidents

Input

Context Output

| Path | Type | Description |
| — | — |———————————————————————————————————————-|
| Core.Incident.incident_id | String | Unique ID assigned to each returned incident. |
| Core.Incident.manual_severity | String | Incident severity assigned by the user. This does not affect the calculated severity. Can be “low”, “medium”, “high” |
| Core.Incident.manual_description | String | Incident description provided by the user. |
| Core.Incident.assigned_user_mail | String | Email address of the assigned user. |
| Core.Incident.high_severity_alert_count | String | Number of alerts with the severity HIGH. |
| Core.Incident.host_count | number | Number of hosts involved in the incident. |
| Core.Incident.xdr_url | String | A link to the incident view on Cortex XDR or XSIAM. |
| Core.Incident.assigned_user_pretty_name | String | Full name of the user assigned to the incident. |
| Core.Incident.alert_count | number | Total number of alerts in the incident. |
| Core.Incident.med_severity_alert_count | number | Number of alerts with the severity MEDIUM. |
| Core.Incident.user_count | number | Number of users involved in the incident. |
| Core.Incident.severity | String | Calculated severity of the incident. Valid values are:
“low”,”medium”,”high”
|
| Core.Incident.low_severity_alert_count | String | Number of alerts with the severity LOW. |
| Core.Incident.status | String | Current status of the incident. Valid values are: “new”,”under_investigation”,”resolved_known_issue”,”resolved_duplicate”,”resolved_false_positive”,”resolved_true_positive”,”resolved_security_testing” or “resolved_other”.
|
| Core.Incident.description | String | Dynamic calculated description of the incident. |
| Core.Incident.resolve_comment | String | Comments entered by the user when the incident was resolved. |
| Core.Incident.notes | String | Comments entered by the user regarding the incident. |
| Core.Incident.creation_time | date | Date and time the incident was created on Cortex XDR or XSIAM. |
| Core.Incident.detection_time | date | Date and time that the first alert occurred in the incident. |
| Core.Incident.modification_time | date | Date and time that the incident was last modified. |

Command Example

!core-get-incidents gte_creation_time=2010-10-10T00:00:00 limit=3 sort_by_creation_time=desc

Context Example

{
    "Core.Incident": [
        {
            "host_count": 1, 
            "incident_id": "4", 
            "manual_severity": "medium", 
            "description": "5 'This alert from content  TestXDRPlaybook' alerts detected by Checkpoint - SandBlast  ", 
            "severity": "medium", 
            "modification_time": 1579290004178, 
            "assigned_user_pretty_name": null, 
            "notes": null, 
            "creation_time": 1577276587937, 
            "alert_count": 5, 
            "med_severity_alert_count": 1, 
            "detection_time": null, 
            "assigned_user_mail": null, 
            "resolve_comment": "This issue was solved in Incident number 192304", 
            "status": "new", 
            "user_count": 1, 
            "xdr_url": "https://some.xdr.url.com/incident-view/4", 
            "starred": false, 
            "low_severity_alert_count": 0, 
            "high_severity_alert_count": 4, 
            "manual_description": null
        }, 
        {
            "host_count": 1, 
            "incident_id": "3", 
            "manual_severity": "medium", 
            "description": "'test 1' generated by Virus Total - Firewall", 
            "severity": "medium", 
            "modification_time": 1579237974014, 
            "assigned_user_pretty_name": "woo@demisto.com", 
            "notes": null, 
            "creation_time": 1576100096594, 
            "alert_count": 1, 
            "med_severity_alert_count": 0, 
            "detection_time": null, 
            "assigned_user_mail": "woo@demisto.com", 
            "resolve_comment": null, 
            "status": "new", 
            "user_count": 1, 
            "xdr_url": "https://some.xdr.url.com/incident-view/3", 
            "starred": false, 
            "low_severity_alert_count": 0, 
            "high_severity_alert_count": 1, 
            "manual_description": null
        }, 
        {
            "host_count": 1, 
            "incident_id": "2", 
            "manual_severity": "high", 
            "description": "'Alert Name Example 333' along with 1 other alert generated by Virus Total - VPN & Firewall-3 and Checkpoint - SandBlast", 
            "severity": "high", 
            "modification_time": 1579288790259, 
            "assigned_user_pretty_name": null, 
            "notes": null, 
            "creation_time": 1576062816474, 
            "alert_count": 2, 
            "med_severity_alert_count": 0, 
            "detection_time": null, 
            "assigned_user_mail": null, 
            "resolve_comment": null, 
            "status": "under_investigation", 
            "user_count": 1, 
            "xdr_url": "https://some.xdr.url.com/incident-view/2", 
            "starred": false, 
            "low_severity_alert_count": 0, 
            "high_severity_alert_count": 2, 
            "manual_description": null
        }
    ]
}

Human Readable Output

Incidents

alert_count	assigned_user_mail	assigned_user_pretty_name	creation_time	description	detection_time	high_severity_alert_count	host_count	incident_id	low_severity_alert_count	manual_description	manual_severity	med_severity_alert_count	modification_time	notes	resolve_comment	severity	starred	status	user_count	xdr_url
5			1577276587937	5 ‘This alert from content TestXDRPlaybook’ alerts detected by Checkpoint - SandBlast		4	1	4	0		medium	1	1579290004178		This issue was solved in Incident number 192304	medium	false	new	1	https://some.xdr.url.com/incident-view/4
1	woo@demisto.com	woo@demisto.com	1576100096594	‘test 1’ generated by Virus Total - Firewall		1	1	3	0		medium	0	1579237974014			medium	false	new	1	https://some.xdr.url.com/incident-view/3
2			1576062816474	‘Alert Name Example 333’ along with 1 other alert generated by Virus Total - VPN & Firewall-3 and Checkpoint - SandBlast		2	1	2	0		high	0	1579288790259			high	false	under_investigation	1	https://some.xdr.url.com/incident-view/2

core-script-run

Initiates a new endpoint script execution using a script from the script library and returns the results.

Base Command

core-script-run

Input

Context Output

Command example

!core-script-run endpoint_ids=111 script_uid=111 polling_timeout_in_seconds=1200 timeout=1200

Context Example

{
    "Core.ScriptResult": [
        {
            "action_id": 1, 
            "results": [
                {
                    "retrieved_files" : 0,
                    "_return_value": [],
                    "standard_output": ""
                    "domain" : "222",
                    "endpoint_id" : "111",
                    "endpoint_ip_address" : ["1.1.1.1"],
                    "command" : "_return_value",
                    "retention_date" : NULL,
                    "command_output" : [],
                    "endpoint_name" : "test",
                    "failed_files" : 0,
                    "execution_status" : "COMPLETED_SUCCESSFULLY",
                    "endpoint_status" : "STATUS_010_CONNECTED"
                },
            ]
        }
    ],
    "Core.ScriptRun": [
        {
            "action_id": 1,
            "endpoints_count": 1,
            "status": 1
        }
    ]
}

Human Readable Output

Script Execution Results

_return_value	domain	endpoint_id	endpoint_ip_address	endpoint_name	endpoint_status	execution_status	failed_files	retention_date	retrieved_files	standard_output
	222	111	1.1.1.1	test	STATUS_010_CONNECTED	COMPLETED_SUCCESSFULLY	0		0

core-terminate-process

Terminates a process by its instance ID. Available only for XSIAM 2.4 and above.

Base Command

core-terminate-process

Input

Context Output

core-terminate-causality

Terminate a process tree by its causality ID. Available only for XSIAM 2.4 and above.

Command Example

!core-terminate-process agent_id=1 instance_id=1 process_name=process incident_id=2

Context Example

{
    "Core.TerminateProcess": [
        {
            "action_id": "1",
        }
       
    ]
}

Base Command

core-terminate-causality

Input

Context Output

Command Example

!core-terminate-causality agent_id=1 causality_id=1 process_name=process incident_id=2

Context Example

{
    "Core.TerminateCausality": [
        {
            "action_id": "1",
        }
       
    ]
}

core-execute-command

Run a shell command on a specific endpoint and return its result.

Base Command

core-execute-command

Input

Context Output