Cortex XDR - IR

Cortex XDR is the world's first detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks.

Endpoint · Cortex XDR by Palo Alto Networks

Details

IDCortex XDR - IR
ProviderPalo Alto Networks
CategoryEndpoint
From Version5.0.0
Docker Imagedemisto/python3:3.12.13.10116658
Supported ModulesAgentix

README

Cortex XDR is the world’s first detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks.
This integration was integrated and tested with version 2.6.5 of Cortex XDR - IR.

Configure Palo Alto Networks Cortex XDR - Investigation and Response on Cortex XSOAR

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Palo Alto Networks Cortex XDR - Investigation and Response.
  3. Click Add instance to create and configure a new integration instance.
Parameter Description Required
Fetch incidents   False
Incident type   False
Server URL (copy URL from XDR)   True
API Key ID   False
API Key   False
Remove legacy incident fields Not selected for backwards compatibility. Recommended to select. This will remove duplicated incident fields under file_artifacts, network_artifacts, and alerts (like client_id, clientid.) False
Incident Mirroring Direction Not supported on Cortex platform. False
Close Mirrored XSOAR Incident When selected, closing the Cortex XDR incident is mirrored in Cortex XSOAR. False
Close Mirrored Cortex XDR Incident When selected, closing the Cortex XSOAR incident is mirrored in Cortex XDR. Notice: If not selected, but ‘Close all related alerts in XDR’ is selected, the incident will automatically be closed in Cortex XDR. False
XDR mirroring delay in minutes In the event of a delay in mirroring incoming changes from XDR, use the xdr_delay parameter to extend the look-back period. However, be aware that this may result in increased latency when updating incidents. False
Custom close-reason mapping (XSOAR -> XDR mirrored incident. Overwrites default close-reason mapping defined by Cortex XSOAR) Define how to close the mirrored incidents from Cortex XSOAR into Cortex XDR with a custom close reason mapping. Enter a comma-separated list of close reasons (acceptable format {Cortex XSOAR close reason}={Cortex XDR close reason}) to override the default close reason mapping defined by Cortex XSOAR. Note that the mapping must be configured accordingly with the existing close reasons in Cortex XSOAR and Cortex XDR. Not following this format will result in closing the incident with a default close reason. Example: “Resolved=Other,Duplicate=Other”. Refer to ../README.md for possible close-reasons - `XDR Incident Mirroring`. False
Custom close-reason mapping (XDR -> XSOAR mirrored incident. Overwrites default close-reason mapping defined by Cortex XSOAR) Define how to close the mirrored incidents from Cortex XDR into Cortex XSOAR with a custom close reason mapping. Enter a comma-separated list of close reasons (acceptable format {Cortex XDR close reason}={Cortex XSOAR close reason}) to override the default close reason mapping defined by Cortex XSOAR. Note that the mapping must be configured accordingly with the existing close reasons in Cortex XSOAR and Cortex XDR. Not following this format will result in closing the incident with a default close reason. Example: “Known Issue=Resolved, Duplicate Incident=Other”. Refer to ../README.md for possible close-reasons - `XDR Incident Mirroring`. False
HTTP Timeout The timeout of the HTTP requests sent to Cortex XDR API (in seconds). False
Maximum number of incidents per fetch The maximum number of incidents per fetch. Cannot exceed 100. False
Only fetch starred incidents   False
Starred incidents fetch window Starred fetch window timestamp (<number> <time unit>, e.g., 12 hours, 7 days). Fetches only starred incidents within the specified time range. False
First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)   False
Sync Incident Owners For Cortex XSOAR version 6.0.0 and above. If selected, for every incident fetched from Cortex XDR to Cortex XSOAR, the incident owners will be synced. Note that once this value is changed and synchronized between the systems, additional changes will not be reflected. For example, if you change the owner in Cortex XSOAR, the new owner will also be changed in Cortex XDR. However, if you now change the owner back in Cortex XDR, this additional change will not be reflected in Cortex XSOAR. In addition, for this change to be reflected, the owners must exist in both Cortex XSOAR and Cortex XDR. False
Trust any certificate (not secure)   False
Use system proxy settings   False
Prevent Only Mode Whether the XDR tenant mode is prevent only False
Incident Statuses to Fetch The statuses of the incidents that will be fetched. If no status is provided then incidents of all the statuses will be fetched. Note: An incident whose status was changed to a filtered status after its creation time will not be fetched. False
Minimize Incident Information Whether to fetch only the essential incident’s fields - without Network Artifacts and File Artifacts to minimize the incident’s information. False
Minimize Alert Information Whether to fetch only the essential alert fields in order to minimize the incident’s information. Possible values: null_values to remove all null values from alerts data, or any other field of an alert. False
Close all related alerts in XDR Close all related alerts in Cortex XDR once an incident has been closed in Cortex XSOAR. False
  1. Click Test to validate the URLs, token, and connection.

Configuration

To configure the integration on Cortex XSOAR, you need to generate an API Key and obtain your Cortex XDR URL.

Generate an API Key and API Key ID

  1. In Cortex XDR, navigate to Settings > Configurations > API Keys.
  2. Click +New Key and generate an Advanced key.
  3. Copy the generated API Key and the Key ID from the table.

Note 1: You can assign a custom or built-in role to the API Key. Instance Admin provides the highest privileges, while Privileged Responder offers maximum command execution with fewer overall permissions. In order for the integration test to pass, the API Key must have View permissions for Cases and Issues.

Note 2: If you experience missing updates when mirroring incoming changes from XDR, increase the XDR mirroring delay in minutes parameter. Note that this may increase latency when updating incidents.

URL

  1. In Cortex XDR, navigate to Settings > Configurations > API Keys.
  2. Click Copy URL in the top right corner.

XDR & XSOAR

Playbooks

Cortex XDR Incident Handling

The playbook syncs and updates new Cortex XDR alerts that construct the incident.
It enriches indicators using Threat Intelligence integrations and Palo Alto Networks
AutoFocus. The incident’s severity is then updated based on the indicators reputation
and an analyst is assigned for manual investigation. If chosen, automated remediation
with Palo Alto Networks FireWall is initiated. After a manual review by the
SOC analyst, the Cortex XDR incident is closed automatically.

To utilize this playbook for handling Cortex XDR incidents, the classifier that should be selected is Cortex XDR - Classifier.
The selected Mapper (incoming) should be XDR - Incoming Mapper, and the selected Mapper (outgoing) should be Cortex XDR - Outgoing Mapper.

Cortex XDR Lite - Incident Handling

This playbook is a lite default playbook to handle Cortex XDR incidents, and it doesn’t require additional integrations to run. The playbook is triggered by fetching a Palo Alto Networks Cortex XDR incident. First, the playbook performs enrichment on the incident’s indicators. Then, the playbook performs investigation and analysis on the command line and searches for related Cortex XDR alerts by Mitre tactics to identify malicious activity performed on the endpoint and by the user. Based on the enrichment and the investigation results, the playbooks sets the verdict of the incident. If malicious indicators are found, the playbook takes action to block these indicators and isolate the affected endpoint to prevent further damage or the spread of threats. If the verdict is not determined, it lets the analyst decide whether to continue to the remediation stage or close the investigation as benign. As part of this playbook, you’ll receive a comprehensive layout that presents incident details, analysis, investigation findings, and the final verdict. Additionally, the layout offers convenient remediation buttons for quicker manual actions.

To utilize this playbook for handling XDR incidents, the classifier should be empty, and the selected incident type should be Cortex XDR - Lite.
The selected Mapper (incoming) should be XDR - Incoming Mapper, and the selected Mapper (outgoing) should be Cortex XDR - Outgoing Mapper.

Use Cases

  • Fetch incidents from Cortex XDR
  • Enrich incident with alerts and incident from Cortex XDR
  • Update incident in Cortex XDR
  • Search for endpoints
  • Isolate/unisolate endpoints
  • Insert parsed alerts into Cortex XDR
  • Insert CEF alerts into Cortex XDR
  • Query for agent audit reports
  • Query for audit management logs
  • Create distribution
  • Get distribution download URL
  • Get distribution versions

Automation

To sync incidents between Cortex XSOAR and Cortex XDR, you should use the XDRSyncScript script, which you can find in the automation page.

Fetched Incidents Data

incident_id:31
creation_time:1564594008755
modification_time:1566339537617
detection_time:null
status:new
severity:low
description:6 'Microsoft Windows RPC Fragment Evasion Attempt' alerts detected by PAN NGFW on 6 hosts
assigned_user_mail:null
assigned_user_pretty_name:null
alert_count:6
low_severity_alert_count:0
med_severity_alert_count:6
high_severity_alert_count:0
user_count:1
host_count:6
notes:null
resolve_comment:null
manual_severity:low
manual_description:null
xdr_url:https://1111.paloaltonetworks.com/incident-view/31

XDR Incident Mirroring

Note this feature is available from Cortex XSOAR version 6.0.0

You can enable incident mirroring between Cortex XSOAR incidents and Cortex XDR incidents.
To setup the mirroring follow these instructions:

  1. Navigate to Settings > Integrations > Servers & Services.
  2. Search for Cortex XDR - IR and select your integration instance.
  3. Enable Fetches incidents.
  4. Under Mapper (incoming), select XDR - Incoming Mapper.
  5. Under Mapper (outgoing), select Cortex XDR - Outgoing Mapper.
  6. In the Incident Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:
    • Incoming - Any changes in Cortex XDR incidents will be reflected in Cortex XSOAR incidents.
    • Outgoing - Any changes in Cortex XSOAR incidents will be reflected in Cortex XDR incidents.
    • Both - Changes in Cortex XSOAR and Cortex XDR incidents will be reflected in both directions.
    • None - Choose this to turn off incident mirroring.

  7. Optional: Provide a custom close-reason mapping for mirrored XDR <-> XSOAR incidents. Please use only possible close-reasons to map:

    Possible Closure Reasons for Cortex XSOAR Incident
    Resolved
    False Positive
    Duplicate
    Security Testing
    Other
    Possible Closure Reasons for Cortex Cortex XDR Incident
    True Positive
    False Positive
    Duplicate Incident
    Security Testing
    Known Issue
    Other
    Auto

    Failing to use only available values will result in using default mapping of closure reasons within the mirroring process.

Close-reason default mapping XSOAR -> XDR: Other=Other, Duplicate=Duplicate Incident, False Positive=False Positive, Resolved=True Positive

Close-reason default mapping XDR -> XSOAR: Known Issue=Other, Duplicate Incident=Duplicate, False Positive=False Positive, True Positive=Resolved, Other=Other, Auto=Resolved

  1. Optional: Check the Sync Incident Owners integration parameter to sync the incident owners in both Cortex XDR and Cortex XSOAR.

    • Note: This feature will only work if the same users are registered in both Cortex XSOAR and Cortex XDR.

  2. Newly fetched incidents will be mirrored in the chosen direction.

    • Note: This will not effect existing incidents.

XDR Mirroring Notes, limitations and Troubleshooting

  • While you can mirror changes in incident fields both in and out in each incident, you can only mirror in a single direction at a time. For example:
    If we have an incident with two fields (A and B) in Cortex XDR and Cortex XSOAR while Incoming And Outgoing mirroring is selected:
    • I can mirror field A from Cortex XDR to Cortex XSOAR and field B from Cortex XSOAR to Cortex XDR.
    • I cannot mirror changes from field A in both directions.

    Initially all fields are mirrored in from Cortex XDR to Cortex XSOAR. Once they are changed in Cortex XSOAR, they can only be mirrored out.

  • Do not use the XDRSyncScript automation nor any playbook that uses this automation
    (e.g Cortex XDR Incident Sync or Cortex XDR incident handling v2), as it impairs the mirroring functionality.

  • When migrating an existing instance to the mirroring feature, or in case the mirroring does not work as expected, make sure that:
    • The default playbook of the Cortex XDR Incident incident type is not Cortex XDR Incident Sync, change it to a
      different playbook that does not use XDRSyncScript.
    • The Cortex XDR integration instance incoming mapper is set to Cortex XDR - Incoming Mapper and the outgoing mapper is set to Cortex XDR - Outgoing Mapper.
    • Mirroring impacts only incidents that were fetched after the mirroring was enabled for this instance. If incidents were fetched with the incorrect mapper, changing the mapper will not affect them. This can be resolved by resetting the last fetch run and re-fetching the incidents. New incidents will be created and the old ones will no longer be relevant.

  • The API includes a limit rate of 10 API requests per minute. Therefore, in a case of a limit rate exception, the sync loop will stop and will resume from the last incident.

  • Owner and closeReason mappings are done using the integration code, therefore they are not part of the out-of-the-box mapper and should not be specified in any future mapper.

Fetch Behavior vs Mirroring

Note: All incidents, including those with a “resolved” status, will be fetched into Cortex XSOAR as “active” incidents to enable the execution of our automations. However, the original resolved status of the incidents will be preserved in the incident details. If you prefer to keep certain incidents closed, you can utilize the “Incident Statuses to Fetch” filter during the configuration stage and choose not to import those specific incidents. Alternatively, you can utilize pre-processing rules to define specific types of incidents to be imported as closed.

Regarding mirroring, if you have already imported an incident and the mirroring feature is enabled, changing the incident’s status to resolved on the Cortex XDR platform will trigger the mirroring process, resulting in the closure of the incident in Cortex XSOAR.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

xdr-get-incidents (Deprecated)

This command is deprecated please use xdr-case-list instead. Returns a list of incidents, which you can filter by a list of incident IDs (max. 100), the time the incident was last modified, and the time the incident was created.
If you pass multiple filtering arguments, they will be concatenated using the AND condition. The OR condition is not supported.

Required Permissions

Required Permissions For API call:
Alerts And Incidents –> View
Builtin Roles with this permission includes: “Investigator”, “Responder”, “Privileged Investigator”, “Privileged Responder”, “Viewer”, and “Instance Admin”.

Base Command

xdr-get-incidents

Input

Argument Name Description Required
lte_creation_time A date in the format 2019-12-31T23:59:00 in UTC. Only incidents that were created on or before the specified date/time will be retrieved. Optional
gte_creation_time A date in the format 2019-12-31T23:59:00 in UTC. Only incidents that were created on or after the specified date/time will be retrieved. Optional
lte_modification_time Filters returned incidents that were created on or before the specified date/time, in the format 2019-12-31T23:59:00. Optional
gte_modification_time Filters returned incidents that were modified on or after the specified date/time, in the format 2019-12-31T23:59:00. Optional
incident_id_list An array or CSV string of incident IDs. Optional
since_creation_time Filters returned incidents that were created on or after the specified date/time range, for example, 1 month, 2 days, 1 hour, and so on. Optional
since_modification_time Filters returned incidents that were modified on or after the specified date/time range, for example, 1 month, 2 days, 1 hour, and so on. Optional
sort_by_modification_time Sorts returned incidents by the date/time that the incident was last modified (“asc” - ascending, “desc” - descending). Possible values are: asc, desc. Optional
sort_by_creation_time Sorts returned incidents by the date/time that the incident was created (“asc” - ascending, “desc” - descending). Possible values are: asc, desc. Optional
page Page number (for pagination). The default is 0 (the first page). Default is 0. Optional
limit Maximum number of incidents to return per page. The default and maximum is 100. Default is 100. Optional
status Filters only incidents in the specified status. The options are: new, under_investigation, resolved_known_issue, resolved_false_positive, resolved_true_positive resolved_security_testing, resolved_other, resolved_auto, resolved_auto_resolve. Optional
starred Whether the incident is starred (Boolean value: true or false). Possible values are: true, false. Optional
starred_incidents_fetch_window Starred fetch window timestamp (<number> <time unit>, e.g., 12 hours, 7 days). Default is 3 days. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.Incident.incident_id String Unique ID assigned to each returned incident.
PaloAltoNetworksXDR.Incident.manual_severity String Incident severity assigned by the user. This does not affect the calculated severity. Can be “low”, “medium”, “high”
PaloAltoNetworksXDR.Incident.manual_description String Incident description provided by the user.
PaloAltoNetworksXDR.Incident.assigned_user_mail String Email address of the assigned user.
PaloAltoNetworksXDR.Incident.high_severity_alert_count String Number of alerts with the severity HIGH.
PaloAltoNetworksXDR.Incident.host_count number Number of hosts involved in the incident.
PaloAltoNetworksXDR.Incident.xdr_url String A link to the incident view on Cortex XDR.
PaloAltoNetworksXDR.Incident.assigned_user_pretty_name String Full name of the user assigned to the incident.
PaloAltoNetworksXDR.Incident.alert_count number Total number of alerts in the incident.
PaloAltoNetworksXDR.Incident.med_severity_alert_count number Number of alerts with the severity MEDIUM.
PaloAltoNetworksXDR.Incident.user_count number Number of users involved in the incident.
PaloAltoNetworksXDR.Incident.severity String Calculated severity of the incident. Valid values are: “low”,”medium”,”high”
PaloAltoNetworksXDR.Incident.low_severity_alert_count String Number of alerts with the severity LOW.
PaloAltoNetworksXDR.Incident.status String Current status of the incident. Valid values are: “new”,”under_investigation”,”resolved_known_issue”,”resolved_duplicate”,”resolved_false_positive”,”resolved_true_positive”,”resolved_security_testing” or “resolved_other”.
PaloAltoNetworksXDR.Incident.description String Dynamic calculated description of the incident.
PaloAltoNetworksXDR.Incident.resolve_comment String Comments entered by the user when the incident was resolved.
PaloAltoNetworksXDR.Incident.notes String Comments entered by the user regarding the incident.
PaloAltoNetworksXDR.Incident.creation_time date Date and time the incident was created on Cortex XDR.
PaloAltoNetworksXDR.Incident.detection_time date Date and time that the first alert occurred in the incident.
PaloAltoNetworksXDR.Incident.modification_time date Date and time that the incident was last modified.
Command Example

!xdr-get-incidents gte_creation_time=2010-10-10T00:00:00 limit=3 sort_by_creation_time=desc

Context Example
{
    "PaloAltoNetworksXDR.Incident": [
        {
            "host_count": 1, 
            "incident_id": "4", 
            "manual_severity": "medium", 
            "description": "5 'This alert from content  TestXDRPlaybook' alerts detected by Checkpoint - SandBlast  ", 
            "severity": "medium", 
            "modification_time": 1579290004178, 
            "assigned_user_pretty_name": null, 
            "notes": null, 
            "creation_time": 1577276587937, 
            "alert_count": 5, 
            "med_severity_alert_count": 1, 
            "detection_time": null, 
            "assigned_user_mail": null, 
            "resolve_comment": "This issue was solved in Incident number 192304", 
            "status": "new", 
            "user_count": 1, 
            "xdr_url": "https://some.xdr.url.com/incident-view/4", 
            "starred": false, 
            "low_severity_alert_count": 0, 
            "high_severity_alert_count": 4, 
            "manual_description": null
        }, 
        {
            "host_count": 1, 
            "incident_id": "3", 
            "manual_severity": "medium", 
            "description": "'test 1' generated by Virus Total - Firewall", 
            "severity": "medium", 
            "modification_time": 1579237974014, 
            "assigned_user_pretty_name": "woo@test.com", 
            "notes": null, 
            "creation_time": 1576100096594, 
            "alert_count": 1, 
            "med_severity_alert_count": 0, 
            "detection_time": null, 
            "assigned_user_mail": "woo@test.com", 
            "resolve_comment": null, 
            "status": "new", 
            "user_count": 1, 
            "xdr_url": "https://some.xdr.url.com/incident-view/3", 
            "starred": false, 
            "low_severity_alert_count": 0, 
            "high_severity_alert_count": 1, 
            "manual_description": null
        }, 
        {
            "host_count": 1, 
            "incident_id": "2", 
            "manual_severity": "high", 
            "description": "'Alert Name Example 333' along with 1 other alert generated by Virus Total - VPN & Firewall-3 and Checkpoint - SandBlast", 
            "severity": "high", 
            "modification_time": 1579288790259, 
            "assigned_user_pretty_name": null, 
            "notes": null, 
            "creation_time": 1576062816474, 
            "alert_count": 2, 
            "med_severity_alert_count": 0, 
            "detection_time": null, 
            "assigned_user_mail": null, 
            "resolve_comment": null, 
            "status": "under_investigation", 
            "user_count": 1, 
            "xdr_url": "https://some.xdr.url.com/incident-view/2", 
            "starred": false, 
            "low_severity_alert_count": 0, 
            "high_severity_alert_count": 2, 
            "manual_description": null
        }
    ]
}
Human Readable Output

Incidents

alert_count assigned_user_mail assigned_user_pretty_name creation_time description detection_time high_severity_alert_count host_count incident_id low_severity_alert_count manual_description manual_severity med_severity_alert_count modification_time notes resolve_comment severity starred status user_count xdr_url
5     1577276587937 5 ‘This alert from content TestXDRPlaybook’ alerts detected by Checkpoint - SandBlast   4 1 4 0   medium 1 1579290004178   This issue was solved in Incident number 192304 medium false new 1 https://some.xdr.url.com/incident-view/4
1 woo@test.com woo@test.com 1576100096594 ‘test 1’ generated by Virus Total - Firewall   1 1 3 0   medium 0 1579237974014     medium false new 1 https://some.xdr.url.com/incident-view/3
2     1576062816474 ‘Alert Name Example 333’ along with 1 other alert generated by Virus Total - VPN & Firewall-3 and Checkpoint - SandBlast   2 1 2 0   high 0 1579288790259     high false under_investigation 1 https://some.xdr.url.com/incident-view/2

xdr-get-incident-extra-data (Deprecated)

This command is deprecated. Returns additional data for the specified incident, for example, related alerts, file artifacts, network artifacts, and so on.

Required Permissions

Required Permissions For API call:
Alerts And Incidents –> View

Builtin Roles with this permission includes: “Investigator”, “Responder”, “Privileged Investigator”, “Privileged Responder”, “Viewer”, and “Instance Admin”.

Base Command

xdr-get-incident-extra-data

Input

Argument Name Description Required
incident_id The ID of the incident for which to get additional data. Required
alerts_limit Maximum number of alerts to return. Default is 1000. Optional
return_only_updated_incident Return data only if the incident was changed since the last time it was mirrored into Cortex XSOAR. This flag should be used only from within a Cortex XDR incident. Default is False. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.Incident.incident_id String Unique ID assigned to each returned incident.
PaloAltoNetworksXDR.Incident.creation_time Date Date and time the incident was created on Cortex XDR.
PaloAltoNetworksXDR.Incident.modification_time Date Date and time that the incident was last modified.
PaloAltoNetworksXDR.Incident.detection_time Date Date and time that the first alert occurred in the incident.
PaloAltoNetworksXDR.Incident.status String Current status of the incident. Valid values are:
“new”,”under_investigation”,”resolved_known_issue”,”resolved_duplicate”,”resolved_false_positive”,”resolved_true_positive”,”resolved_security_testing”,”resolved_other”    
PaloAltoNetworksXDR.Incident.severity String Calculated severity of the incident. Valid values are: “low”,”medium”,”high”
PaloAltoNetworksXDR.Incident.description String Dynamic calculated description of the incident.
PaloAltoNetworksXDR.Incident.assigned_user_mail String Email address of the assigned user.
PaloAltoNetworksXDR.Incident.assigned_user_pretty_name String Full name of the user assigned to the incident.
PaloAltoNetworksXDR.Incident.alert_count Number Total number of alerts in the incident.
PaloAltoNetworksXDR.Incident.low_severity_alert_count Number Number of alerts with the severity LOW.
PaloAltoNetworksXDR.Incident.med_severity_alert_count Number Number of alerts with the severity MEDIUM.
PaloAltoNetworksXDR.Incident.high_severity_alert_count Number Number of alerts with the severity HIGH.
PaloAltoNetworksXDR.Incident.user_count Number Number of users involved in the incident.
PaloAltoNetworksXDR.Incident.host_count Number Number of hosts involved in the incident
PaloAltoNetworksXDR.Incident.notes Unknown Comments entered by the user regarding the incident.
PaloAltoNetworksXDR.Incident.resolve_comment String Comments entered by the user when the incident was resolved.
PaloAltoNetworksXDR.Incident.manual_severity String Incident severity assigned by the user. This does not affect the calculated severity of low, medium, or high.
PaloAltoNetworksXDR.Incident.manual_description String Incident description provided by the user.
PaloAltoNetworksXDR.Incident.xdr_url String A link to the incident view on Cortex XDR.
PaloAltoNetworksXDR.Incident.starred Boolean Incident starred.
PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_techniques_ids_and_names String Incident Mitre techniques IDs and names.
PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_tactics_ids_and_names String Incident Mitre tactics ids and names.
PaloAltoNetworksXDR.Incident.alerts.alert_id String Unique ID for each alert.
PaloAltoNetworksXDR.Incident.alerts.detection_timestamp Date Date and time that the alert occurred.
PaloAltoNetworksXDR.Incident.alerts.source String Source of the alert. The product/vendor this alert came from.
PaloAltoNetworksXDR.Incident.alerts.severity String Severity of the alert.Valid values are: “low”,”medium”,”high”””
PaloAltoNetworksXDR.Incident.alerts.name String Calculated name of the alert.
PaloAltoNetworksXDR.Incident.alerts.category String Category of the alert, for example, Spyware Detected via Anti-Spyware profile.
PaloAltoNetworksXDR.Incident.alerts.description String Textual description of the alert.
PaloAltoNetworksXDR.Incident.alerts.host_ip_list Unknown Host IP involved in the alert.
PaloAltoNetworksXDR.Incident.alerts.host_name String Host name involved in the alert.
PaloAltoNetworksXDR.Incident.alerts.user_name String User name involved with the alert.
PaloAltoNetworksXDR.Incident.alerts.event_type String Event type. Valid values are: “Process Execution”,”Network Event”,”File Event”,”Registry Event”,”Injection Event”,”Load Image Event”,”Windows Event Log”
PaloAltoNetworksXDR.Incident.alerts.action String The action that triggered the alert. Valid values are: “REPORTED”, “BLOCKED”, “POST_DETECTED”, “SCANNED”, “DOWNLOAD”, “PROMPT_ALLOW”, “PROMPT_BLOCK”, “DETECTED”, “BLOCKED_1”, “BLOCKED_2”, “BLOCKED_3”, “BLOCKED_5”, “BLOCKED_6”, “BLOCKED_7”, “BLOCKED_8”, “BLOCKED_9”, “BLOCKED_10”, “BLOCKED_11”, “BLOCKED_13”, “BLOCKED_14”, “BLOCKED_15”, “BLOCKED_16”, “BLOCKED_17”, “BLOCKED_24”, “BLOCKED_25”, “DETECTED_0”, “DETECTED_4”, “DETECTED_18”, “DETECTED_19”, “DETECTED_20”, “DETECTED_21”, “DETECTED_22”, “DETECTED_23”
PaloAltoNetworksXDR.Incident.alerts.action_pretty String The action that triggered the alert. Valid values are: “Detected (Reported)” “Prevented (Blocked)” “Detected (Post Detected)” “Detected (Scanned)” “Detected (Download)” “Detected (Prompt Allow)” “Prevented (Prompt Block)” “Detected” “Prevented (Denied The Session)” “Prevented (Dropped The Session)” “Prevented (Dropped The Session And Sent a TCP Reset)” “Prevented (Blocked The URL)” “Prevented (Blocked The IP)” “Prevented (Dropped The Packet)” “Prevented (Dropped All Packets)” “Prevented (Terminated The Session And Sent a TCP Reset To Both Sides Of The Connection)” “Prevented (Terminated The Session And Sent a TCP Reset To The Client)” “Prevented (Terminated The Session And Sent a TCP Reset To The Server)” “Prevented (Continue)” “Prevented (Block-Override)” “Prevented (Override-Lockout)” “Prevented (Override)” “Prevented (Random-Drop)” “Prevented (Silently Dropped The Session With An ICMP Unreachable Message To The Host Or Application)” “Prevented (Block)” “Detected (Allowed The Session)” “Detected (Raised An Alert)” “Detected (Syncookie Sent)” “Detected (Forward)” “Detected (Wildfire Upload Success)” “Detected (Wildfire Upload Failure)” “Detected (Wildfire Upload Skip)” “Detected (Sinkhole)”
PaloAltoNetworksXDR.Incident.alerts.actor_process_image_name String Image name.
PaloAltoNetworksXDR.Incident.alerts.actor_process_command_line String Command line.
PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_status String Signature status. Valid values are: “Signed” “Invalid Signature” “Unsigned” “Revoked” “Signature Fail” “N/A” “Weak Hash”.
PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_vendor String Signature vendor name.
PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_image_name String Image name.
PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_line String Command line.
PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_status String Signature status. Valid values are: “Signed” “Invalid Signature” “Unsigned” “Revoked” “Signature Fail” “N/A” “Weak Hash”
PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_vendor String Signature vendor.
PaloAltoNetworksXDR.Incident.alerts.causality_actor_causality_id Unknown Causality ID.
PaloAltoNetworksXDR.Incident.alerts.action_process_image_name String Image name.
PaloAltoNetworksXDR.Incident.alerts.action_process_image_command_line String Command line.
PaloAltoNetworksXDR.Incident.alerts.action_process_image_sha256 String Image SHA256.
PaloAltoNetworksXDR.Incident.alerts.action_process_signature_status String Signature status. Valid values are: “Signed” “Invalid Signature” “Unsigned” “Revoked” “Signature Fail” “N/A” “Weak Hash”
PaloAltoNetworksXDR.Incident.alerts.action_process_signature_vendor String Signature vendor name.
PaloAltoNetworksXDR.Incident.alerts.action_file_path String File path.
PaloAltoNetworksXDR.Incident.alerts.action_file_md5 String File MD5.
PaloAltoNetworksXDR.Incident.alerts.action_file_sha256 String File SHA256.
PaloAltoNetworksXDR.Incident.alerts.action_registry_data String Registry data.
PaloAltoNetworksXDR.Incident.alerts.action_registry_full_key String Registry full key.
PaloAltoNetworksXDR.Incident.alerts.action_local_ip String Local IP.
PaloAltoNetworksXDR.Incident.alerts.action_local_port Number Local port.
PaloAltoNetworksXDR.Incident.alerts.action_remote_ip String Remote IP.
PaloAltoNetworksXDR.Incident.alerts.action_remote_port Number Remote port.
PaloAltoNetworksXDR.Incident.alerts.action_external_hostname String External hostname.
PaloAltoNetworksXDR.Incident.alerts.fw_app_id Unknown Firewall app id.
PaloAltoNetworksXDR.Incident.alerts.is_whitelisted String Is the alert on allow list. Valid values are: “Yes” “No”
PaloAltoNetworksXDR.Incident.alerts.starred Boolean Alert starred.
PaloAltoNetworksXDR.Incident.network_artifacts.type String Network artifact type.
PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_port number The remote port related to the artifact.
PaloAltoNetworksXDR.Incident.network_artifacts.alert_count number Number of alerts related to the artifact.
PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_ip String The remote IP related to the artifact.
PaloAltoNetworksXDR.Incident.network_artifacts.is_manual boolean Whether the artifact was created by the user (manually).
PaloAltoNetworksXDR.Incident.network_artifacts.network_domain String The domain related to the artifact.
PaloAltoNetworksXDR.Incident.network_artifacts.type String The artifact type. Valid values are: “META”, “GID”, “CID”, “HASH”, “IP”, “DOMAIN”, “REGISTRY”, “HOSTNAME”
PaloAltoNetworksXDR.Incident.network_artifacts.network_country String The country related to the artifact.
PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_status String Digital signature status of the file. Valid values are: “SIGNATURE_UNAVAILABLE” “SIGNATURE_SIGNED” “SIGNATURE_INVALID” “SIGNATURE_UNSIGNED” “SIGNATURE_WEAK_HASH”
PaloAltoNetworksXDR.Incident.file_artifacts.is_process boolean Whether the file artifact is related to a process execution.
PaloAltoNetworksXDR.Incident.file_artifacts.file_name String Name of the file.
PaloAltoNetworksXDR.Incident.file_artifacts.file_wildfire_verdict String The file verdict, calculated by Wildfire. Valid values are: “BENIGN” “MALWARE” “GRAYWARE” “PHISHING” “UNKNOWN”.
PaloAltoNetworksXDR.Incident.file_artifacts.alert_count number Number of alerts related to the artifact.
PaloAltoNetworksXDR.Incident.file_artifacts.is_malicious boolean Whether the artifact is malicious, as decided by the Wildfire verdict.
PaloAltoNetworksXDR.Incident.file_artifacts.is_manual boolean Whether the artifact was created by the user (manually).
PaloAltoNetworksXDR.Incident.file_artifacts.type String The artifact type. Valid values are: “META” “GID” “CID” “HASH” “IP” “DOMAIN” “REGISTRY” “HOSTNAME”
PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256 String SHA256 hash of the file.
PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_vendor_name String File signature vendor name.
Account.Username String The username in the relevant system.
Endpoint.Hostname String The hostname that is mapped to this endpoint.
Endpoint.ID String The agent ID of the endpoint.
File.Path String The path where the file is located.
File.MD5 String The MD5 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.Name String The full file name (including file extension).
Process.Name String The name of the process.
Process.MD5 String The MD5 hash of the process.
Process.SHA256 String The SHA256 hash of the process.
Process.PID String The PID of the process.
Process.Path String The file system path to the binary file.
Process.Start Time String The timestamp of the process start time.
Process.CommandLine String The full command line (including arguments).
Process.is_malicious boolean Whether the artifact is malicious, as decided by the Wildfire verdict.
IP.Address String IP address.
IP.Geo.Country String The country in which the IP address is located.
Domain.Name String The domain name, for example: “google.com”.
Human Readable Output

Incident 4

alert_count assigned_user_mail assigned_user_pretty_name creation_time description detection_time high_severity_alert_count host_count incident_id low_severity_alert_count manual_description manual_severity med_severity_alert_count modification_time notes resolve_comment severity starred status user_count xdr_url
5     1577276587937 5 ‘This alert from content TestXDRPlaybook’ alerts detected by Checkpoint - SandBlast   4 1 4 0   medium 1 1579290004178   This issue was solved in Incident number 192304 medium false new 1 https://some.xdr.url.com/incident-view/4

Alerts

action action_external_hostname action_file_md5 action_file_path action_file_sha256 action_local_ip action_local_port action_pretty action_process_image_command_line action_process_image_name action_process_image_sha256 action_process_signature_status action_process_signature_vendor action_registry_data action_registry_full_key action_remote_ip action_remote_port actor_process_command_line actor_process_image_name actor_process_signature_status actor_process_signature_vendor alert_id category causality_actor_causality_id causality_actor_process_command_line causality_actor_process_image_name causality_actor_process_signature_status causality_actor_process_signature_vendor description detection_timestamp event_type fw_app_id host_ip_list host_name is_whitelisted name severity source starred user_name
VALUE_NA,
N/A		         196.168.0.1 7000 VALUE_NA,
N/A		       N/A N/A     2.2.2.2 8000     N/A N/A 6         N/A N/A Test - alert generated by Test XDR Playbook 1577276586921 Network Event       No Test - alert generated by Test XDR Playbook medium Cisco - Sandblast false  
VALUE_NA,
N/A		         196.168.0.111 2000 VALUE_NA,
N/A		       N/A N/A     2.2.2.2 6000     N/A N/A 7         N/A N/A This alert from content TestXDRPlaybook description 1577776701589 Network Event       No This alert from content TestXDRPlaybook high Checkpoint - SandBlast false  
VALUE_NA,
N/A		         196.168.0.111 2000 VALUE_NA,
N/A		       N/A N/A     2.2.2.2 6000     N/A N/A 8         N/A N/A This alert from content TestXDRPlaybook description 1577958479843 Network Event       No This alert from content TestXDRPlaybook high Checkpoint - SandBlast false  
VALUE_NA,
N/A		         196.168.0.111 2000 VALUE_NA,
N/A		       N/A N/A     2.2.2.2 6000     N/A N/A 9         N/A N/A This alert from content TestXDRPlaybook description 1578123895414 Network Event       No This alert from content TestXDRPlaybook high Checkpoint - SandBlast false  
VALUE_NA,
N/A		         196.168.0.111 2000 VALUE_NA,
N/A		       N/A N/A     2.2.2.2 6000     N/A N/A 10         N/A N/A This alert from content TestXDRPlaybook description 1578927443615 Network Event       No This alert from content TestXDRPlaybook high Checkpoint - SandBlast false  

Network Artifacts

alert_count is_manual network_country network_domain network_remote_ip network_remote_port type
5 false     2.2.2.2 8000 IP

File Artifacts

No entries.

xdr-update-incident (Deprecated)

This command is deprecated please use xdr-case-update instead. Updates one or more fields of a specified incident. Missing fields will be ignored. To remove the assignment for an incident, pass a null value in the assignee email argument.

Required Permissions

Required Permissions For API call:
Alerts And Incidents –> View / Edit

Builtin Roles with this permission includes: “Investigator”, “Privileged Investigator”, “Privileged Responder”, and “Instance Admin”.

Base Command

xdr-update-incident

Input

Argument Name Description Required
incident_id XDR incident ID. You can get the incident ID from the output of the ‘xdr-get-incidents’ command or the ‘xdr-get-incident-extra-details’ command. Required
manual_severity Severity to assign to the incident (LOW, MEDIUM, or HIGH). Possible values are: HIGH, MEDIUM, LOW. Optional
assigned_user_mail Email address of the user to assign to the incident. Optional
assigned_user_pretty_name Full name of the user assigned to the incident. To supply a new value in this field, you must also provide a value for the ‘assigned_user_mail’ argument. Optional
status Status of the incident. Valid values are: NEW, UNDER_INVESTIGATION, RESOLVED_KNOWN_ISSUE, RESOLVED_DUPLICATE, RESOLVED_FALSE_POSITIVE, RESOLVED_TRUE_POSITIVE, RESOLVED_SECURITY_TESTING, RESOLVED_OTHER. Possible values are: NEW, UNDER_INVESTIGATION, RESOLVED_KNOWN_ISSUE, RESOLVED_DUPLICATE, RESOLVED_FALSE_POSITIVE, RESOLVED_TRUE_POSITIVE, RESOLVED_SECURITY_TESTING, RESOLVED_OTHER. Optional
resolve_comment Comment explaining why the incident was resolved. This should be set when the incident is resolved. Optional
unassign_user If true, will remove all assigned users from the incident. Possible values are: true. Optional
Command Example

!xdr-update-incident incident_id=4

Context Output

There is no context output for this command.

Human Readable Output

Incident 4 has been updated

xdr-insert-parsed-alert (Deprecated)

This command is deprecated. Uploads an alert from external alert sources in Cortex XDR format. Cortex XDR displays alerts that are parsed
successfully in related incidents and views. You can send 600 alerts per minute. Each request can contain a
maximum of 60 alerts.

Required Permissions

Required Permissions For API call:
External Alerts Mapping–> View

Builtin Roles with this permission includes: “Instance Admin”.

Base Command

xdr-insert-parsed-alert

Input

Argument Name Description Required
product String value that defines the product. Required
vendor String value that defines the vendor. Required
local_ip String value for the source IP address. Optional
local_port Integer value for the source port. Required
remote_ip String value of the destination IP
address.		 Required
remote_port Integer value for the destination
port.		 Required
event_timestamp Integer value representing the time the alert occurred in milliseconds, or a string value in date format 2019-10-23T10:00:00. If not set, the event time will be defined as now. Optional
severity String value of alert severity. Valid values are:
Informational, Low, Medium or High. Possible values are: Informational, Low, Medium, High. Default is Medium.		 Optional
alert_name String defining the alert name. Required
alert_description String defining the alert description. Optional

Context Output

There is no context output for this command.

xdr-insert-cef-alerts (Deprecated)

This command is deprecated. Upload alerts in CEF format from external alert sources. After you map CEF alert fields to Cortex XDR fields, Cortex XDR displays the alerts in related incidents and views. You can send 600 requests per minute. Each request can contain a maximum of 60 alerts.

Required Permissions

Required Permissions For API call:
External Alerts Mapping–> View

Builtin Roles with this permission includes: “Instance Admin”.

Base Command

xdr-insert-cef-alerts

Input

Argument Name Description Required
cef_alerts List of alerts in CEF format. Required

Context Output

There is no context output for this command.

xdr-endpoint-isolate

Isolates the specified endpoint.

Required Permissions

Required Permissions For API call:
Endpoint Administrations –> View
Action Center –> View/ Edit
Action Center –> Isolate

Builtin Roles with this permission includes: “Privileged Responder” and “Instance Admin”.

Base Command

xdr-endpoint-isolate

Input

Argument Name Description Required
incident_id Allows linking the response action to the incident that triggered it. Optional
endpoint_id The endpoint ID (string) to isolate. You can retrieve the string from the xdr-get-endpoints command. Required
suppress_disconnected_endpoint_error Whether to suppress an error when trying to isolate a disconnected endpoint. When sets to false, an error will be returned. Possible values are: true, false. Default is false. Optional
interval_in_seconds Interval in seconds between each poll. Optional
timeout_in_seconds Polling timeout in seconds. Optional
action_id For polling use. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.Isolation.endpoint_id String The endpoint ID.

xdr-endpoint-unisolate

Reverses the isolation of an endpoint.

Required Permissions

Required Permissions For API call:
Endpoint Administrations –> View
Action Center –> View/ Edit
Action Center –> Isolate

Builtin Roles with this permission includes: “Privileged Responder” and “Instance Admin”.

Base Command

xdr-endpoint-unisolate

Input

Argument Name Description Required
incident_id Allows linking the response action to the incident that triggered it. Optional
endpoint_id The endpoint ID (string) for which to reverse the isolation. You can retrieve it from the xdr-get-endpoints command. Required
suppress_disconnected_endpoint_error Whether to suppress an error when trying to unisolate a disconnected endpoint. When sets to false, an error will be returned. Possible values are: true, false. Default is false. Optional
interval_in_seconds Interval in seconds between each poll. Optional
timeout_in_seconds Polling timeout in seconds. Optional
action_id For polling use. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.UnIsolation.endpoint_id String Isolates the specified endpoint.

xdr-get-endpoints

Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0).

Required Permissions

Required Permissions For API call:
Endpoint Administrations –> View

Builtin Roles with this permission includes: “Privileged Responder”, “Viewer” and “Instance Admin”.

Base Command

xdr-get-endpoints

Input

Argument Name Description Required
status A comma-separated list of endpoints statuses to filter. Valid values are: connected, disconnected, lost, uninstalled, windows, linux, macos, android, isolated, unisolated. Optional
endpoint_id_list A comma-separated list of endpoint IDs. Optional
dist_name A comma-separated list of distribution package names or installation package names.
Example: dist_name1,dist_name2.		 Optional
ip_list A comma-separated list of private IP addresses.
Example: Example: 10.1.1.1,192.168.1.1.		 Optional
public_ip_list A comma-separated list of public IP addresses that correlate to the last IPv4 address from which the Cortex XDR agent connected (know as Last Origin IP).
Example: 8.8.8.8,1.1.1.1.		 Optional
group_name The group name to which the agent belongs.
Example: group_name1,group_name2.		 Optional
platform The endpoint platform. Valid values are: “windows”, “linux”, “macos”, or “android”. . Possible values are: windows, linux, macos, android. Optional
alias_name A comma-separated list of alias names.
Examples: alias_name1,alias_name2.		 Optional
isolate Specifies whether the endpoint was isolated or unisolated. Possible values are: isolated, unisolated. Optional
hostname Hostname
Example: hostname1,hostname2.		 Optional
first_seen_gte All the agents that were first seen after {first_seen_gte}.
Supported values:
1579039377301 (time in milliseconds)
“3 days” (relative date)
“2019-10-21T23:45:00” (date).		 Optional
first_seen_lte All the agents that were first seen before {first_seen_lte}.
Supported values:
1579039377301 (time in milliseconds)
“3 days” (relative date)
“2019-10-21T23:45:00” (date).		 Optional
last_seen_gte All the agents that were last seen before {last_seen_gte}.
Supported values:
1579039377301 (time in milliseconds)
“3 days” (relative date)
“2019-10-21T23:45:00” (date).		 Optional
last_seen_lte All the agents that were last seen before {last_seen_lte}.
Supported values:
1579039377301 (time in milliseconds)
“3 days” (relative date)
“2019-10-21T23:45:00” (date).		 Optional
page Page number (for pagination). The default is 0 (the first page). Default is 0. Optional
limit Maximum number of endpoints to return per page. The default and maximum is 30. Default is 30. Optional
sort_by Specifies whether to sort endpoints by the first time or last time they were seen. Can be “first_seen” or “last_seen”. Possible values are: first_seen, last_seen. Optional
sort_order The order by which to sort results. Can be “asc” (ascending) or “desc” ( descending). Default set to asc. Possible values are: asc, desc. Default is asc. Optional
username The usernames to query for, accepts a single user, or comma-separated list of usernames. Optional
all_results Whether to return all endpoints. If true, will override the ‘limit’ and ‘page’ arguments. Possible values are: false, true. Default is false. Optional
use_hr_timestamps Whether to return timestamp values in human-readable format as opposed to Unix epoch timestamp format. Possible values are: false, true. Default is false. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.Endpoint.endpoint_id String The endpoint ID.
PaloAltoNetworksXDR.Endpoint.endpoint_name String The endpoint name.
PaloAltoNetworksXDR.Endpoint.endpoint_type String The endpoint type.
PaloAltoNetworksXDR.Endpoint.endpoint_status String The status of the endpoint.
PaloAltoNetworksXDR.Endpoint.os_type String The endpoint OS type.
PaloAltoNetworksXDR.Endpoint.ip Unknown A list of IP addresses.
PaloAltoNetworksXDR.Endpoint.users Unknown A list of users.
PaloAltoNetworksXDR.Endpoint.domain String The endpoint domain.
PaloAltoNetworksXDR.Endpoint.alias String The endpoint’s aliases.
PaloAltoNetworksXDR.Endpoint.first_seen Unknown First seen date/time in Epoch (milliseconds).
PaloAltoNetworksXDR.Endpoint.last_seen Date Last seen date/time in Epoch (milliseconds).
PaloAltoNetworksXDR.Endpoint.content_version String Content version.
PaloAltoNetworksXDR.Endpoint.installation_package String Installation package.
PaloAltoNetworksXDR.Endpoint.active_directory String Active directory.
PaloAltoNetworksXDR.Endpoint.install_date Date Install date in Epoch (milliseconds).
PaloAltoNetworksXDR.Endpoint.endpoint_version String Endpoint version.
PaloAltoNetworksXDR.Endpoint.is_isolated String Whether the endpoint is isolated.
PaloAltoNetworksXDR.Endpoint.group_name String The name of the group to which the endpoint belongs.
PaloAltoNetworksXDR.Endpoint.count String Number of endpoints returned.
Endpoint.Hostname String The hostname that is mapped to this endpoint.
Endpoint.ID String The unique ID within the tool retrieving the endpoint.
Endpoint.IPAddress String The IP address of the endpoint.
Endpoint.Domain String The domain of the endpoint.
Endpoint.OS String The endpoint’s operation system.
Account.Username String The username in the relevant system.
Account.Domain String The domain of the account.
Endpoint.Status String The endpoint’s status.
Endpoint.IsIsolated String The endpoint’s isolation status.
Endpoint.MACAddress String The endpoint’s MAC address.
Endpoint.Vendor String The integration name of the endpoint vendor.
Command Example

!xdr-get-endpoints isolate="unisolated" first_seen_gte="3 month" page="0" limit="30" sort_order="asc"

Context Example
{
    "Endpoint": [
        {
            "Domain": "WORKGROUP",
            "Hostname": "aaaaa.compute.internal",
            "ID": "ea303670c76e4ad09600c8b346f7c804",
            "IPAddress": [
                "172.31.11.11"
            ],
            "OS": "Windows",
            "Status" : "Online",
            "IsIsolated" : "No",
            "Vendor": "Cortex XDR - IR"
        },
        {
            "Domain": "WORKGROUP",
            "Hostname": "EC2AMAZ-P7PPOI4",
            "ID": "f8a2f58846b542579c12090652e79f3d",
            "IPAddress": [
                "2.2.2.2"
            ],
            "OS": "Windows",
            "Status" : "Online",
            "IsIsolated" : "No",
            "Vendor": "Cortex XDR - IR"
        }
    ],
    "PaloAltoNetworksXDR.Endpoint": [
        {
            "domain": "", 
            "users": [
                "ec2-user"
            ], 
            "endpoint_name": "aaaaa.compute.internal", 
            "ip": [
                "172.31.11.11"
            ], 
            "install_date": 1575795969644, 
            "endpoint_version": "7.0.0.1915", 
            "group_name": null, 
            "installation_package": "linux", 
            "alias": "", 
            "active_directory": null, 
            "endpoint_status": "CONNECTED", 
            "os_type": "AGENT_OS_LINUX", 
            "endpoint_id": "ea303670c76e4ad09600c8b346f7c804", 
            "content_version": "111-17757", 
            "first_seen": 1575795969644, 
            "endpoint_type": "AGENT_TYPE_SERVER", 
            "is_isolated": "AGENT_UNISOLATED", 
            "last_seen": 1579290023629
        }, 
        {
            "domain": "WORKGROUP", 
            "users": [
                "Administrator"
            ], 
            "endpoint_name": "EC2AMAZ-P7PPOI4", 
            "ip": [
                "2.2.2.2"
            ], 
            "install_date": 1575796381739, 
            "endpoint_version": "7.0.0.27797", 
            "group_name": null, 
            "installation_package": "Windows Server 2016", 
            "alias": "", 
            "active_directory": null, 
            "endpoint_status": "CONNECTED", 
            "os_type": "AGENT_OS_WINDOWS", 
            "endpoint_id": "f8a2f58846b542579c12090652e79f3d", 
            "content_version": "111-17757", 
            "first_seen": 1575796381739, 
            "endpoint_type": "AGENT_TYPE_SERVER", 
            "is_isolated": "AGENT_UNISOLATED", 
            "last_seen": 1579289957412
        }
    ]
}
Human Readable Output

Endpoints

active_directory alias content_version domain endpoint_id endpoint_name endpoint_status endpoint_type endpoint_version first_seen group_name install_date installation_package ip is_isolated last_seen os_type users
    111-17757   ea303670c76e4ad09600c8b346f7c804 aaaaa.compute.internal CONNECTED AGENT_TYPE_SERVER 7.0.0.1915 1575795969644   1575795969644 linux 172.31.11.11 AGENT_UNISOLATED 1579290023629 AGENT_OS_LINUX ec2-user
    111-17757 WORKGROUP f8a2f58846b542579c12090652e79f3d EC2AMAZ-P7PPOI4 CONNECTED AGENT_TYPE_SERVER 7.0.0.27797 1575796381739   1575796381739 Windows Server 2016 2.2.2.2 AGENT_UNISOLATED 1579289957412 AGENT_OS_WINDOWS Administrator

xdr-get-distribution-versions

Gets a list of all the agent versions to use for creating a distribution list.

Required Permissions

Required Permissions For API call:
Endpoint Installations –> View

Builtin Roles with this permission includes: “Viewer” and “Instance Admin”.

Base Command

xdr-get-distribution-versions

Input

There are no input arguments for this command.

Context Output

Path Type Description
PaloAltoNetworksXDR.DistributionVersions.windows Unknown A list of Windows agent versions.
PaloAltoNetworksXDR.DistributionVersions.linux Unknown A list of Linux agent versions.
PaloAltoNetworksXDR.DistributionVersions.macos Unknown A list of Mac agent versions.
Command Example

##### Context Example

{
“PaloAltoNetworksXDR.DistributionVersions”: {
“windows”: [
“5.0.8.29673”,
“5.0.9.30963”,
“6.1.4.28751”,
“7.0.0.28644”
],
“macos”: [
“6.1.4.1681”,
“7.0.0.1914”
],
“linux”: [
“6.1.4.1680”,
“7.0.0.1916”
]
}
}


##### Human Readable Output

>### windows

>|versions|
>|---|
>| 5.0.8.29673 |
>| 5.0.9.30963 |
>| 6.1.4.28751 |
>| 7.0.0.28644 |
>
>
>### linux

>|versions|
>|---|
>| 6.1.4.1680 |
>| 7.0.0.1916 |
>
>
>### macos

>|versions|
>|---|
>| 6.1.4.1681 |
>| 7.0.0.1914 |

### xdr-create-distribution

***
Creates an installation package. This is an asynchronous call that returns the distribution ID. This does not mean that the creation succeeded. To confirm that the package has been created, check the status of the distribution by running the Get Distribution Status API.

##### Required Permissions

Required Permissions For API call:
`Endpoint Installations` --> `View/ Edit`

Builtin Roles with this permission includes: "Instance Admin".

#### Base Command

`xdr-create-distribution`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| name | A string representing the name of the installation package. | Required |
| platform | String, valid values are:<br/>• windows <br/>• linux<br/>• macos <br/>• android. Possible values are: windows, linux, macos, android. | Required |
| package_type | A string representing the type of package to create.<br/>standalone - An installation for a new agent<br/>upgrade - An upgrade of an agent from ESM. Possible values are: standalone, upgrade. | Required |
| agent_version | agent_version returned from xdr-get-distribution-versions. Not required for Android platform. | Required |
| description | Information about the package. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.Distribution.id | String | The installation package ID. |
| PaloAltoNetworksXDR.Distribution.name | String | The name of the installation package. |
| PaloAltoNetworksXDR.Distribution.platform | String | The installation OS. |
| PaloAltoNetworksXDR.Distribution.agent_version | String | Agent version. |
| PaloAltoNetworksXDR.Distribution.description | String | Information about the package. |

##### Command Example

```!xdr-create-distribution agent_version=6.1.4.1680 name="dist_1" package_type=standalone platform=linux description="some description"```

##### Context Example

{
“PaloAltoNetworksXDR.Distribution”: {
“description”: “some description”,
“package_type”: “standalone”,
“platform”: “linux”,
“agent_version”: “6.1.4.1680”,
“id”: “43aede7f846846fa92b50149663fbb25”,
“name”: “dist_1”
}
}


##### Human Readable Output

Distribution 43aede7f846846fa92b50149663fbb25 created successfully

### xdr-get-distribution-url

***
Gets the distribution URL for downloading the installation package.

##### Required Permissions

Required Permissions For API call:
`Endpoint Installations` --> `View`

Builtin Roles with this permission includes: "Viewer" and "Instance Admin".

#### Base Command

`xdr-get-distribution-url`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| distribution_id | The ID of the installation package.<br/>Copy the distribution_id from the "id" field on Endpoints &gt; Agent Installation page. | Required |
| package_type | The installation package type. Valid<br/>values are:<br/>• upgrade<br/>• sh - For Linux<br/>• rpm - For Linux<br/>• deb - For Linux<br/>• pkg - For Mac<br/>• x86 - For Windows<br/>• x64 - For Windows. Possible values are: upgrade, sh, rpm, deb, pkg, x86, x64. | Required |
| download_package | Supported only for package_type x64 or x86. Whether to download the installation package file. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.Distribution.id | String | Distribution ID. |
| PaloAltoNetworksXDR.Distribution.url | String | URL for downloading the installation package. |

##### Command Example

```!xdr-get-distribution-url distribution_id=2c74c11b63074653aa01d575a82bf52a package_type=sh```

### xdr-get-create-distribution-status

***
Gets the status of the installation package.

##### Required Permissions

Required Permissions For API call:
`Endpoint Installations` --> `View`

Builtin Roles with this permission includes: "Viewer" and "Instance Admin".

#### Base Command

`xdr-get-create-distribution-status`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| distribution_ids | A comma-separated list of distribution IDs to get the status for. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.Distribution.id | String | Distribution ID. |
| PaloAltoNetworksXDR.Distribution.status | String | The status of installation package. |

##### Command Example

```!xdr-get-create-distribution-status distribution_ids=2c74c11b63074653aa01d575a82bf52a```

### xdr-get-audit-management-logs

***
Gets management logs. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of management logs from the start of the result set (start by counting from 0).

##### Required Permissions

Required Permissions For API call:
`Auditing` --> `View`

Builtin Roles with this permission includes: "Viewer" and "Instance Admin".

##### Context Example

{
“PaloAltoNetworksXDR.Distribution”: [
{
“status”: “Completed”,
“id”: “2c74c11b63074653aa01d575a82bf52a”
}
]
}


##### Human Readable Output

>### Distribution Status

>|id|status|
>|---|---|
>| 2c74c11b63074653aa01d575a82bf52a | Completed |

#### Base Command

`xdr-get-audit-management-logs`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| email | User’s email address. | Optional |
| type | The audit log type. Possible values are: LIVE_TERMINAL, RULES, AUTH, RESPONSE, INCIDENT_MANAGEMENT, ENDPOINT_MANAGEMENT, ALERT_WHITELIST, PUBLIC_API, DISTRIBUTIONS, STARRED_INCIDENTS, POLICY_PROFILES, DEVICE_CONTROL_PROFILE, HOST_FIREWALL_PROFILE, POLICY_RULES, PROTECTION_POLICY, DEVICE_CONTROL_TEMP_EXCEPTIONS, DEVICE_CONTROL_GLOBAL_EXCEPTIONS, GLOBAL_EXCEPTIONS, MSSP, REPORTING, DASHBOARD, BROKER_VM. | Optional |
| sub_type | The audit log subtype. | Optional |
| result | Result type. Possible values are: SUCCESS, FAIL, PARTIAL. | Optional |
| timestamp_gte | Return logs for which the timestamp is after 'log_time_after'.<br/>Supported values:<br/>1579039377301 (time in milliseconds)<br/>"3 days" (relative date)<br/>"2019-10-21T23:45:00" (date). | Optional |
| timestamp_lte | Return logs for which the timestamp is before the 'log_time_after'.<br/>Supported values:<br/>1579039377301 (time in milliseconds)<br/>"3 days" (relative date)<br/>"2019-10-21T23:45:00" (date). | Optional |
| page | Page number (for pagination). The default is 0 (the first page). Default is 0. | Optional |
| limit | Maximum number of audit logs to return per page. The default and maximum is 30. Default is 30. | Optional |
| sort_by | Specifies the field by which to sort the results. By default the sort is defined as creation-time and DESC. Can be "type", "sub_type", "result", or "timestamp". Possible values are: type, sub_type, result, timestamp. | Optional |
| sort_order | The sort order. Can be "asc" (ascending) or "desc" (descending). Default set to "desc". Possible values are: asc, desc. Default is desc. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ID | Number | Audit log ID. |
| PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_OWNER_NAME | String | Audit owner name. |
| PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_OWNER_EMAIL | String | Audit owner email address. |
| PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ASSET_JSON | String | Asset JSON. |
| PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ASSET_NAMES | String | Audit asset names. |
| PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_HOSTNAME | String | Host name. |
| PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_RESULT | String | Audit result. |
| PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_REASON | String | Audit reason. |
| PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_DESCRIPTION | String | Description of the audit. |
| PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ENTITY | String | Audit entity (e.g., AUTH, DISTRIBUTIONS). |
| PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ENTITY_SUBTYPE | String | Entity subtype (e.g., Login, Create). |
| PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_CASE_ID | Number | Audit case ID. |
| PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_INSERT_TIME | Date | Log's insert time. |

### xdr-get-audit-agent-reports

***
Gets agent event reports. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of reports from the start of the result set (start by counting from 0).

##### Required Permissions

Required Permissions For API call:
`Auditing` --> `View`

Builtin Roles with this permission includes: "Viewer" and "Instance Admin".

#### Base Command

`xdr-get-audit-agent-reports`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| endpoint_ids | A comma-separated list of endpoint IDs. | Optional |
| endpoint_names | A comma-separated list of endpoint names. | Optional |
| type | The report type. Can be "Installation", "Policy", "Action", "Agent Service", "Agent Modules", or "Agent Status". Possible values are: Installation, Policy, Action, Agent Service, Agent Modules, Agent Status. | Optional |
| sub_type | The report subtype. Possible values are: Install, Uninstall, Upgrade, Local Configuration, Content Update, Policy Update, Process Exception, Hash Exception, Scan, File Retrieval, File Scan, Terminate Process, Isolate, Cancel Isolation, Payload Execution, Quarantine, Restore, Stop, Start, Module Initialization, Local Analysis Model, Local Analysis Feature Extraction, Fully Protected, OS Incompatible, Software Incompatible, Kernel Driver Initialization, Kernel Extension Initialization, Proxy Communication, Quota Exceeded, Minimal Content, Reboot Required, Missing Disc Access. | Optional |
| result | The result type. Can be "Success" or "Fail". If not passed, returns all event reports. Possible values are: Success, Fail. | Optional |
| timestamp_gte | Return logs that their timestamp is greater than 'log_time_after'.<br/>Supported values:<br/>1579039377301 (time in milliseconds)<br/>"3 days" (relative date)<br/>"2019-10-21T23:45:00" (date). | Optional |
| timestamp_lte | Return logs for which the timestamp is before the 'timestamp_lte'.<br/><br/>Supported values:<br/>1579039377301 (time in milliseconds)<br/>"3 days" (relative date)<br/>"2019-10-21T23:45:00" (date). | Optional |
| page | Page number (for pagination). The default is 0 (the first page). Default is 0. | Optional |
| limit | The maximum number of reports to return. Default and maximum is 30. Default is 30. | Optional |
| sort_by | The field by which to sort results. Can be "type", "category", "trapsversion", "timestamp", or "domain"). Possible values are: type, category, trapsversion, timestamp, domain. | Optional |
| sort_order | The sort order. Can be "asc" (ascending) or "desc" (descending). Default is "asc". Possible values are: asc, desc. Default is asc. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.AuditAgentReports.ENDPOINTID | String | Endpoint ID. |
| PaloAltoNetworksXDR.AuditAgentReports.ENDPOINTNAME | String | Endpoint name. |
| PaloAltoNetworksXDR.AuditAgentReports.DOMAIN | String | Agent domain. |
| PaloAltoNetworksXDR.AuditAgentReports.TRAPSVERSION | String | Traps version. |
| PaloAltoNetworksXDR.AuditAgentReports.RECEIVEDTIME | Date | Received time in Epoch time. |
| PaloAltoNetworksXDR.AuditAgentReports.TIMESTAMP | Date | Timestamp in Epoch time. |
| PaloAltoNetworksXDR.AuditAgentReports.CATEGORY | String | Report category (e.g., Audit). |
| PaloAltoNetworksXDR.AuditAgentReports.TYPE | String | Report type (e.g., Action, Policy). |
| PaloAltoNetworksXDR.AuditAgentReports.SUBTYPE | String | Report subtype (e.g., Fully Protected,Policy Update,Cancel Isolation\). |
| PaloAltoNetworksXDR.AuditAgentReports.RESULT | String | Report result. |
| PaloAltoNetworksXDR.AuditAgentReports.REASON | String | Report reason. |
| PaloAltoNetworksXDR.AuditAgentReports.DESCRIPTION | String | Agent report description. |
| Endpoint.ID | String | The unique ID within the tool retrieving the endpoint. |
| Endpoint.Hostname | String | The hostname that is mapped to this endpoint. |
| Endpoint.Domain | String | The domain of the endpoint. |

### xdr-blocklist-files

***
Block lists requested files which have not already been block listed or added to allow lists.

##### Required Permissions

Required Permissions For API call:
`Action Center` --> `View/ Edit`
`Action Center` --> `Allow List/Block List`

Builtin Roles with this permission includes: "Responder", "Privileged Responder" and "Instance Admin".

#### Base Command

`xdr-blocklist-files`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident_id | Links the response action to the triggered incident. | Optional |
| hash_list | String that represents a list of hashed files you want to block list. Must be a valid SHA256 hash. | Required |
| comment | String that represents additional information regarding the action. | Optional |
| detailed_response | Choose either regular response or detailed response. Default value = false, regular response. Possible values are: true, false. Default is false. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.blocklist.added_hashes | Number | Number of file hashes added to block list. |
| PaloAltoNetworksXDR.blocklist.excluded_hashes | Number | Number of file hashes excluded from block list. |

### xdr-allowlist-files

***
Adds requested files to allow list if they are not already on block list or allow list.

##### Required Permissions

Required Permissions For API call:
`Action Center` --> `View/ Edit`
`Action Center` --> `Allow List/Block List`

Builtin Roles with this permission includes: "Responder", "Privileged Responder" and "Instance Admin".

#### Base Command

`xdr-allowlist-files`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident_id | Links the response action to the triggered incident. | Optional |
| hash_list | String that represents a list of hashed files you want to add to allow lists. Must be a valid SHA256 hash. | Required |
| comment | String that represents additional information regarding the action. | Optional |
| detailed_response | Choose either regular response or detailed response. Default value = false, regular response. Possible values are: true, false. Default is false. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.allowlist.added_hashes | Number | Number of added file hashes to allowlist. |
| PaloAltoNetworksXDR.allowlist.excluded_hashes | Number | Number of excluded file hashes from allowlist. |

### xdr-file-quarantine

***
Quarantines a file on selected endpoints. You can select up to 1000 endpoints.

##### Required Permissions

Required Permissions For API call:
`Action Center` --> `View/ Edit`
`Action Center` --> `Quarantine`

Builtin Roles with this permission includes: "Responder", "Privileged Responder" and "Instance Admin".

#### Base Command

`xdr-file-quarantine`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident_id | Allows linking the response action to the incident that triggered it. | Optional |
| endpoint_id_list | List of endpoint IDs. | Required |
| file_path | String that represents the path of the file you want to quarantine. | Required |
| file_hash | String that represents the file's hash. Must be a valid SHA256 hash. | Required |
| interval_in_seconds | Interval in seconds between each poll. | Optional |
| timeout_in_seconds | Polling timeout in seconds. | Optional |
| action_id | The action IDs for polling use. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket | String | The bucket in which the error occurred. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name | String | The name of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path | String | The path of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size | Number | The size of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files | Unknown | The missing files that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData | String | The error reason data. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by | String | The instance ID which terminated the action and caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription | String | The error reason description. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result | Unknown | The error reason terminate result. |

### xdr-get-quarantine-status

***
Retrieves the quarantine status for a selected file.

##### Required Permissions

Required Permissions For API call:
`Action Center` --> `View/ Edit`
`Action Center` --> `Quarantine`

Builtin Roles with this permission includes: "Responder", "Privileged Responder" and "Instance Admin".

#### Base Command

`xdr-get-quarantine-status`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| endpoint_id | String the represents the endpoint ID. | Required |
| file_hash | String that represents the file hash. Must be a valid SHA256 hash. | Required |
| file_path | String that represents the file path. | Required |

#### Context Output

There is no context output for this command.

### xdr-file-restore

***
Restores a quarantined file on requested endpoints.

##### Required Permissions

Required Permissions For API call:
`Action Center` --> `View/ Edit`
`Action Center` --> `Quarantine`

Builtin Roles with this permission includes: "Responder", "Privileged Responder" and "Instance Admin".

#### Base Command

`xdr-file-restore`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident_id | Allows linking the response action to the incident that triggered it. | Optional |
| file_hash | The hash code of the file. Must be a valid SHA256 hash. | Required |
| endpoint_id | String that represents the endpoint ID. If you do not enter a specific endpoint ID, the request will run restore on all endpoints that relate to the quarantined file you defined. | Optional |
| interval_in_seconds | Interval in seconds between each poll. | Optional |
| timeout_in_seconds | Polling timeout in seconds. | Optional |
| action_id | The action IDs for polling use. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket | String | The bucket in which the error occurred. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name | String | The name of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path | String | The path of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size | Number | The size of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files | Unknown | The missing files that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData | String | The error reason data. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by | String | The instance ID which terminated the action and caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription | String | The error reason description. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result | Unknown | The error reason terminate result. |

### xdr-endpoint-scan-execute

***
Runs a scan on a selected endpoint. To scan all endpoints, run this command with argument all=true. Note: scanning all the endpoints may cause performance issues and latency.

##### Required Permissions

Required Permissions For API call:
`Action Center` --> `View`
`Endpoint Administrations` --> `View/ Edit`
`Endpoint Administrations` --> `Endpoint Scan`

Builtin Roles with this permission includes: "Privileged Responder" and "Instance Admin".

#### Base Command

`xdr-endpoint-scan-execute`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident_id | Allows linking the response action to the incident that triggered it. | Optional |
| endpoint_id_list | List of endpoint IDs. | Optional |
| dist_name | Name of the distribution list. | Optional |
| gte_first_seen | Greater than or equal to first seen timestamp in milliseconds. | Optional |
| gte_last_seen | Greater than or equal to last seen timestamp in milliseconds. | Optional |
| lte_first_seen | Less than or equal to first seen timestamp in milliseconds. | Optional |
| lte_last_seen | Less than or equal to last seen timestamp in milliseconds. | Optional |
| ip_list | List of IP addresses. | Optional |
| group_name | Name of the endpoint group. | Optional |
| platform | Type of operating system. Possible values are: windows, linux, macos, android. | Optional |
| alias | Endpoint alias name. | Optional |
| isolate | Whether an endpoint has been isolated. Possible values are: isolated, unisolated. | Optional |
| hostname | Name of the host. | Optional |
| all | Whether to scan all of the endpoints. Scanning all of the endpoints may cause performance issues and latency. Possible values are: true, false. Default is false. | Optional |
| action_id | The action IDs for polling use. | Optional |
| interval_in_seconds | Interval in seconds between each poll. | Optional |
| timeout_in_seconds | Polling timeout in seconds. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.endpointScan.actionId | Number | The action ID of the scan request. |
| PaloAltoNetworksXDR.endpointScan.aborted | Boolean | Was the scan aborted? |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket | String | The bucket in which the error occurred. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name | String | The name of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path | String | The path of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size | Number | The size of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files | Unknown | The missing files that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData | String | The error reason data. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by | String | The instance ID which terminated the action and caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription | String | The error reason description. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result | Unknown | The error reason terminate result. |

### xdr-endpoint-scan-abort

***
Cancels the scan of selected endpoints. A scan can only be aborted if the selected endpoints are Pending or In Progress. To scan all endpoints, run the command with the argument all=true. Note that scanning all of the endpoints may cause performance issues and latency.

##### Required Permissions

Required Permissions For API call:
`Endpoint Administrations` --> `View/ Edit`
`Endpoint Administrations` --> `Endpoint Scan`

Builtin Roles with this permission includes: "Privileged Responder" and "Instance Admin".

#### Base Command

`xdr-endpoint-scan-abort`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident_id | Allows linking the response action to the incident that triggered it. | Optional |
| endpoint_id_list | List of endpoint IDs. | Optional |
| dist_name | Name of the distribution list. | Optional |
| gte_first_seen | GTE first seen timestamp in milliseconds. | Optional |
| gte_last_seen | GTE last seen timestamp in milliseconds. | Optional |
| lte_first_seen | LTE first seen timestamp in milliseconds. | Optional |
| lte_last_seen | LTE last seen timestamp in milliseconds. | Optional |
| ip_list | List of IP addresses. | Optional |
| group_name | Name of the endpoint group. | Optional |
| platform | Type of operating system. Possible values are: windows, linux, macos, android. | Optional |
| alias | Endpoint alias name. | Optional |
| isolate | Whether an endpoint has been isolated. Can be "isolated" or "unisolated". Possible values are: isolated, unisolated. | Optional |
| hostname | Name of the host. | Optional |
| all | Whether to scan all of the endpoints. Note: scanning all of the endpoints may cause performance issues and latency. Possible values are: true, false. Default is false. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.endpointScan.actionId | Unknown | The action ID of the abort scan request. |
| PaloAltoNetworksXDR.endpointScan.aborted | Boolean | Was the scan aborted? |

### get-mapping-fields

***
Gets mapping fields from remote incident. Note: This method will not update the current incident, it's here for debugging purposes.

#### Base Command

`get-mapping-fields`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |

#### Context Output

There is no context output for this command.

### get-remote-data

***
Gets remote data from a remote incident. Note: This method will not update the current incident, it's here for debugging purposes.

#### Base Command

`get-remote-data`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | The remote incident ID. | Required |
| lastUpdate | UTC timestamp in seconds. The incident is only updated if it was modified after the last update time. Default is 0. | Optional |

#### Context Output

There is no context output for this command.

### get-modified-remote-data

***
Gets the list of incidents that were modified since the last update. Note: This method is here for debugging purposes. get-modified-remote-data is used as part of a Mirroring feature, which is available since version 6.1.

#### Base Command

`get-modified-remote-data`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| lastUpdate | Date string representing the local time.The incident is only returned if it was modified after the last update time. | Optional |

#### Context Output

There is no context output for this command.

### xdr-get-policy

***
Gets the policy name for a specific endpoint.

##### Required Permissions

Required Permissions For API call:
`Endpoint Prevention Policies` --> `View`

Builtin Roles with this permission includes: "Privileged Investigator", "Privileged Responder", "Viewer", and "Instance Admin".

#### Base Command

`xdr-get-policy`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| endpoint_id | The endpoint ID. Can be retrieved by running the xdr-get-endpoints command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.Policy | string | The policy allocated with the endpoint. |
| PaloAltoNetworksXDR.Policy.policy_name | string | Name of the policy allocated with the endpoint. |
| PaloAltoNetworksXDR.Policy.endpoint_id | string | Endpoint ID. |

### xdr-get-scripts

***
Gets a list of scripts available in the scripts library.

##### Required Permissions

Required Permissions For API call:
`Agent Scripts library` --> `View`
`Endpoint Administrations` --> `View/ Edit`
`Endpoint Administrations` --> `Endpoint Scan`

Builtin Roles with this permission includes: "Privileged Responder", "Viewer" and "Instance Admin".

#### Base Command

`xdr-get-scripts`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| script_name | A comma-separated list of the script names. | Optional |
| description | A comma-separated list of the script descriptions. | Optional |
| created_by | A comma-separated list of the users who created the script. | Optional |
| limit | The maximum number of scripts returned to the War Room. | Optional |
| offset | (Int) Offset in the data set. | Optional |
| windows_supported | Whether the script can be executed on a Windows operating system. Possible values are: true, false. | Optional |
| linux_supported | Whether the script can be executed on a Linux operating system. Possible values are: true, false. | Optional |
| macos_supported | Whether the script can be executed on a Mac operating system. Possible values are: true, false. | Optional |
| is_high_risk | Whether the script has a high-risk outcome. Possible values are: true, false. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.Scripts | Unknown | The scripts command results. |
| PaloAltoNetworksXDR.Scripts.script_id | Unknown | Script ID. |
| PaloAltoNetworksXDR.Scripts.name | string | Name of the script. |
| PaloAltoNetworksXDR.Scripts.description | string | Description of the script. |
| PaloAltoNetworksXDR.Scripts.modification_date | Unknown | Timestamp of when the script was last modified. |
| PaloAltoNetworksXDR.Scripts.created_by | string | Name of the user who created the script. |
| PaloAltoNetworksXDR.Scripts.windows_supported | boolean | Whether the script can be executed on a Windows operating system. |
| PaloAltoNetworksXDR.Scripts.linux_supported | boolean | Whether the script can be executed on a Linux operating system. |
| PaloAltoNetworksXDR.Scripts.macos_supported | boolean | Whether the script can be executed on Mac operating system. |
| PaloAltoNetworksXDR.Scripts.is_high_risk | boolean | Whether the script has a high-risk outcome. |
| PaloAltoNetworksXDR.Scripts.script_uid | string | Globally Unique Identifier of the script, used to identify the script when executing. |

### xdr-delete-endpoints

***
Deletes selected endpoints in the Cortex XDR app. You can delete up to 1000 endpoints.

##### Required Permissions

Required Permissions For API call:
`Endpoint Administrations` --> `View/ Edit`

Builtin Roles with this permission includes: "Privileged Responder" and "Instance Admin".

#### Base Command

`xdr-delete-endpoints`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| endpoint_ids | A comma-separated list of endpoint IDs. You can retrieve the endpoint IDs from the xdr-get-endpoints command. | Required |

#### Context Output

There is no context output for this command.

### xdr-get-endpoint-device-control-violations

***
Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.

##### Required Permissions

Required Permissions For API call:
`Device Control` --> `View`

Builtin Roles with this permission includes: "Privileged Investigator", "Privileged Responder", "Viewer", and "Instance Admin".

#### Base Command

`xdr-get-endpoint-device-control-violations`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| endpoint_ids | A comma-separated list of endpoint IDs. You can retrieve the endpoint IDs from the xdr-get-endpoints command. | Optional |
| type | Type of violation. Possible values are: "cd-rom", "disk drive", "floppy disk", and "portable device". Possible values are: cd-rom, disk drive, floppy disk, portable device. | Optional |
| timestamp_gte | Timestamp of the violation. Violations that are greater than or equal to this timestamp will be returned. Values can be in either ISO date format, relative time, or epoch timestamp. For example:  "2019-10-21T23:45:00" (ISO date format), "3 days ago" (relative time) 1579039377301 (epoch time). | Optional |
| timestamp_lte | Timestamp of the violation. Violations that are less than or equal to this timestamp will be returned. Values can be in either ISO date format, relative time, or epoch timestamp. For example:  "2019-10-21T23:45:00" (ISO date format), "3 days ago" (relative time) 1579039377301 (epoch time). | Optional |
| ip_list | A comma-separated list of IP addresses. | Optional |
| vendor | Name of the vendor. | Optional |
| vendor_id | Vendor ID. | Optional |
| product | Name of the product. | Optional |
| product_id | Product ID. | Optional |
| serial | Serial number. | Optional |
| hostname | Hostname. | Optional |
| violation_id_list | A comma-separated list of violation IDs. | Optional |
| username | Username. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.EndpointViolations | Unknown | Endpoint violations command results. |
| PaloAltoNetworksXDR.EndpointViolations.violations | Unknown | A list of violations. |
| PaloAltoNetworksXDR.EndpointViolations.violations.os_type | string | Type of the operating system. |
| PaloAltoNetworksXDR.EndpointViolations.violations.hostname | string | Host name of the violation. |
| PaloAltoNetworksXDR.EndpointViolations.violations.username | string | Username of the violation. |
| PaloAltoNetworksXDR.EndpointViolations.violations.ip | string | IP address of the violation. |
| PaloAltoNetworksXDR.EndpointViolations.violations.timestamp | number | Timestamp of the violation. |
| PaloAltoNetworksXDR.EndpointViolations.violations.violation_id | number | Violation ID. |
| PaloAltoNetworksXDR.EndpointViolations.violations.type | string | Type of violation. |
| PaloAltoNetworksXDR.EndpointViolations.violations.vendor_id | string | Vendor ID of the violation. |
| PaloAltoNetworksXDR.EndpointViolations.violations.vendor | string | Name of the vendor of the violation. |
| PaloAltoNetworksXDR.EndpointViolations.violations.product_id | string | Product ID of the violation. |
| PaloAltoNetworksXDR.EndpointViolations.violations.product | string | Name of the product of the violation. |
| PaloAltoNetworksXDR.EndpointViolations.violations.serial | string | Serial number of the violation. |
| PaloAltoNetworksXDR.EndpointViolations.violations.endpoint_id | string | Endpoint ID of the violation. |

### xdr-file-retrieve

***
Retrieves files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. At least one endpoint ID and one file path are necessary in order to run the command. After running this command, you can use the xdr-action-status-get command with returned action_id, to check the action status.

##### Required Permissions

Required Permissions For API call:
`Action Center` --> `View/ Edit`
`Action Center` --> `File Retrieval`

Builtin Roles with this permission includes: "Privileged Responder" and "Instance Admin".

#### Base Command

`xdr-file-retrieve`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident_id | Allows to link the response action to the incident that triggered it. | Optional |
| endpoint_ids | A comma-separated list of endpoint IDs. | Required |
| windows_file_paths | A comma-separated list of file paths on the Windows platform. | Optional |
| linux_file_paths | A comma-separated list of file paths on the Linux platform. | Optional |
| mac_file_paths | A comma-separated list of file paths on the Mac platform. | Optional |
| generic_file_path | A comma-separated list of file paths in any platform. Can be used instead of the mac/windows/linux file paths. The order of the files path list must be parallel to the endpoints list order, so the first file path in the list is related to the first endpoint and so on. | Optional |
| paths_separator | The delimiter used to separate multiple file paths. Set to a different character (for example, ";") when a file path contains a comma. Default is ,. | Optional |
| interval_in_seconds | Interval in seconds between each poll. | Optional |
| timeout_in_seconds | Polling timeout in seconds. | Optional |
| action_id | The action IDs for polling use. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.RetrievedFiles.action_id | string | ID of the action to retrieve files from selected endpoints. |
| PaloAltoNetworksXDR.RetrievedFiles.endpoint_id | string | Endpoint ID. Added only when the operation is successful. |
| PaloAltoNetworksXDR.RetrievedFiles.file_link | string | Link to the file. Added only when the operation is successful. |
| PaloAltoNetworksXDR.RetrievedFiles.status | string | The action status. Added only when the operation is unsuccessful. |
| PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.bucket | String | The bucket in which the error occurred. |
| PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.file_name | String | The name of the file that caused the error. |
| PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.file_path | String | The path of the file that caused the error. |
| PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.file_size | Number | The size of the file that caused the error. |
| PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.missing_files | Unknown | The missing files that caused the error. |
| PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.errorData | String | The error reason data. |
| PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.terminated_by | String | The instance ID which terminated the action and caused the error. |
| PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.errorDescription | String | The error reason description. |
| PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.terminate_result | Unknown | The error reason terminate result. |

### xdr-retrieve-file-details

***
View the file retrieved by the xdr-retrieve-files command according to the action ID. Before running this command, you can use the xdr-action-status-get command to check if this action completed successfully.

##### Required Permissions

Required Permissions For API call:
`Action Center` --> `View/ Edit`
`Action Center` --> `File Retrieval`

Builtin Roles with this permission includes: "Privileged Responder" and "Instance Admin".

#### Base Command

`xdr-retrieve-file-details`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| action_id | Action ID retrieved from the xdr-retrieve-files command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| File | Unknown | The file details command results. |
| File.Name | String | The full file name \(including the file extension\). |
| File.EntryID | String | The ID for locating the file in the War Room. |
| File.Size | Number | The size of the file in bytes. |
| File.MD5 | String | The MD5 hash of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.SHA512 | String | The SHA512 hash of the file. |
| File.Extension | String | The file extension. For example: "xls". |
| File.Type | String | The file type, as determined by libmagic \(same as displayed in file entries\). |

### xdr-get-script-metadata

***
Gets the full definition of a specific script in the scripts library.

##### Required Permissions

Required Permissions For API call:
`Agent Scripts library` --> `View`

Builtin Roles with this permission includes: "Privileged Responder", "Viewer" and "Instance Admin".

#### Base Command

`xdr-get-script-metadata`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| script_uid | Unique identifier of the script, returned by the xdr-get-scripts command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.ScriptMetadata | Unknown | The script metadata command results. |
| PaloAltoNetworksXDR.ScriptMetadata.script_id | number | Script ID. |
| PaloAltoNetworksXDR.ScriptMetadata.name | string | Script name. |
| PaloAltoNetworksXDR.ScriptMetadata.description | string | Script description. |
| PaloAltoNetworksXDR.ScriptMetadata.modification_date | unknown | Timestamp of when the script was last modified. |
| PaloAltoNetworksXDR.ScriptMetadata.created_by | string | Name of the user who created the script. |
| PaloAltoNetworksXDR.ScriptMetadata.is_high_risk | boolean | Whether the script has a high-risk outcome. |
| PaloAltoNetworksXDR.ScriptMetadata.windows_supported | boolean | Whether the script can be executed on a Windows operating system. |
| PaloAltoNetworksXDR.ScriptMetadata.linux_supported | boolean | Whether the script can be executed on a Linux operating system. |
| PaloAltoNetworksXDR.ScriptMetadata.macos_supported | boolean | Whether the script can be executed on a Mac operating system. |
| PaloAltoNetworksXDR.ScriptMetadata.entry_point | string | Name of the entry point selected for the script. An empty string indicates  the script defined as just run. |
| PaloAltoNetworksXDR.ScriptMetadata.script_input | string | Name and type for the specified entry point. |
| PaloAltoNetworksXDR.ScriptMetadata.script_output_type | string | Type of the output. |
| PaloAltoNetworksXDR.ScriptMetadata.script_output_dictionary_definitions | Unknown | If the script_output_type is a dictionary, an array with friendly name, name, and type for each output. |

### xdr-get-script-code

***
Gets the code of a specific script in the script library.

##### Required Permissions

Required Permissions For API call:
`Agent Scripts library` --> `View`

Builtin Roles with this permission includes: "Privileged Responder", "Viewer" and "Instance Admin".

#### Base Command

`xdr-get-script-code`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| script_uid | Unique identifier of the script, returned by the xdr-get-scripts command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.ScriptCode | Unknown | The script code command results. |
| PaloAltoNetworksXDR.ScriptCode.code | string | The code of a specific script in the script library. |
| PaloAltoNetworksXDR.ScriptCode.script_uid | string | Unique identifier of the script. |

### xdr-action-status-get

***
Retrieves the status of the requested actions according to the action ID.

##### Required Permissions

Required Permissions For API call:
`Action Center` --> `View`

Builtin Roles with this permission includes: "Responder", "Privileged Investigator", "Privileged Responder", "Viewer", and "Instance Admin".

#### Base Command

`xdr-action-status-get`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| action_id | The action ID of the selected request. After performing an action, you will receive an action ID. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.GetActionStatus | Unknown | The action status command results. |
| PaloAltoNetworksXDR.GetActionStatus.endpoint_id | string | Endpoint ID. |
| PaloAltoNetworksXDR.GetActionStatus.status | string | The status of the specific endpoint ID. |
| PaloAltoNetworksXDR.GetActionStatus.action_id | number | The specified action ID. |

### xdr-run-script

***
Deprecated. Use the `xdr-script-run` command instead. Initiates a new endpoint script execution action using a script from the script library.

#### Base Command

`xdr-run-script`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident_id | Allows linking the response action to the incident that triggered it. | Optional |
| endpoint_ids | A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command. | Required |
| script_uid | Unique identifier of the script. Can be retrieved by running the xdr-get-scripts command. | Required |
| parameters | Dictionary containing the parameter name as key and its value for this execution as the value. For example, {"param1":"param1_value","param2":"param2_value"}. | Optional |
| timeout | The timeout in seconds for this execution. Default is 600. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.ScriptRun.action_id | Number | ID of the action initiated. |
| PaloAltoNetworksXDR.ScriptRun.endpoints_count | Number | Number of endpoints the action was initiated on. |

### xdr-snippet-code-script-execute

***
Initiates a new endpoint script execution action using the provided snippet code.

##### Required Permissions

Required Permissions For API call:
`Action Center` --> `View`

Builtin Roles with this permission includes: "Responder", "Privileged Investigator", "Privileged Responder", "Viewer", and "Instance Admin".

#### Base Command

`xdr-snippet-code-script-execute`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident_id | Allows linking the response action to the incident that triggered it. | Optional |
| endpoint_ids | A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command. | Required |
| snippet_code | Section of a script to initiate on an endpoint (e.g., print("7")). | Required |
| interval_in_seconds | Interval in seconds between each poll. | Optional |
| timeout_in_seconds | Polling timeout in seconds. | Optional |
| action_id | Action IDs for polling use. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.ScriptRun.action_id | Number | ID of the action initiated. |
| PaloAltoNetworksXDR.ScriptRun.endpoints_count | Number | Number of endpoints the action was initiated on. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket | String | The bucket in which the error occurred. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name | String | The name of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path | String | The path of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size | Number | The size of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files | Unknown | The missing files that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData | String | The error reason data. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by | String | The instance ID which terminated the action and caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription | String | The error reason description. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result | Unknown | The error reason terminate result. |

### xdr-get-script-execution-status

***
Retrieves the status of a script execution action.

##### Required Permissions

Required Permissions For API call:
`Agent Scripts library` --> `View`

Builtin Roles with this permission includes: "Privileged Responder", "Viewer" and "Instance Admin".

#### Base Command

`xdr-get-script-execution-status`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| action_id | Action IDs retrieved from the xdr-run-script command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.ScriptStatus.general_status | String | General status of the action, considering the status of all the endpoints. |
| PaloAltoNetworksXDR.ScriptStatus.error_message | String | Error message regarding permissions for running APIs or the action doesn’t exist. |
| PaloAltoNetworksXDR.ScriptStatus.endpoints_timeout | Number | Number of endpoints in "timeout" status. |
| PaloAltoNetworksXDR.ScriptStatus.action_id | Number | ID of the action initiated. |
| PaloAltoNetworksXDR.ScriptStatus.endpoints_pending_abort | Number | Number of endpoints in "pending abort" status. |
| PaloAltoNetworksXDR.ScriptStatus.endpoints_pending | Number | Number of endpoints in "pending" status. |
| PaloAltoNetworksXDR.ScriptStatus.endpoints_in_progress | Number | Number of endpoints in "in progress" status. |
| PaloAltoNetworksXDR.ScriptStatus.endpoints_failed | Number | Number of endpoints in "failed" status. |
| PaloAltoNetworksXDR.ScriptStatus.endpoints_expired | Number | Number of endpoints in "expired" status. |
| PaloAltoNetworksXDR.ScriptStatus.endpoints_completed_successfully | Number | Number of endpoints in "completed successfully" status. |
| PaloAltoNetworksXDR.ScriptStatus.endpoints_canceled | Number | Number of endpoints in "canceled" status. |
| PaloAltoNetworksXDR.ScriptStatus.endpoints_aborted | Number | Number of endpoints in "aborted" status. |

### xdr-get-script-execution-results

***
Retrieve the results of a script execution action.

##### Required Permissions

Required Permissions For API call:
`Agent Scripts library` --> `View`

Builtin Roles with this permission includes: "Privileged Responder", "Viewer" and "Instance Admin".

#### Base Command

`xdr-get-script-execution-results`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| action_id | Action IDs retrieved from the xdr-run-script command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.ScriptResult.action_id | Number | ID of the action initiated. |
| PaloAltoNetworksXDR.ScriptResult.results.retrieved_files | Number | Number of successfully retrieved files. |
| PaloAltoNetworksXDR.ScriptResult.results.endpoint_ip_address | String | Endpoint IP address. |
| PaloAltoNetworksXDR.ScriptResult.results.endpoint_name | String | Name of successfully retrieved files. |
| PaloAltoNetworksXDR.ScriptResult.results.failed_files | Number | Number of files failed to retrieve. |
| PaloAltoNetworksXDR.ScriptResult.results.endpoint_status | String | Endpoint status. |
| PaloAltoNetworksXDR.ScriptResult.results.domain | String | Domain to which the endpoint belongs. |
| PaloAltoNetworksXDR.ScriptResult.results.endpoint_id | String | Endpoint ID. |
| PaloAltoNetworksXDR.ScriptResult.results.execution_status | String | Execution status of this endpoint. |
| PaloAltoNetworksXDR.ScriptResult.results.return_value | String | Value returned by the script in case the type is not a dictionary. |
| PaloAltoNetworksXDR.ScriptResult.results.standard_output | String | The STDOUT and the STDERR logged by the script during the execution. |
| PaloAltoNetworksXDR.ScriptResult.results.retention_date | Date | Timestamp in which the retrieved files will be deleted from the server. |

### xdr-get-script-execution-result-files

***
Gets the files retrieved from a specific endpoint during a script execution.

##### Required Permissions

Required Permissions For API call:
`Agent Scripts library` --> `View`

Builtin Roles with this permission includes: "Privileged Responder", "Viewer" and "Instance Admin".

#### Base Command

`xdr-get-script-execution-result-files`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| action_id | Action ID retrieved from the xdr-run-script command. | Required |
| endpoint_id | Endpoint ID. Can be retrieved by running the xdr-get-endpoints command. | Required |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| File.Size | String | The size of the file. |
| File.SHA1 | String | The SHA1 hash of the file. |
| File.SHA256 | String | The SHA256 hash of the file. |
| File.SHA512 | String | The SHA512 hash of the file. |
| File.Name | String | The name of the file. |
| File.SSDeep | String | The SSDeep hash of the file. |
| File.EntryID | String | EntryID of the file |
| File.Info | String | Information about the file. |
| File.Type | String | The file type. |
| File.MD5 | String | The MD5 hash of the file. |
| File.Extension | String | The extension of the file. |

### xdr-script-commands-execute

***
Initiates a new endpoint script execution of shell commands.

#### Base Command

`xdr-script-commands-execute`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident_id | Allows linking the response action to the incident that triggered it. | Optional |
| endpoint_ids | A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command. | Required |
| commands | A comma-separated list of shell commands to execute. Set the `is_raw_command` argument to `true` to prevent splitting by commas. (Useful when using `\|\|`, `&amp;&amp;`, `;` separators for controlling the flow of multiple commands). | Required |
| is_raw_command | Whether to pass the command as-is. When false, the command is split by commas and sent as a list of commands, that are run independently. | Optional |
| command_type | Type of shell command. Possible values are: powershell, native. | Optional |
| timeout | The timeout in seconds for this execution. Default is 600. | Optional |
| interval_in_seconds | Interval in seconds between each poll. | Optional |
| timeout_in_seconds | Polling timeout in seconds. | Optional |
| action_id | The action IDs for polling use. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.ScriptRun.action_id | Number | ID of the action initiated. |
| PaloAltoNetworksXDR.ScriptRun.endpoints_count | Number | Number of endpoints the action was initiated on. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket | String | The bucket in which the error occurred. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name | String | The name of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path | String | The path of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size | Number | The size of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files | Unknown | The missing files that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData | String | The error reason data. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by | String | The instance ID which terminated the action and caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription | String | The error reason description. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result | Unknown | The error reason terminate result. |

### xdr-file-delete-script-execute

***
Initiates a new endpoint script execution to delete the specified file.

#### Base Command

`xdr-file-delete-script-execute`

#### Input

| **Argument Name** | **Description**                                                                                                       | **Required** |
| --- |-----------------------------------------------------------------------------------------------------------------------| --- |
| incident_id | Allows linking the response action to the incident that triggered it.                                                 | Optional |
| endpoint_ids | A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.                    | Required |
| file_path | A comma-separated list of paths of the files to delete. All of the given file paths will run on all of the endpoints. | Required |
| timeout | The timeout in seconds for this execution. Default is 600.                                                            | Optional |
| interval_in_seconds | Interval in seconds between each poll.                                                                                | Optional |
| timeout_in_seconds | Polling timeout in seconds.                                                                                           | Optional |
| action_id | The action IDs for polling use.                                                                                       | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.ScriptRun.action_id | Number | ID of the action initiated. |
| PaloAltoNetworksXDR.ScriptRun.endpoints_count | Number | Number of endpoints the action was initiated on. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket | String | The bucket in which the error occurred. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name | String | The name of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path | String | The path of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size | Number | The size of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files | Unknown | The missing files that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData | String | The error reason data. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by | String | The instance ID which terminated the action and caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription | String | The error reason description. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result | Unknown | The error reason terminate result. |

### xdr-file-exist-script-execute

***
Initiates a new endpoint script execution to check if the file exists.

#### Base Command

`xdr-file-exist-script-execute`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident_id | Allows linking the response action to the incident that triggered it. | Optional |
| endpoint_ids | A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command. | Required |
| file_path | A comma-separated list of paths of the files to check for existence. All of the given file paths will run on all of the endpoints. | Required |
| timeout | The timeout in seconds for this execution. Default is 600. | Optional |
| interval_in_seconds | Interval in seconds between each poll. | Optional |
| timeout_in_seconds | Polling timeout in seconds. | Optional |
| action_id | The action IDs for polling use. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.ScriptRun.action_id | Number | ID of the action initiated. |
| PaloAltoNetworksXDR.ScriptRun.endpoints_count | Number | Number of endpoints the action was initiated on. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket | String | The bucket in which the error occurred. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name | String | The name of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path | String | The path of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size | Number | The size of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files | Unknown | The missing files that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData | String | The error reason data. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by | String | The instance ID which terminated the action and caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription | String | The error reason description. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result | Unknown | The error reason terminate result. |

### xdr-kill-process-script-execute

***
Initiates a new endpoint script execution kill process.

#### Base Command

`xdr-kill-process-script-execute`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident_id | Allows to link the response action to the incident that triggered it. | Optional |
| endpoint_ids | A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command. | Required |
| process_name | Names of processes to kill. Will kill all of the given processes on all of the endpoints. | Required |
| timeout | The timeout in seconds for this execution. Default is 600. | Optional |
| interval_in_seconds | Interval in seconds between each poll. | Optional |
| timeout_in_seconds | Polling timeout in seconds. | Optional |
| action_id | The action IDs for polling use. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.ScriptRun.action_id | Number | ID of the action initiated. |
| PaloAltoNetworksXDR.ScriptRun.endpoints_count | Number | Number of endpoints the action was initiated on. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket | String | The bucket in which the error occurred. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name | String | The name of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path | String | The path of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size | Number | The size of the file that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files | Unknown | The missing files that caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData | String | The error reason data. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by | String | The instance ID which terminated the action and caused the error. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription | String | The error reason description. |
| PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result | Unknown | The error reason terminate result. |

### endpoint

***
Returns information about an endpoint.

##### Required Permissions

Required Permissions For API call:
`Endpoint Administrations` --> `View`

Builtin Roles with this permission includes: "Privileged Responder", "Viewer" and "Instance Admin".

#### Base Command

`endpoint`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| id | The endpoint ID. | Optional |
| ip | The endpoint IP address. | Optional |
| hostname | The endpoint host name. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| Endpoint.Hostname | String | The endpoint hostname. |
| Endpoint.OS | String | The endpoint operation system. |
| Endpoint.IPAddress | String | The endpoint IP address. |
| Endpoint.ID | String | The endpoint ID. |
| Endpoint.Status | String | The endpoint status. |
| Endpoint.IsIsolated | String | The endpoint isolation status. |
| Endpoint.MACAddress | String | The endpoint MAC address. |
| Endpoint.Vendor | String | The integration name of the endpoint vendor. |

### xdr-get-endpoints-by-status

***
Returns the number of the connected\disconnected endpoints.

##### Required Permissions

Required Permissions For API call:
`Endpoint Administrations` --> `View`

Builtin Roles with this permission includes: "Privileged Responder", "Viewer" and "Instance Admin".

#### Base Command

`xdr-get-endpoints-by-status`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| status | The status of the endpoint to filter. Possible values are: connected, disconnected, lost, uninstalled. | Required |
| last_seen_gte | All the agents that were last seen before {last_seen_gte}. Supported<br/>        values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00"<br/>        (date). | Optional |
| last_seen_lte | All the agents that were last seen before {last_seen_lte}. Supported<br/>        values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00"<br/>        (date). | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.EndpointsStatus.status | String | The endpoint status. |
| PaloAltoNetworksXDR.EndpointsStatus.count | Number | The number of endpoints with this status. |

### xdr-get-cloud-original-alerts (Deprecated)

***
This command is deprecated. Returns information about each alert ID.

##### Required Permissions

Required Permissions For API call:
`Alerts & Incidents` --> `View`

Builtin Roles with this permission includes: "Investigator", "Responder", "Privileged Investigator", "Privileged Responder", "Viewer", and "Instance Admin".

#### Base Command

`xdr-get-cloud-original-alerts`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| alert_ids | A comma-separated list of alert IDs. | Required |
| events_from_decider_format | Whether to return events_from_decider context output as a dictionary (the raw API response) or as a list (improved for playbook automation) - relevant only when filter_alert_fields is set to False. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.OriginalAlert.event._time | String | The timestamp of the occurrence of the event. |
| PaloAltoNetworksXDR.OriginalAlert.event.vendor | String | Vendor name. |
| PaloAltoNetworksXDR.OriginalAlert.event.event_timestamp | Number | Event timestamp. |
| PaloAltoNetworksXDR.OriginalAlert.event.event_type | Number | Event type \(static 500\). |
| PaloAltoNetworksXDR.OriginalAlert.event.cloud_provider | String | The cloud provider - GCP, AZURE, or AWS. |
| PaloAltoNetworksXDR.OriginalAlert.event.project | String | The project in which the event occurred. |
| PaloAltoNetworksXDR.OriginalAlert.event.cloud_provider_event_id | String | The ID given to the event by the cloud provider, if the ID exists. |
| PaloAltoNetworksXDR.OriginalAlert.event.cloud_correlation_id | String | The ID the cloud provider is using to aggregate events that are part of the same general event. |
| PaloAltoNetworksXDR.OriginalAlert.event.operation_name_orig | String | The name of the operation that occurred, as supplied by the cloud provider. |
| PaloAltoNetworksXDR.OriginalAlert.event.operation_name | String | The normalized name of the operation performed by the event. |
| PaloAltoNetworksXDR.OriginalAlert.event.identity_orig | String | Contains the original identity related fields as provided by the cloud provider. |
| PaloAltoNetworksXDR.OriginalAlert.event.identity_name | String | The name of the identity that initiated the action. |
| PaloAltoNetworksXDR.OriginalAlert.event.identity_uuid | String | Same as identity_name but also contains the UUID of the identity if it exists. |
| PaloAltoNetworksXDR.OriginalAlert.event.identity_type | String | An enum representing the type of the identity. |
| PaloAltoNetworksXDR.OriginalAlert.event.identity_sub_type | String | An enum representing the sub-type of the identity, respective to its identity_type. |
| PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_name | String | The name of the identity that invoked the action as it appears in the log. |
| PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_uuid | String | The UUID of the identity that invoked the action as it appears in the log. |
| PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_type | String | An enum that represents the type of identity event that invoked the action. |
| PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_sub_type | String | An enum that represents the respective sub_type of the type of identity \(identity_type\) that has invoked the action. |
| PaloAltoNetworksXDR.OriginalAlert.event.operation_status | String | Status of whether the operation has succeed or failed, if provided. |
| PaloAltoNetworksXDR.OriginalAlert.event.operation_status_orig | String | The operation status code as it appears in the log, including lookup from code number to code name. |
| PaloAltoNetworksXDR.OriginalAlert.event.operation_status_orig_code | String | The operation status code as it appears in the log. |
| PaloAltoNetworksXDR.OriginalAlert.event.operation_status_reason_provided | String | Description of the error, if the log record indicates an error and the cloud provider supplied the reason. |
| PaloAltoNetworksXDR.OriginalAlert.event.resource_type | String | The normalized type of the service that emitted the log row. |
| PaloAltoNetworksXDR.OriginalAlert.event.resource_type_orig | String | The type of the service that omitted the log as provided by the cloud provider. |
| PaloAltoNetworksXDR.OriginalAlert.event.resource_sub_type | String | The sub-type respective to the resource_type field, normalized across all cloud providers. |
| PaloAltoNetworksXDR.OriginalAlert.event.resource_sub_type_orig | String | The sub-type of the service that emitted this log row as provided by the cloud provider. |
| PaloAltoNetworksXDR.OriginalAlert.event.region | String | The cloud region of the resource that emitted the log. |
| PaloAltoNetworksXDR.OriginalAlert.event.zone | String | The availability zone of the resource that emitted the log. |
| PaloAltoNetworksXDR.OriginalAlert.event.referenced_resource | String | The cloud resource referenced in the audit log. |
| PaloAltoNetworksXDR.OriginalAlert.event.referenced_resource_name | String | Same as referenced_resource but provides only the substring that represents the resource name instead of the full asset ID. |
| PaloAltoNetworksXDR.OriginalAlert.event.referenced_resources_count | Number | The number of extracted resources referenced in this audit log. |
| PaloAltoNetworksXDR.OriginalAlert.event.user_agent | String | The user agent provided in the call to the API of the cloud provider. |
| PaloAltoNetworksXDR.OriginalAlert.event.caller_ip | String | The IP of the caller that performed the action in the log. |
| PaloAltoNetworksXDR.OriginalAlert.event.caller_ip_geolocation | String | The geolocation associated with the caller_ip's value. |
| PaloAltoNetworksXDR.OriginalAlert.event.caller_ip_asn | Number | The ASN of the caller_ip's value. |
| PaloAltoNetworksXDR.OriginalAlert.event.caller_project | String | The project of the caller entity. |
| PaloAltoNetworksXDR.OriginalAlert.event.raw_log | Unknown | The raw log that is being normalized. |
| PaloAltoNetworksXDR.OriginalAlert.event.log_name | String | The name of the log that contains the log row. |
| PaloAltoNetworksXDR.OriginalAlert.event.caller_ip_asn_org | String | The organization associated with the ASN of the caller_ip's value. |
| PaloAltoNetworksXDR.OriginalAlert.event.event_base_id | String | Event base ID. |
| PaloAltoNetworksXDR.OriginalAlert.event.ingestion_time | String | Ingestion time. |

### xdr-remove-allowlist-files

***
Removes requested files from allow list.

##### Required Permissions

Required Permissions For API call:
`Action Center` --> `View/ Edit`
`Action Center` --> `Allow List/Block List`

Builtin Roles with this permission includes: "Responder", "Privileged Responder" and "Instance Admin".

#### Base Command

`xdr-remove-allowlist-files`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident_id | Links the response action to the incident that triggered it. | Optional |
| hash_list | String that represents a list of hashed files you want to add to allow list. Must be a valid SHA256 hash. | Required |
| comment | String that represents additional information regarding the action. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.allowlist.removed_hashes | Number | Removed file hash |

### xdr-remove-blocklist-files

***
Removes requested files from block list.

##### Required Permissions

Required Permissions For API call:
`Action Center` --> `View/ Edit`
`Action Center` --> `Allow List/Block List`

Builtin Roles with this permission includes: "Responder", "Privileged Responder" and "Instance Admin".

#### Base Command

`xdr-remove-blocklist-files`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| incident_id | Links the response action to the incident that triggered it. | Optional |
| hash_list | String that represents a list of hashed files you want to add to allow list. Must be a valid SHA256 hash. | Required |
| comment | String that represents additional information regarding the action. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.blocklist.removed_hashes | Number | Removed fileHash from blocklist |

There is no context output for this command.

### xdr-get-alerts (Deprecated)

***
This command is deprecated, please use xdr-issue-list instead. Returns a list of alerts and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object.
Multiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value.

##### Required Permissions

Required Permissions For API call:
`Alerts & Incidents` --> `View`

Builtin Roles with this permission includes: "Investigator", "Responder", "Privileged Investigator", "Privileged Responder", "Viewer", and "Instance Admin".

#### Base Command

`xdr-get-alerts`

#### Input

| **Argument Name** | **Description** | **Required** |
| --- | --- | --- |
| alert_id | The unique ID of the alert. | Optional |
| severity | The severity of the alert. Possible values are: low, medium, high. | Optional |
| custom_filter | a custom filter, when using this argument, other filter arguments are not relevant. example: <br/>`{<br/>                "OR": [<br/>                    {<br/>                        "SEARCH_FIELD": "actor_process_command_line",<br/>                        "SEARCH_TYPE": "EQ",<br/>                        "SEARCH_VALUE": "path_to_file"<br/>                    }<br/>                ]<br/>            }`. | Optional |
| Identity_type | Account type. Possible values are: ANONYMOUS, APPLICATION, COMPUTE, FEDERATED_IDENTITY, SERVICE, SERVICE_ACCOUNT, TEMPORARY_CREDENTIALS, TOKEN, UNKNOWN, USER. | Optional |
| agent_id | A unique identifier per agent. | Optional |
| action_external_hostname | The host name to connect to. In case of a proxy connection, this value will differ from action_remote_ip. | Optional |
| rule_id | A string identifying the user rule. | Optional |
| rule_name | The name of the user rule. | Optional |
| alert_name | The alert name. | Optional |
| alert_source | The alert source. | Optional |
| time_frame | Supports relative times or “custom” time option. If you choose the "custom" option, you should use start_time and end_time arguments. Possible values are: 60 minutes, 3 hours, 12 hours, 24 hours, 2 days, 7 days, 14 days, 30 days, custom. | Optional |
| user_name | The name assigned to the user_id during agent runtime. | Optional |
| actor_process_image_name | The file name of the binary file. | Optional |
| causality_actor_process_image_command_line | CGO CMD. | Optional |
| actor_process_image_command_line | Trimmed to 128 unicode chars during event serialization.<br/>Full value reported as part of the original process event. | Optional |
| action_process_image_command_line | The command line of the process created. | Optional |
| actor_process_image_sha256 | SHA256 of the binary file. | Optional |
| causality_actor_process_image_sha256 | SHA256 of the binary file. | Optional |
| action_process_image_sha256 | SHA256 of the binary file. | Optional |
| action_file_image_sha256 | SHA256 of the file related to the event. | Optional |
| action_registry_name | The name of the registry. | Optional |
| action_registry_key_data | The key data of the registry. | Optional |
| host_ip | The host IP. | Optional |
| action_local_ip | The local IP address for the connection. | Optional |
| action_remote_ip | Remote IP address for the connection. | Optional |
| alert_action_status | Alert action status. Possible values are: detected, detected (allowed the session), detected (download), detected (forward), detected (post detected), detected (prompt allow), detected (raised an alert), detected (reported), detected (on write), detected (scanned), detected (sinkhole), detected (syncookie sent), detected (wildfire upload failure), detected (wildfire upload success), detected (wildfire upload skip), detected (xdr managed threat hunting), prevented (block), prevented (blocked), prevented (block-override), prevented (blocked the url), prevented (blocked the ip), prevented (continue), prevented (denied the session), prevented (dropped all packets), prevented (dropped the session), prevented (dropped the session and sent a tcp reset), prevented (dropped the packet), prevented (override), prevented (override-lockout), prevented (post detected), prevented (prompt block), prevented (random-drop), prevented (silently dropped the session with an icmp unreachable message to the host or application), prevented (terminated the session and sent a tcp reset to both sides of the connection), prevented (terminated the session and sent a tcp reset to the client), prevented (terminated the session and sent a tcp reset to the server), prevented (on write). | Optional |
| action_local_port | The local IP address for the connection. | Optional |
| action_remote_port | The remote port for the connection. | Optional |
| dst_action_external_hostname | The hostname we connect to. In case of a proxy connection, this value will differ from action_remote_ip. | Optional |
| sort_field | The field by which we sort the results. Default is source_insert_ts. | Optional |
| sort_order | The order in which we sort the results. Possible values are: DESC, ASC. | Optional |
| offset | The first page from which we bring the alerts. Default is 0. | Optional |
| limit | The last page from which we bring the alerts. Default is 50. | Optional |
| start_time | Relevant when "time_frame" argument is "custom". Supports Epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss). | Optional |
| end_time | Relevant when "time_frame" argument is "custom". Supports Epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss). | Optional |
| starred | Whether the alert is starred or not. Possible values are: true, false. | Optional |
| mitre_technique_id_and_name | The MITRE attack technique. | Optional |

#### Context Output

| **Path** | **Type** | **Description** |
| --- | --- | --- |
| PaloAltoNetworksXDR.Alert.internal_id | String | The unique ID of the alert. |
| PaloAltoNetworksXDR.Alert.source_insert_ts | Number | The detection timestamp |
| PaloAltoNetworksXDR.Alert.alert_name | String | The name of the alert. |
| PaloAltoNetworksXDR.Alert.severity | String | The severity of the alert. |
| PaloAltoNetworksXDR.Alert.alert_category | String | The category of the alert. |
| PaloAltoNetworksXDR.Alert.alert_action_status | String | The alert action. Possible values.

DETECTED: detected
DETECTED_0: detected \(allowed the session\)
DOWNLOAD: detected \(download\)
DETECTED_19: detected \(forward\)
POST_DETECTED: detected \(post detected\)
PROMPT_ALLOW: detected \(prompt allow\)
DETECTED_4: detected \(raised an alert\)
REPORTED: detected \(reported\)
REPORTED_TRIGGER_4: detected \(on write\)
SCANNED: detected \(scanned\)
DETECTED_23: detected \(sinkhole\)
DETECTED_18: detected \(syncookie sent\)
DETECTED_21: detected \(wildfire upload failure\)
DETECTED_20: detected \(wildfire upload success\)
DETECTED_22: detected \(wildfire upload skip\)
DETECTED_MTH: detected \(xdr managed threat hunting\)
BLOCKED_25: prevented \(block\)
BLOCKED: prevented \(blocked\)
BLOCKED_14: prevented \(block-override\)
BLOCKED_5: prevented \(blocked the url\)
BLOCKED_6: prevented \(blocked the ip\)
BLOCKED_13: prevented \(continue\)
BLOCKED_1: prevented \(denied the session\)
BLOCKED_8: prevented \(dropped all packets\)
BLOCKED_2: prevented \(dropped the session\)
BLOCKED_3: prevented \(dropped the session and sent a tcp reset\)
BLOCKED_7: prevented \(dropped the packet\)
BLOCKED_16: prevented \(override\)
BLOCKED_15: prevented \(override-lockout\)
BLOCKED_26: prevented \(post detected\)
PROMPT_BLOCK: prevented \(prompt block\)
BLOCKED_17: prevented \(random-drop\)
BLOCKED_24: prevented \(silently dropped the session with an icmp unreachable message to the host or application\)
BLOCKED_9: prevented \(terminated the session and sent a tcp reset to both sides of the connection\)
BLOCKED_10: prevented \(terminated the session and sent a tcp reset to the client\)
BLOCKED_11: prevented \(terminated the session and sent a tcp reset to the server\)
BLOCKED_TRIGGER_4: prevented \(on write\)
 |
| PaloAltoNetworksXDR.Alert.alert_action_status_readable | String | The alert action. |
| PaloAltoNetworksXDR.Alert.alert_name | String | The alert name. |
| PaloAltoNetworksXDR.Alert.alert_description | String | The alert description. |
| PaloAltoNetworksXDR.Alert.agent_ip_addresses | String | The host IP. |
| PaloAltoNetworksXDR.Alert.agent_hostname | String | The host name. |
| PaloAltoNetworksXDR.Alert.mitre_tactic_id_and_name | String | The MITRE attack tactic. |
| PaloAltoNetworksXDR.Alert.mitre_technique_id_and_name | String | The MITRE attack technique. |
| PaloAltoNetworksXDR.Alert.starred | Boolean | Whether the alert is starred or not. |

#### Command example

```!xdr-get-alerts severity="high" alert_action_status="detected (reported)" sort_field="source_insert_ts" offset="0" limit="1"```

#### Context Example

```json
{
    "PaloAltoNetworksXDR": {
        "Alert": {
            "action_country": [
                "UNKNOWN"
            ],
            "action_external_hostname": null,
            "action_file_macro_sha256": null,
            "action_file_md5": null,
            "action_file_name": null,
            "action_file_path": null,
            "action_file_sha256": null,
            "action_local_ip": null,
            "action_local_ip_v6": null,
            "action_local_port": null,
            "action_process_causality_id": null,
            "action_process_image_command_line": null,
            "action_process_image_md5": [
                "ddcd2be64212b10c3cf84496a879b098"
            ],
            "action_process_image_name": null,
            "action_process_image_path": [
                "C:\Users\administrator\Downloads\svchost.exe"
            ],
            "action_process_image_sha256": null,
            "action_process_instance_id": null,
            "action_process_os_pid": [
                5172
            ],
            "action_process_signature_status": [
                "SIGNATURE_UNAVAILABLE"
            ],
            "action_process_signature_vendor": null,
            "action_process_user_sid": null,
            "action_registry_data": null,
            "action_registry_full_key": null,
            "action_registry_key_name": null,
            "action_registry_value_name": null,
            "action_remote_ip": null,
            "action_remote_ip_v6": null,
            "action_remote_port": null,
            "activity_first_seen_at": null,
            "activity_last_seen_at": null,
            "actor_causality_id": null,
            "actor_effective_user_sid": null,
            "actor_effective_username": [
                "env1.local\administrator"
            ],
            "actor_process_causality_id": [
                "AdhDcc/XHpAAABQ0AAAAAA=="
            ],
            "actor_process_command_line": [
                "\"C:\Users\administrator\Downloads\svchost.exe\" "
            ],
            "actor_process_execution_time": [
                1648560911622
            ],
            "actor_process_image_md5": [
                "ddcd2be64212b10c3cf84496a879b098"
            ],
            "actor_process_image_name": [
                "svchost.exe"
            ],
            "actor_process_image_path": [
                "C:\Users\administrator\Downloads\svchost.exe"
            ],
            "actor_process_image_sha256": [
                "b013074d220d71877112b61e16927abbbb98ad29aa40609aca1b936332fbe4b7"
            ],
            "actor_process_instance_id": [
                "AdhDcc/XHpAAABQ0AAAAAA=="
            ],
            "actor_process_os_pid": [
                5172
            ],
            "actor_process_signature_status": [
                "SIGNATURE_UNSIGNED"
            ],
            "actor_process_signature_vendor": null,
            "actor_thread_thread_id": [
                2468
            ],
            "agent_data_collection_status": true,
            "agent_device_domain": "env1.local",
            "agent_fqdn": "DC1ENV1APC02.env1.local",
            "agent_host_boot_time": [
                0
            ],
            "agent_hostname": "DC1ENV1APC02",
            "agent_id": "63f88a9e797440ccac742a6adc926fb2",
            "agent_install_type": "STANDARD",
            "agent_ip_addresses": [
                "10.111.230.11"
            ],
            "agent_ip_addresses_v6": null,
            "agent_is_vdi": null,
            "agent_os_sub_type": "10.0.10240",
            "agent_os_type": "AGENT_OS_WINDOWS",
            "agent_version": "7.6.1.46600",
            "alert_action_status": "REPORTED",
            "alert_action_status_readable": "detected (reported)",
            "alert_category": "Malware",
            "alert_description": "Behavioral threat detected (rule: bioc.masquerade_svchost)",
            "alert_description_raw": "Behavioral threat detected (rule: bioc.masquerade_svchost)",
            "alert_is_fp": false,
            "alert_name": "Behavioral Threat",
            "alert_source": "TRAPS",
            "alert_sub_type": null,
            "alert_type": "Unclassified",
            "association_strength": [
                50
            ],
            "attack_techniques": null,
            "attempt_counter": 0,
            "audit_ids": null,
            "bioc_category_enum_key": null,
            "bioc_indicator": null,
            "caller_ip": null,
            "case_id": 48,
            "causality_actor_causality_id": [
                "AdhDcc/XHpAAABQ0AAAAAA=="
            ],
            "causality_actor_process_command_line": [
                "\"C:\Users\administrator\Downloads\svchost.exe\" "
            ],
            "causality_actor_process_execution_time": [
                1648560911622
            ],
            "causality_actor_process_image_md5": null,
            "causality_actor_process_image_name": [
                "svchost.exe"
            ],
            "causality_actor_process_image_path": [
                "C:\Users\administrator\Downloads\svchost.exe"
            ],
            "causality_actor_process_image_sha256": [
                "b013074d220d71877112b61e16927abbbb98ad29aa40609aca1b936332fbe4b7"
            ],
            "causality_actor_process_instance_id": [
                "AdhDcc/XHpAAABQ0AAAAAA=="
            ],
            "causality_actor_process_os_pid": [
                5172
            ],
            "causality_actor_process_signature_status": [
                "SIGNATURE_UNSIGNED"
            ],
            "causality_actor_process_signature_vendor": null,
            "cloud_provider": null,
            "cluster_name": null,
            "container_id": null,
            "contains_featured_host": [
                "NO"
            ],
            "contains_featured_ip": [
                "NO"
            ],
            "contains_featured_user": [
                "NO"
            ],
            "deduplicate_tokens": null,
            "detection_modules": null,
            "dns_query_name": null,
            "drilldown_max_ts": null,
            "drilldown_min_ts": null,
            "drilldown_query": null,
            "dss_country": null,
            "dss_department": null,
            "dss_groups": null,
            "dss_job_title": null,
            "dst_action_country": null,
            "dst_action_external_hostname": null,
            "dst_action_external_port": null,
            "dst_actor_process_image_name": null,
            "dst_actor_process_os_pid": null,
            "dst_agent_hostname": null,
            "dst_agent_id": null,
            "dst_agent_os_type": [
                "NO_HOST"
            ],
            "dst_association_strength": null,
            "dst_causality_actor_process_execution_time": null,
            "dst_os_actor_process_image_name": null,
            "dst_os_actor_process_os_pid": null,
            "dynamic_fields": {
                "action_country": [
                    "UNKNOWN"
                ],
                "action_process_signature_status": [
                    "SIGNATURE_UNAVAILABLE"
                ],
                "activated": "0001-01-01T00:00:00Z",
                "activatingingUserId": "",
                "actor_effective_username": [
                    "env1.local\administrator"
                ],
                "actor_process_command_line": [
                    "\"C:\Users\administrator\Downloads\svchost.exe\" "
                ],
                "actor_process_image_md5": [
                    "ddcd2be64212b10c3cf84496a879b098"
                ],
                "actor_process_image_name": [
                    "svchost.exe"
                ],
                "actor_process_image_path": [
                    "C:\Users\administrator\Downloads\svchost.exe"
                ],
                "actor_process_image_sha256": [
                    "b013074d220d71877112b61e16927abbbb98ad29aa40609aca1b936332fbe4b7"
                ],
                "actor_process_os_pid": [
                    5172
                ],
                "actor_process_signature_status": [
                    "SIGNATURE_UNSIGNED"
                ],
                "actor_thread_thread_id": [
                    2468
                ],
                "agent_device_domain": "env1.local",
                "agent_fqdn": "DC1ENV1APC02.env1.local",
                "agent_hostname": "DC1ENV1APC02",
                "agent_id": "63f88a9e797440ccac742a6adc926fb2",
                "agent_ip_addresses": [
                    "10.111.230.11"
                ],
                "agent_os_sub_type": "10.0.10240",
                "agent_os_type": "AGENT_OS_WINDOWS",
                "alert_action_status": "REPORTED",
                "alert_category": "Malware",
                "alert_description": "Behavioral threat detected (rule: bioc.masquerade_svchost)",
                "alert_name": "Behavioral Threat",
                "alert_source": "TRAPS",
                "alert_type": "Unclassified",
                "attachment": null,
                "category": "",
                "causality_actor_causality_id": [
                    "AdhDcc/XHpAAABQ0AAAAAA=="
                ],
                "causality_actor_process_command_line": [
                    "\"C:\Users\administrator\Downloads\svchost.exe\" "
                ],
                "causality_actor_process_image_name": [
                    "svchost.exe"
                ],
                "causality_actor_process_image_path": [
                    "C:\Users\administrator\Downloads\svchost.exe"
                ],
                "causality_actor_process_image_sha256": [
                    "b013074d220d71877112b61e16927abbbb98ad29aa40609aca1b936332fbe4b7"
                ],
                "causality_actor_process_signature_status": [
                    "SIGNATURE_UNSIGNED"
                ],
                "closeReason": "",
                "closed": "0001-01-01T00:00:00Z",
                "closingUserId": "",
                "contains_featured_host": [
                    "NO"
                ],
                "contains_featured_ip": [
                    "NO"
                ],
                "contains_featured_user": [
                    "NO"
                ],
                "dbotCurrentDirtyFields": null,
                "dbotDirtyFields": null,
                "dbotMirrorDirection": "",
                "dbotMirrorId": "",
                "dbotMirrorInstance": "",
                "dbotMirrorLastSync": "0001-01-01T00:00:00Z",
                "dbotMirrorTags": null,
                "droppedCount": 0,
                "dueDate": "0001-01-01T00:00:00Z",
                "event_type": [
                    1
                ],
                "feedBased": false,
                "fw_is_phishing": [
                    "NOT_AVAILABLE"
                ],
                "internal_id": 6887,
                "investigationId": "6887",
                "isDebug": false,
                "is_whitelisted": false,
                "labels": null,
                "lastJobRunTime": "0001-01-01T00:00:00Z",
                "lastOpen": "0001-01-01T00:00:00Z",
                "linkedCount": 0,
                "linkedIncidents": null,
                "mac": "00:50:56:89:8b:8e",
                "mitre_tactic_id_and_name": [
                    "TA0005 - Defense Evasion",
                    "TA0002 - Execution"
                ],
                "mitre_technique_id_and_name": [
                    "T1036.005 - Masquerading: Match Legitimate Name or Location"
                ],
                "module_id": [
                    "Behavioral Threat Protection"
                ],
                "notifyTime": "2022-09-21T06:45:17.746532863Z",
                "occurred": "0001-01-01T00:00:00Z",
                "openDuration": 0,
                "os_actor_process_signature_status": [
                    "SIGNATURE_UNAVAILABLE"
                ],
                "os_actor_thread_thread_id": [
                    2468
                ],
                "phase": "",
                "playbookId": "T1036 - Masquerading",
                "reason": "",
                "reminder": "0001-01-01T00:00:00Z",
                "resolution_comment": "",
                "resolution_status": "STATUS_020_UNDER_INVESTIGATION",
                "runStatus": "error",
                "severity": "SEV_040_HIGH",
                "sla": 0,
                "sourceInstance": "",
                "source_insert_ts": 1648560949000,
                "starred": false
            },
            "end_match_attempt_ts": null,
            "event_id": null,
            "event_sub_type": null,
            "event_timestamp": [
                1648560949290
            ],
            "event_type": [
                1
            ],
            "events_length": 1,
            "external_id": "d4c2983dfab74741b087dce1bbffd8d5",
            "family_tags": null,
            "filter_rule_id": null,
            "forensics_artifact_type": null,
            "from_dml": null,
            "fw_app_category": null,
            "fw_app_id": null,
            "fw_app_subcategory": null,
            "fw_app_technology": null,
            "fw_device_name": null,
            "fw_email_recipient": null,
            "fw_email_sender": null,
            "fw_email_subject": null,
            "fw_interface_from": null,
            "fw_interface_to": null,
            "fw_is_phishing": [
                "NOT_AVAILABLE"
            ],
            "fw_misc": null,
            "fw_rule": null,
            "fw_rule_id": null,
            "fw_serial_number": null,
            "fw_url_domain": null,
            "fw_vsys": null,
            "fw_xff": null,
            "identity_invoked_by_type": null,
            "identity_name": null,
            "identity_sub_type": null,
            "identity_type": null,
            "image_name": null,
            "internal_id": "6887",
            "iot_pivot_url": null,
            "is_disintegrated": null,
            "is_pcap": false,
            "is_whitelisted": false,
            "is_xsoar_alert": false,
            "last_modified_ts": 1663742717853,
            "local_insert_ts": 1648560958017,
            "mac": "00:50:56:89:8b:8e",
            "matching_service_rule_id": null,
            "matching_status": "MATCHED",
            "mitre_tactic_id_and_name": [
                "TA0005 - Defense Evasion",
                "TA0002 - Execution"
            ],
            "mitre_technique_id_and_name": [
                "T1036.005 - Masquerading: Match Legitimate Name or Location"
            ],
            "module_id": [
                "Behavioral Threat Protection"
            ],
            "module_name": [
                "COMPONENT_DSE"
            ],
            "operation_name": null,
            "original_severity": "SEV_040_HIGH",
            "os_actor_causality_id": null,
            "os_actor_effective_username": null,
            "os_actor_process_causality_id": null,
            "os_actor_process_command_line": null,
            "os_actor_process_execution_time": null,
            "os_actor_process_image_md5": null,
            "os_actor_process_image_name": null,
            "os_actor_process_image_path": null,
            "os_actor_process_image_sha256": null,
            "os_actor_process_instance_id": null,
            "os_actor_process_os_pid": null,
            "os_actor_process_signature_status": [
                "SIGNATURE_UNAVAILABLE"
            ],
            "os_actor_process_signature_vendor": null,
            "os_actor_thread_thread_id": [
                2468
            ],
            "phone_number": null,
            "pivot_url": null,
            "playbook_suggestion_rule_id": null,
            "policy_id": null,
            "project": null,
            "query_tables": null,
            "referenced_resource": null,
            "remote_cid": null,
            "resolution_comment": "",
            "resolution_status": "STATUS_020_UNDER_INVESTIGATION",
            "resource_sub_type": null,
            "resource_type": null,
            "severity": "SEV_040_HIGH",
            "source_insert_ts": 1648560949290,
            "starred": false,
            "story_id": null,
            "suggested_playbook_id": null,
            "tim_main_indicator": null,
            "user_agent": null,
            "xpanse_asset_id": null,
            "xpanse_asset_name": null,
            "xpanse_policy_id": null,
            "xpanse_primary_asset_id": null,
            "xpanse_service_id": null
        }
    }
}

Human Readable Output

Alerts

Action Alert ID Category Description Detection Timestamp Host IP Host Name Name Severity
detected (reported) 6887 Malware Behavioral threat detected (rule: bioc.masquerade_svchost) 2022-03-29T13:35:49.000Z 10.111.230.11 DC1ENV1APC02 Behavioral Threat SEV_040_HIGH

xdr-get-contributing-event

Retrieves contributing events for a specific correlation alert.
Known limitation: the command is compatible only with correlation alerts, otherwise an error will be raised.

Required Permissions

Required Permissions For API call:
Alerts & Incidents –> View

Builtin Roles with this permission includes: “Investigator”, “Responder”, “Privileged Investigator”, “Privileged Responder”, “Viewer”, and “Instance Admin”.

Base Command

xdr-get-contributing-event

Input

Argument Name Description Required
alert_ids The alert ID’s from where to retrieve the contributing events. Required
limit The maximum number of contributing events to retrieve. Default is 50. Optional
page_number The page number to retrieve. Minimum is 1. Default is 1. Optional
page_size The page size. Default is 50. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.ContributingEvent.alertID String The alert ID.
PaloAltoNetworksXDR.ContributingEvent.events Unknown Contributing events per alert.

Command example

!xdr-get-contributing-event alert_ids=`[123456 , 123457]`

Context Example

{
    "PaloAltoNetworksXDR": {
        "ContributingEvent": [
            {
                "alertID": "123456",
                "events": [
                    {
                        "Domain": "WIN10X64",
                        "Host_Name": "WIN10X64",
                        "Logon_Type": "7",
                        "Process_Name": "C:\\Windows\\System32\\svchost.exe",
                        "Raw_Message": "An account was successfully logged on.",
                        "Source_IP": "1.1.1.1",
                        "User_Name": "xsoar",
                        "111111": 15,
                        "222222": 165298280000,
                        "333333": "abcdef",
                        "444444": 1,
                        "555555": "ghijk",
                        "_is_cardable": true,
                        "_product": "XDR agent",
                        "_time": 165298280000,
                        "_vendor": "PANW",
                        "insert_timestamp": 165298280001
                    }
                ]
            },
            {
                "alert_id": "123457",
                "events": [
                    {
                        "Domain": "WIN10X64",
                        "Host_Name": "WIN10X64",
                        "Logon_Type": "7",
                        "Process_Name": "C:\\Windows\\System32\\svchost.exe",
                        "Raw_Message": "An account was successfully logged on",
                        "Source_IP": "1.1.1.1",
                        "User_Name": "xsoar",
                        "111111": 15,
                        "222222": 165298280000,
                        "333333": "abcdef",
                        "444444": 1,
                        "555555": "ghijk",
                        "_is_cardable": true,
                        "_product": "XDR agent",
                        "_time": 165298280000,
                        "_vendor": "PANW",
                        "insert_timestamp": 165298280001
                    }
                ]
            }
        ]
    }
}

Human Readable Output

Contributing events

Alert _ Id Events
123456 - Logon_Type: 7
User_Name: xsoar
Domain: WIN10X64
Source_IP: 1.1.1.1
Process_Name: C:\Windows\System32\svchost.exe
Host_Name: WIN10X64
Raw_Message: An account was successfully logged on. _time: 165298280000
555555: a1b2c3d4
222222: 165298280000
333333: abcdef
111111: 15
444444: 1
insert_timestamp: 165298280001
_vendor: PANW
_product: XDR agent
_is_cardable: true
123457 - Logon_Type: 7
User_Name: xsoar
Domain: WIN10X64
Source_IP: 1.1.1.1
Process_Name: C:\Windows\System32\svchost.exe
Host_Name: WIN10X64
Raw_Message: An account was successfully logged on. _time: 165298280000
555555: ghijk
222222: 165298280000
333333: abcdef
111111: 15
444444: 1
insert_timestamp: 165298280001
_vendor: PANW
_product: XDR agent
_is_cardable: true

xdr-replace-featured-field

Replace the featured hosts\users\IP addresses\active directory groups listed in your environment.

Required Permissions

Required Permissions For API call:
Alerts & Incidents –> View/ Edit

Builtin Roles with this permission includes: “Investigator”, “Privileged Investigator”, “Privileged Responder” and “Instance Admin”.

Base Command

xdr-replace-featured-field

Input

Argument Name Description Required
field_type The field type to change. Possible values are: hosts, users, ip_addresses, ad_groups. Required
values The string value, which defines the new field. Maximum length is 256 characters. Required
comments The string value, which represents additional information regarding the featured alert field. Optional
ad_type The string value to replace an active directory group or organizational unit. Possible values are: group, ou. Default is group. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.FeaturedField.fieldType String The field type that changed.
PaloAltoNetworksXDR.FeaturedField.fields String String value that defines the new field.

Command example

!xdr-replace-featured-field field_type=ip_addresses values=`["1.1.1.1"]` comments=`new ip address`

Context Example

{
    "PaloAltoNetworksXDR": {
        "FeaturedField": {
            "fieldType": "ip_addresses",
            "fields": [
                {
                    "comment": "new ip address",
                    "value": "1.1.1.1"
                }
            ]
        }
    }
}

Human Readable Output

Replaced featured: ip_addresses

Comment Value
new ip address 1.1.1.1

xdr-list-users

Retrieve a list of the current users in the environment.
Required license: Cortex XDR Pro per Endpoint, Cortex XDR Pro, or Cortex XDR Pro per GB.

Base Command

xdr-list-users

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

Path Type Description
PaloAltoNetworksXDR.User.user_email string Email address of the user
PaloAltoNetworksXDR.User.user_first_name string First name of the user
PaloAltoNetworksXDR.User.user_last_name string Last name of the user.
PaloAltoNetworksXDR.User.role_name string Role name associated with the user.
PaloAltoNetworksXDR.User.last_logged_in Number Timestamp of when the user last logged in.
PaloAltoNetworksXDR.User.user_type string Type of user.
PaloAltoNetworksXDR.User.groups array Name of user groups associated with the user, if applicable.
PaloAltoNetworksXDR.User.scope array Name of scope associated with the user, if applicable.

Command example


#### Context Example

```json
{
    "dummy": {
        "User": [
            {
                "groups": [],
                "last_logged_in": 1648158415051,
                "role_name": "dummy",
                "scope": [],
                "user_email": "dummy@dummy.com",
                "user_first_name": "dummy",
                "user_last_name": "dummy",
                "user_type": "dummy"
            },
             {
                "groups": [],
                "last_logged_in": null,
                "role_name": "dummy",
                "scope": [],
                "user_email": "dummy@dummy.com",
                "user_first_name": "dummy",
                "user_last_name": "dummy",
                "user_type": "dummy"
            }            
        ]
    }
}

Human Readable Output

Users

First Name Groups Last Name Role Type User email
dummy   dummy dummy dummy dummy
dummy   dummy dummy dummy dummy

xdr-list-risky-users

Retrieve the risk score of a specific user or list of users with the highest risk score in the environment along with the reason affecting each score.
Required license: Cortex XDR Pro per Endpoint, Cortex XDR Pro, or Cortex XDR Pro per GB.

Base Command

xdr-list-risky-users

Input

Argument Name Description Required
user_id Unique ID of a specific user.
User ID could be either of the foo/dummy format, or just dummy.
.		 Optional
limit Limit the number of users that will appear in the list. (Use limit when no specific host is requested.). Default is 10. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.RiskyUser.type String Form of identification element.
PaloAltoNetworksXDR.RiskyUser.id String Identification value of the type field.
PaloAltoNetworksXDR.RiskyUser.score Number The score assigned to the user.
PaloAltoNetworksXDR.RiskyUser.reasons.date created String Date when the incident was created.
PaloAltoNetworksXDR.RiskyUser.reasons.description String Description of the incident.
PaloAltoNetworksXDR.RiskyUser.reasons.severity String The severity of the incident
PaloAltoNetworksXDR.RiskyUser.reasons.status String The incident status
PaloAltoNetworksXDR.RiskyUser.reasons.points Number The score.

Command example

!xdr-list-risky-users user_id=dummy

Context Example

{
    "PaloAltoNetworksXDR": {
        "RiskyUser": {
            "id": "dummy",
            "reasons": [],
            "score": 0,
            "type": "user"
        }
    }
}

Human Readable Output

Risky Users

User ID Score Description
dummy 0  

xdr-list-risky-hosts

Retrieve the risk score of a specific host or list of hosts with the highest risk score in the environment along with the reason affecting each score.
Required license: Cortex XDR Pro per Endpoint, Cortex XDR Pro, or Cortex XDR Pro per GB.

Base Command

xdr-list-risky-hosts

Input

Argument Name Description Required
host_id The host name of a specific host. Optional
limit Limit the number of hosts that will appear in the list. By default, the limit is 50 hosts.(Use limit when no specific host is requested.). Default is 10. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.RiskyHost.type String Form of identification element.
PaloAltoNetworksXDR.RiskyHost.id String Identification value of the type field.
PaloAltoNetworksXDR.RiskyHost.score Number The score assigned to the host.
PaloAltoNetworksXDR.RiskyHost.reasons.date created String Date when the incident was created.
PaloAltoNetworksXDR.RiskyHost.reasons.description String Description of the incident.
PaloAltoNetworksXDR.RiskyHost.reasons.severity String The severity of the incident
PaloAltoNetworksXDR.RiskyHost.reasons.status String The incident status
PaloAltoNetworksXDR.RiskyHost.reasons.points Number The score.

Command example

!xdr-list-risky-hosts host_id=dummy

Context Example

{
    "PaloAltoNetworksXDR": {
        "RiskyHost": {
            "id": "dummy",
            "reasons": [],
            "score": 0,
            "type": "dummy"
        }
    }
}

Human Readable Output

Risky Hosts

Host ID Score Description
dummy 0  

xdr-list-user-groups

Retrieve a list of the current user emails associated with one or more user groups in the environment.
Required license: Cortex XDR Pro per Endpoint, Cortex XDR Pro, or Cortex XDR Pro per GB.

Base Command

xdr-list-user-groups

Input

Argument Name Description Required
group_names A comma-separated list of one or more user group names for which you want the associated users. Required

Context Output

Path Type Description
PaloAltoNetworksXDR.UserGroup.group_name String Name of the user group.
PaloAltoNetworksXDR.UserGroup.description String Description of the user group, if available.
PaloAltoNetworksXDR.UserGroup.pretty_name String Name of the user group as it appears in the management console.
PaloAltoNetworksXDR.UserGroup.insert_time Number Timestamp of when the user group was created.
PaloAltoNetworksXDR.UserGroup.update_time Number Timestamp of when the user group was last updated.
PaloAltoNetworksXDR.UserGroup.user_email array List of email addresses belonging to the users associated with the user group.
PaloAltoNetworksXDR.UserGroup.source String Type of user group.

Command example

!xdr-list-user-groups group_names=test

Context Example

{
    "PaloAltoNetworksXDR": {
        "UserGroup": {
            "description": "test",
            "group_name": "test",
            "insert_time": 1684746187678,
            "pretty_name": null,
            "source": "Custom",
            "update_time": 1684746209062,
            "user_email": [
                null
            ]
        }
    }
}

Human Readable Output

Groups

Group Name Group Description User email
test test for demo  

xdr-list-roles

Retrieve information about one or more roles created in the environment.
Required license: Cortex XDR Pro per Endpoint, Cortex XDR Pro, or Cortex XDR Pro per GB.

Base Command

xdr-list-roles

Input

Argument Name Description Required
role_names A comma-separated list of one or more role names in your environment for which you want detailed information. Required

Context Output

Path Type Description
PaloAltoNetworksXDR.Role.pretty_name String Name of the role as it appears in the management console.
PaloAltoNetworksXDR.Role.permissions array List of permissions associated with this role.
PaloAltoNetworksXDR.Role.insert_time Number Timestamp of when the role was created.
PaloAltoNetworksXDR.Role.update_time Number Timestamp of when the role was last updated.
PaloAltoNetworksXDR.Role.created_by String Email of the user who created the role.
PaloAltoNetworksXDR.Role.description String Description of the role, if available.
PaloAltoNetworksXDR.Role.groups array Group names associated with the role.
PaloAltoNetworksXDR.Role.users array Email address of users associated with the role.

Command example

!xdr-list-roles role_names=dummy

Context Example

{
    "PaloAltoNetworksXDR": {
        "Role": [
            [
                {
                    "created_by": "dummy dummy",
                    "description": "The user(s) have full access.",
                    "groups": [],
                    "insert_time": null,
                    "permissions": [
                        "dummy"
                    ],
                    "pretty_name": "dummy",
                    "update_time": null,
                    "users": []
                }
            ]
        ]
    }
}

Human Readable Output

Roles

Role Name Description Permissions Users Groups
dummy The user(s) have full access. ADMIN    

xdr-set-user-role

Add one or more users to a role.
Required license: Cortex XDR Pro per Endpoint, Cortex XDR Pro, or Cortex XDR Pro per GB.

Base Command

xdr-set-user-role

Input

Argument Name Description Required
user_emails A comma-separated list of one or more user emails of users you want to add to a role. Required
role_name Name of the role you want to add a user to. Required

Context Output

There is no context output for this command.

Command example

!xdr-set-user-role role_name=dummy user_emails=dummy

Human Readable Output

Role was updated successfully for 1 user.

xdr-remove-user-role

Remove one or more users from a role.
Required license: Cortex XDR Pro per Endpoint, Cortex XDR Pro, or Cortex XDR Pro per GB.

Base Command

xdr-remove-user-role

Input

Argument Name Description Required
user_emails A comma-separate list of one or more user emails of users you want to remove from a role. Required

Context Output

There is no context output for this command.

Command example

!xdr-remove-user-role user_emails=dummy

Human Readable Output

Role was removed successfully for 1 user.

xdr-script-run

Initiates a new endpoint script execution action using a script from the script library and returns the results.

Required Permissions

Required Permissions For API call:
Agent Scripts library –> View

Builtin Roles with this permission includes: “Privileged Responder”, “Viewer” and “Instance Admin”.

Base Command

xdr-script-run

Input

Argument Name Description Required
incident_id Allows linking the response action to the incident that triggered it. Optional
endpoint_ids A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command. Required
script_uid Unique identifier of the script. Can be retrieved by running the xdr-get-scripts command. Required
parameters Dictionary containing the parameter name as key and its value for this execution as the value. For example, {“param1”:”param1_value”,”param2”:”param2_value”}. Optional
timeout The timeout in seconds for this execution. Default is 600. Optional
polling_interval_in_seconds Interval in seconds between each poll. Default is 10. Optional
polling_timeout_in_seconds Polling timeout in seconds. Default is 600. Optional
action_id action ID for polling. Optional
hide_polling_output whether to hide the polling result (automatically filled by polling). Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.ScriptResult.action_id Number ID of the action initiated.
PaloAltoNetworksXDR.ScriptResult.results.retrieved_files Number Number of successfully retrieved files.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_ip_address String Endpoint IP address.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_name String Number of successfully retrieved files.
PaloAltoNetworksXDR.ScriptResult.results.failed_files Number Number of files failed to retrieve.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_status String Endpoint status.
PaloAltoNetworksXDR.ScriptResult.results.domain String Domain to which the endpoint belongs.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_id String Endpoint ID.
PaloAltoNetworksXDR.ScriptResult.results.execution_status String Execution status of this endpoint.
PaloAltoNetworksXDR.ScriptResult.results.return_value String Value returned by the script in case the type is not a dictionary.
PaloAltoNetworksXDR.ScriptResult.results.standard_output String The STDOUT and the STDERR logged by the script during the execution.
PaloAltoNetworksXDR.ScriptResult.results.retention_date Date Timestamp in which the retrieved files will be deleted from the server.

Base Command

xdr-script-run

Input

Argument Name Description Required
incident_id Allows linking the response action to the incident that triggered it. Optional
endpoint_ids A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command. Required
script_uid Unique identifier of the script. Can be retrieved by running the xdr-get-scripts command. Required
parameters Dictionary containing the parameter name as key and its value for this execution as the value. For example, {“param1”:”param1_value”,”param2”:”param2_value”}. Optional
timeout The timeout in seconds for this execution. Default is 600. Optional
polling_interval_in_seconds Interval in seconds between each poll. Default is 10. Optional
polling_timeout_in_seconds Polling timeout in seconds. Default is 600. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.ScriptResult.action_id Number ID of the action initiated.
PaloAltoNetworksXDR.ScriptResult.results.retrieved_files Number Number of successfully retrieved files.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_ip_address String Endpoint IP address.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_name String Number of successfully retrieved files.
PaloAltoNetworksXDR.ScriptResult.results.failed_files Number Number of files failed to retrieve.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_status String Endpoint status.
PaloAltoNetworksXDR.ScriptResult.results.domain String Domain to which the endpoint belongs.
PaloAltoNetworksXDR.ScriptResult.results.endpoint_id String Endpoint ID.
PaloAltoNetworksXDR.ScriptResult.results.execution_status String Execution status of this endpoint.
PaloAltoNetworksXDR.ScriptResult.results.return_value String Value returned by the script in case the type is not a dictionary.
PaloAltoNetworksXDR.ScriptResult.results.standard_output String The STDOUT and the STDERR logged by the script during the execution.
PaloAltoNetworksXDR.ScriptResult.results.retention_date Date Timestamp in which the retrieved files will be deleted from the server.

Command example

!xdr-script-run endpoint_ids=1 script_uid=123

Human Readable Output

Waiting for the script to finish running on the following endpoints: [‘1’]…

Script Execution Results - 10368

_return_value domain endpoint_id endpoint_ip_address endpoint_name endpoint_status execution_status failed_files retention_date retrieved_files standard_output
Name: return value WORKGROUP 1 1.1.1.1 WIN10X64 STATUS_010_CONNECTED COMPLETED_SUCCESSFULLY 0   0  

Context Example

{
  "PaloAltoNetworksXDR": {
    "ScriptResult": {
      "results": [
        {
          "domain": "WORKGROUP",
          "endpoint_name": "WIN10X64",
          "retrieved_files": 0,
          "failed_files": 0,
          "standard_output": "",
          "_return_value": [
            "return_value"
          ],
          "command_output": [
            "command_output"
          ],
          "endpoint_status": "STATUS_010_CONNECTED",
          "command": "_return_value",
          "endpoint_id": "1",
          "endpoint_ip_address": [
            "1.1.1.1"
          ],
          "execution_status": "COMPLETED_SUCCESSFULLY",
          "retention_date": null
        }
      ],
      "action_id": 4444
    }
  }
}

xdr-endpoint-tag-add

Adds a tag to specified endpoint_ids

Required Permissions

Required Permissions For API call:
Endpoint Administrations –> View/ Edit

Builtin Roles with this permission includes: “Privileged Responder” and “Instance Admin”.

Base Command

xdr-endpoint-tag-add

Input

Argument Name Description Required
endpoint_ids List of endpoint IDs. Supports comma-separated list. Optional
tag Tag to add. Optional

Context Output

There is no context output for this command.

xdr-endpoint-tag-remove

Removes a tag from specified endpoint_ids.

Required Permissions

Required Permissions For API call:
Endpoint Administrations –> View/ Edit

Builtin Roles with this permission includes: “Privileged Responder” and “Instance Admin”.

Base Command

xdr-endpoint-tag-remove

Input

Argument Name Description Required
endpoint_ids List of endpoint IDs. Supports comma separated list. Optional
tag Tag to remove from specified endpoint_ids. Optional

Context Output

There is no context output for this command.

xdr-get-tenant-info

Provides information about the tenant.

Base Command

xdr-get-tenant-info

Input

There are no arguments for this command.

Context Output

Path Type Description
PaloAltoNetworksXDR.TenantInformation.pro_per_endpoint_expiration Date Expiration time pro per endpoint.
PaloAltoNetworksXDR.TenantInformation.purchased_pro_per_endpoint.agents Number Number of endpoints agent purchased.
PaloAltoNetworksXDR.TenantInformation.data_enabled_pro_per_endpoint Number Enabled data per pro endpoint.
PaloAltoNetworksXDR.TenantInformation.prevent_expiration Number Number of prevent expirations.
PaloAltoNetworksXDR.TenantInformation.purchased_prevent Number Number of purchased prevents.
PaloAltoNetworksXDR.TenantInformation.installed_prevent Number Number of installed prevents.
PaloAltoNetworksXDR.TenantInformation.pro_tb_expiration Date pro_tb license expiration time.
PaloAltoNetworksXDR.TenantInformation.purchased_pro_tb.tb Number Number of pro_tbs purchased.
PaloAltoNetworksXDR.TenantInformation.installed_pro_tb Number Number of pro_tbs installed.
PaloAltoNetworksXDR.TenantInformation.compute_unit_expiration Date Compute unit expiration time.
PaloAltoNetworksXDR.TenantInformation.purchased_compute_unit Number Number of compute units purchased.
PaloAltoNetworksXDR.TenantInformation.compute_unit_is_trial Boolean Whether the compute unit is a trial.
PaloAltoNetworksXDR.TenantInformation.host_insights_expiration Date Host insight expiration time.
PaloAltoNetworksXDR.TenantInformation.enabled_host_insights Number Number of host insights enabled.
PaloAltoNetworksXDR.TenantInformation.purchased_host_insights Number Number of purchased host insights.
PaloAltoNetworksXDR.TenantInformation.forensics_expiration Date Forensic expiration time.
PaloAltoNetworksXDR.TenantInformation.purchased_forensics Number Number of forensics purchased.

Command example


#### Context Example

```json
{
    "PaloAltoNetworksXDR": {
        "TenantInformation": {
            "compute_unit_expiration": 0,
            "data_enabled_pro_per_endpoint": 2,
            "forensics_expiration": 0,
            "installed_prevent": 2,
            "installed_pro_tb": 0,
            "prevent_expiration": 0,
            "pro_per_endpoint_expiration": "May 7th 2025 06:59:59",
            "pro_tb_expiration": "May 7th 2025 06:59:59",
            "purchased_compute_unit": 2000,
            "purchased_prevent": 0,
            "purchased_pro_per_endpoint": {
                "agents": 300
            },
            "purchased_pro_tb": {
                "tb": 1
            }
        }
    }
}

Human Readable Output

Tenant Information

Compute Unit Expiration Data Enabled Pro Per Endpoint Forensics _ Expiration Installed _ Prevent Installed Pro Tb Prevent _ Expiration Pro Per Endpoint _ Expiration Pro Tb Expiration Purchased Compute Unit Purchased _ Prevent Purchased Pro Per _ Endpoint Purchased Pro Tb
            May 7th 2025 06:59:59 May 7th 2025 06:59:59     agents: 300 tb: 1

Incident Mirroring

You can enable incident mirroring between Cortex XSOAR incidents and Palo Alto Networks Cortex XDR - Investigation and Response corresponding events (available from Cortex XSOAR version 6.0.0).
To set up the mirroring:

  1. Enable Fetching incidents in your instance configuration.

  2. In the Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:

    Option Description
    None Turns off incident mirroring.
    Incoming Any changes in Palo Alto Networks Cortex XDR - Investigation and Response events (mirroring incoming fields) will be reflected in Cortex XSOAR incidents.
    Outgoing Any changes in Cortex XSOAR incidents will be reflected in Palo Alto Networks Cortex XDR - Investigation and Response events (outgoing mirrored fields).
    Both  

Newly fetched incidents will be mirrored in the chosen direction. However, this selection does not affect existing incidents.
Important Note: To ensure the mirroring works as expected, mappers are required, both for incoming and outgoing, to map the expected fields in Cortex XSOAR and Palo Alto Networks Cortex XDR - Investigation and Response.

xdr-endpoint-alias-change

Gets a list of endpoints according to the passed filters, and changes their alias name. Filtering by multiple fields will be concatenated using the AND condition (OR is not supported).

Base Command

xdr-endpoint-alias-change

Input

Argument Name Description Required
status The status of the endpoint to use as a filter. Possible values are: connected, disconnected. Optional
endpoint_id_list A comma-separated list of endpoint IDs to use as a filter. Optional
dist_name A comma-separated list of distribution package names or installation package names to use as a filter.
Example: dist_name1,dist_name2.		 Optional
ip_list A comma-separated list of IP addresses to use as a filter.
Example: 8.8.8.8,1.1.1.1.		 Optional
group_name A comma-separated list of group names to which the agent belongs to use as a filter.
Example: group_name1,group_name2.		 Optional
platform The endpoint platform to use as a filter. Possible values are: windows, linux, macos, android. Optional
alias_name A comma-separated list of alias names to use as a filter.
Examples: alias_name1,alias_name2.		 Optional
isolate Specifies whether the endpoint was isolated or unisolated to use as a filter. Possible values are: isolated, unisolated. Note: This argument returns only the first endpoint that matches the filter. Optional
hostname A comma-separated list of hostnames to use as a filter.
Example: hostname1,hostname2.		 Optional
first_seen_gte All the agents that were first seen after {first_seen_gte} to use as a filter.
Supported values:
1579039377301 (time in milliseconds)
“3 days” (relative date)
“2019-10-21T23:45:00” (date).		 Optional
first_seen_lte All the agents that were first seen before {first_seen_lte} to use as a filter.
Supported values:
1579039377301 (time in milliseconds)
“3 days” (relative date)
“2019-10-21T23:45:00” (date).		 Optional
last_seen_gte All the agents that were last seen after {last_seen_gte} to use as a filter.
Supported values:
1579039377301 (time in milliseconds)
“3 days” (relative date)
“2019-10-21T23:45:00” (date).		 Optional
last_seen_lte All the agents that were last seen before {last_seen_lte} to use as a filter.
Supported values:
1579039377301 (time in milliseconds)
“3 days” (relative date)
“2019-10-21T23:45:00” (date).		 Optional
username The usernames to query for to use as a filter. Accepts a single user, or comma-separated list of usernames. Optional
new_alias_name The alias name to change to. Note: If you send an empty field, (e.g new_alias_name="") the current alias name is deleted. Required
scan_status The scan status of the endpoint to use as a filter. Possible values are: none, pending, in_progress, canceled, aborted, pending_cancellation, success, error. Optional

Context Output

There is no context output for this command.

Command example

!xdr-endpoint-alias-change new_alias_name=test scan_status=success ip_list=1.1.1.1

Human Readable Output

The endpoint alias was changed successfully.
Note: If there is no error in the process, then this is the output even when the specific endpoint does not exist.

xdr-update-alert (Deprecated)

This command is deprecated, please use xdr-issue-update instead. Update one or more alerts. You can update up to 100 alerts per request. Missing fields are ignored. Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB.

Base Command

xdr-update-alert

Input

Argument Name Description Required
alert_ids Comma-separated list of alert IDs. Required
severity Severity of the incident which was closed. Possible values are: critical, high, medium, low. Optional
status New status for updated alerts. Possible values are: new, resolved_threat_handled, under_investigation, resolved_security_testing, resolved_auto, resolved_auto_resolve, resolved_known_issue, resolved_duplicate, resolved_other, resolved_false_positive, resolved_true_positive. Optional
comment Comment to append to updated alerts. Optional

Context Output

There is no context output for this command.

Command example

!xdr-update-alert alert_ids=35326 severity=low

Human Readable Output

Alerts with IDs 35326 have been updated successfully.

xdr-asset-group-update

Updates an asset group.

Base Command

xdr-asset-group-update

Input

Argument Name Description Required
group_id The ID of the asset group to update. Required
group_name The name of the asset group. Optional
group_type The type of the asset group. Possible values are: Static, Dynamic. Optional
group_description The description of the asset group. Optional
membership_predicate_json Define the filter conditions for selecting which assets to be included in a dynamic Asset Group. For example: “{"AND":[{"SEARCH_FIELD":"xdm.asset.type.class","SEARCH_TYPE":"NEQ","SEARCH_VALUE":"Other"}]}”. The SEARCH_FIELD needs to be in lower case. For more information, please refer to the documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Update-an-Asset-Group. Optional

Context Output

There is no context output for this command.

xdr-asset-group-create

Creates an asset group.

Base Command

xdr-asset-group-create

Input

Argument Name Description Required
group_name The name of the asset group. Required
group_type The type of the asset group. Possible values are: Static, Dynamic. Required
group_description The description of the asset group. Optional
membership_predicate_json Define the filter conditions for selecting which assets to be included in a dynamic Asset Group. For example: “{"AND":[{"SEARCH_FIELD":"xdm.asset.type.class","SEARCH_TYPE":"NEQ","SEARCH_VALUE":"Other"}]}”. The SEARCH_FIELD needs to be in lower case. For more information, please refer to the documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Create-an-Asset-Group. Optional

Context Output

There is no context output for this command.

xdr-asset-group-list

Returns a list of asset groups.

Base Command

xdr-asset-group-list

Input

Argument Name Description Required
sort_field The field by which to sort the results. For example: XDM.ASSET_GROUP.NAME. Use the documentation for finding more fields here. Optional
sort_order The order in which to sort the results. Possible values are: asc, desc. Optional
filter_json The JSON to use for the “filter” field in the API. For example: “{"AND": [{"SEARCH_FIELD": "XDM.ASSET_GROUP.TYPE", "SEARCH_TYPE": "EQ", "SEARCH_VALUE": "Dynamic"}]}”. For more information, please refer to the documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Get-all-or-filtered-asset-groups. Optional
limit Maximum number of asset groups to return. Default is 50. Default is 50. Optional
page_size Page size for pagination. Optional
page Page number for pagination. 0 is the first page. Default is 0. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_ID String The unique identifier of the asset group.
PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_NAME String The name of the asset group.
PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_TYPE String The type of the asset group (Static or Dynamic).
PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_FILTER String The filter query string used to define the members of the XDM asset group.
PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_DESCRIPTION String The description of the asset group.
PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_CREATION_TIME Date The timestamp when the group was created (Epoch).
PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_LAST_UPDATE_TIME Date The timestamp when the group was last updated (Epoch).
PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_CREATED_BY_PRETTY String The user or API key that created the group.
PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_MODIFIED_BY_PRETTY String The user or API key that last modified the group.
PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_MEMBERSHIP_PREDICATE Unknown The JSON object defining the search criteria for dynamic groups.
PaloAltoNetworksXDR.AssetGroup.IS_USED_BY_SBAC Boolean Indicates whether this asset group is currently utilized to define Scope-Based Access Control (SBAC) rules.

xdr-asset-group-delete

Deletes an asset group.

Base Command

xdr-asset-group-delete

Input

Argument Name Description Required
group_id The ID of the asset group to delete. Required

Context Output

There is no context output for this command.

xdr-asset-schema-field-options-get

Gets the enum values of a specified field in the asset schema.

Base Command

xdr-asset-schema-field-options-get

Input

Argument Name Description Required
field_name The name of the field to get options for. You can use xdr-asset-schema-get in order to get the schema. The field must be of type ENUM, for example: xdm.asset.provider. Required

Context Output

Path Type Description
PaloAltoNetworksXDR.AssetSchema.field_name String The name of the field.
PaloAltoNetworksXDR.AssetSchema.options Unknown The enum values of the field.

xdr-asset-schema-get

Gets the schema of the asset inventory.

Base Command

xdr-asset-schema-get

Input

There are no input arguments for this command.

Context Output

Path Type Description
PaloAltoNetworksXDR.AssetSchema.field_name String The name of the field.
PaloAltoNetworksXDR.AssetSchema.field_type String The type of the field.
PaloAltoNetworksXDR.AssetSchema.field_pretty_name String The pretty name of the field.

xdr-asset-list

Returns a list of assets.

Base Command

xdr-asset-list

Input

Argument Name Description Required
asset_id A comma-separated list of asset IDs. For example: “1,2,3”. When using this argument, the other filters will not be used. Optional
sort_field The field by which to sort the results. For example: xdm.asset.first_observed. Use the documentation for finding more fields here. Optional
sort_order The order in which to sort the results. Possible values are: asc, desc. Optional
filter_json The JSON to use for the “filter” field in the API. You can use xdr-asset-schema-get to get the schema. For more information, please refer to the documentation: here. Optional
limit Maximum number of assets to return. Default is 50. Default is 50. Optional
page_size Page size for pagination. Default is 50. Optional
page Page number for pagination. Default is 0. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.Asset.xdm_asset_id String The unique identifier of the asset.
PaloAltoNetworksXDR.Asset.xdm_asset_name String The name of the asset (e.g., image SHA).
PaloAltoNetworksXDR.Asset.xdm_asset_strong_id String The strong identifier (SHA256) of the asset.
PaloAltoNetworksXDR.Asset.xdm_asset_provider String The provider of the asset.
PaloAltoNetworksXDR.Asset.xdm_asset_external_provider_id String External provider ID (if applicable).
PaloAltoNetworksXDR.Asset.xdm_asset_first_observed Date Timestamp when the asset was first observed.
PaloAltoNetworksXDR.Asset.xdm_asset_last_observed Date Timestamp when the asset was last observed.
PaloAltoNetworksXDR.Asset.xdm_asset_type_id String The ID of the asset type (e.g., CORE_IMAGE).
PaloAltoNetworksXDR.Asset.xdm_asset_type_name String The name of the asset type.
PaloAltoNetworksXDR.Asset.xdm_asset_type_category String The category of the asset (e.g., Container Image).
PaloAltoNetworksXDR.Asset.xdm_asset_type_class String The class of the asset (e.g., Compute).
PaloAltoNetworksXDR.Asset.xdm_development_cycle_stages String The development cycle stages (e.g., RUNTIME).
PaloAltoNetworksXDR.Asset.xdm_image_architecture String The architecture of the image (e.g., amd64).
PaloAltoNetworksXDR.Asset.xdm_image_digest String The image digest hash.
PaloAltoNetworksXDR.Asset.xdm_image_identifier String The image identifier.
PaloAltoNetworksXDR.Asset.xdm_image_names String List of names/tags associated with the image.
PaloAltoNetworksXDR.Asset.xdm_image_os String The OS version of the image.
PaloAltoNetworksXDR.Asset.xdm_image_os_distribution String The OS distribution (e.g., UBUNTU).
PaloAltoNetworksXDR.Asset.xdm_image_os_family String The OS family (e.g., Linux).
PaloAltoNetworksXDR.Asset.xdm_image_os_release String The OS release name (e.g., noble).
PaloAltoNetworksXDR.Asset.xdm_image_labels Unknown Labels associated with the image.
PaloAltoNetworksXDR.Asset.xdm_image_layers Unknown List of layers making up the image.
PaloAltoNetworksXDR.Asset.xdm_image_layers_created_at Number Timestamp of when the layer was created.
PaloAltoNetworksXDR.Asset.xdm_image_layers_instruction String The instruction used to create the layer (e.g., RUN, ADD).
PaloAltoNetworksXDR.Asset.xdm_image_layers_size Number The size of the layer in bytes.
PaloAltoNetworksXDR.Asset.xdm_asset_related_cases_cases_breakdown Unknown Breakdown of related cases by severity.
PaloAltoNetworksXDR.Asset.xdm_asset_related_cases_critical_cases Number Count of critical cases.
PaloAltoNetworksXDR.Asset.xdm_asset_related_issues_issues_breakdown Unknown Breakdown of related issues by severity.
PaloAltoNetworksXDR.Asset.xdm_asset_relations Unknown Relations to other assets.
PaloAltoNetworksXDR.Asset.xdm_asset_group_ids Number Group IDs associated with the asset.

xdr-api-key-delete

Deletes the specified API keys.

Base Command

xdr-api-key-delete

Input

Argument Name Description Required
api_id A comma-separated list of API key IDs to delete. Required

Context Output

There is no context output for this command.

xdr-api-key-list

Gets a list of existing API keys.

Base Command

xdr-api-key-list

Input

Argument Name Description Required
api_id A comma-separated list of API key IDs to retrieve. Optional
role A comma-separated list of API key roles to retrieve. Optional
expires_before Filters API keys that expire before this date. For example: “1 year”. Filters API keys that have an expiration date. Optional
expires_after Filters API keys that expire after this date. For example: “1 year”. Filters API keys that have an expiration date. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.APIKeyData.id String The API key ID.
PaloAltoNetworksXDR.APIKeyData.roles String The roles associated with the API key.
PaloAltoNetworksXDR.APIKeyData.expiration Date The expiration date of the API key.

xdr-bioc-list

Returns a list of BIOCs.

Base Command

xdr-bioc-list

Input

Argument Name Description Required
name The BIOC name to filter by. Can filter by only one name at a time. Optional
severity The BIOC severity to filter by. Possible values are: info, low, medium, high, critical. Optional
type The BIOC type to filter by. Possible values are: other, persistence, evasion, tampering, file_type_obfuscation, privilege_escalation, credential_access, lateral_movement, execution, collection, exfiltration, infiltration, dropper, file_privilege_manipulation, reconnaissance, discovery. Optional
is_xql Whether the BIOC is XQL. Possible values are: true, false. Optional
comment The BIOC comment to filter by. Optional
status The BIOC status to filter by. Possible values are: enabled, disabled. Optional
indicator The BIOC indicator to filter by. Optional
mitre_technique_id_and_name The MITRE technique ID and name. Must be in format ‘ID - Name’, for example: [‘T1566 - Phishing’]. Optional
mitre_tactic_id_and_name The MITRE tactic ID and name. Must be in format ‘ID - Name’, for example: [‘T1566 - Phishing’]. Optional
extra_data Whether to return extended data. Possible values are: true, false. Optional
limit Maximum number of results to return. Optional
page_size Page size. Optional
page Page number. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.BIOC.rule_id String BIOC rule ID.
PaloAltoNetworksXDR.BIOC.name String BIOC name.
PaloAltoNetworksXDR.BIOC.type String BIOC type.
PaloAltoNetworksXDR.BIOC.severity String BIOC severity.
PaloAltoNetworksXDR.BIOC.status String BIOC status.
PaloAltoNetworksXDR.BIOC.is_xql Boolean Whether the BIOC is XQL.
PaloAltoNetworksXDR.BIOC.comment String The BIOC comment.
PaloAltoNetworksXDR.BIOC.indicator String The BIOC indicator.

xdr-bioc-create

Creates a new BIOC.

Base Command

xdr-bioc-create

Input

Argument Name Description Required
name The BIOC name. Required
severity The BIOC severity. Possible values are: info, low, medium, high, critical. Required
type The BIOC type. Possible values are: other, persistence, evasion, tampering, file_type_obfuscation, privilege_escalation, credential_access, lateral_movement, execution, collection, exfiltration, infiltration, dropper, file_privilege_manipulation, reconnaissance, discovery. Optional
is_xql Whether the new BIOC is XQL. Possible values are: true, false. Optional
comment The BIOC comment. Optional
status The BIOC status. Possible values are: enabled, disabled. Optional
indicator The BIOC indicator,
for example: ‘{“runOnCGO”:true,”investigationType”:”FILE_EVENT”,”investigation”:{“FILE_EVENT”:{“filter”:{“AND”:[{“SEARCH_FIELD”:”action_file_name”,”SEARCH_TYPE”:”EQ”,”SEARCH_VALUE”:”testfile.exe”}]}}}}’.
For more information, refer to the documentation here.		 Required
mitre_technique_id_and_name The MITRE technique ID and name. Must be in format ‘ID - Name’, for example: [‘T1566 - Phishing’]. Optional
mitre_tactic_id_and_name The MITRE tactic ID and name. Must be in format ‘ID - Name’, for example: [‘TA0001 - Initial Access’]. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.BIOC.rule_id String BIOC ID.

xdr-bioc-update

Updates an existing BIOC.

Base Command

xdr-bioc-update

Input

Argument Name Description Required
rule_id BIOC rule ID. Required
name BIOC name. Required
severity BIOC severity. Possible values are: info, low, medium, high, critical. Required
type BIOC type. Possible values are: other, persistence, evasion, tampering, file_type_obfuscation, privilege_escalation, credential_access, lateral_movement, execution, collection, exfiltration, infiltration, dropper, file_privilege_manipulation, reconnaissance, discovery. Optional
is_xql Whether the BIOC is XQL. Possible values are: true, false. Optional
comment BIOC comment. Optional
status BIOC status. Possible values are: enabled, disabled. Optional
indicator The BIOC indicator,
for example: ‘{“runOnCGO”:true,”investigationType”:”FILE_EVENT”,”investigation”:{“FILE_EVENT”:{“filter”:{“AND”:[{“SEARCH_FIELD”:”action_file_name”,”SEARCH_TYPE”:”EQ”,”SEARCH_VALUE”:”testfile.exe”}]}}}}’.
For more information, refer to the documentation here.		 Required
mitre_technique_id_and_name The MITRE technique ID and name. Must be in format ‘ID - Name’, for example: [‘T1566 - Phishing’]. Optional
mitre_tactic_id_and_name The MITRE tactic ID and name. Must be in format ‘ID - Name’, for example: [‘TA0001 - Initial Access’]. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.BIOC.rule_id String BIOC ID.

xdr-bioc-delete

Deletes a BIOC.

Base Command

xdr-bioc-delete

Input

Argument Name Description Required
name BIOC name. Optional
severity BIOC severity. Possible values are: info, low, medium, high, critical. Optional
type BIOC type. Possible values are: other, persistence, evasion, tampering, file_type_obfuscation, privilege_escalation, credential_access, lateral_movement, execution, collection, exfiltration, infiltration, dropper, file_privilege_manipulation, reconnaissance, discovery. Optional
is_xql Whether the BIOC is XQL. Possible values are: true, false. Optional
comment BIOC comment. Optional
indicator BIOC indicator. Optional
mitre_technique_id_and_name The MITRE technique ID and name. Must be in format ‘ID - Name’, for example: [‘T1566 - Phishing’]. Optional
mitre_tactic_id_and_name The MITRE tactic ID and name. Must be in format ‘ID - Name’, for example: [‘TA0001 - Initial Access’]. Optional

Context Output

There is no context output for this command.

xdr-correlation-rule-list

Returns a list of correlation rules.

Base Command

xdr-correlation-rule-list

Input

Argument Name Description Required
name Correlation rule name. Optional
severity Correlation rule severity. Possible values are: info, low, medium, high, critical. Optional
xql_query Correlation rule XQL query. Optional
is_xql Whether the correlation rule is XQL. Possible values are: true, false. Optional
dataset Correlation rule dataset. Optional
alert_name Alert name. Optional
alert_category Alert category. Optional
alert_fields Alert fields. Can be a string or a dictionary. Optional
alert_domain Alert domain. Optional
filter_json Filter JSON. Optional
extra_data Whether to return extended view. Possible values are: true, false. Optional
limit Maximum number of results to return. Optional
page_size Page size. Optional
page Page number. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.CorrelationRule.suppression_duration String The duration for which alerts are suppressed.
PaloAltoNetworksXDR.CorrelationRule.alert_category String The category of the alert (e.g., DROPPER).
PaloAltoNetworksXDR.CorrelationRule.mitre_defs Unknown MITRE ATT&CK definitions associated with the rule.
PaloAltoNetworksXDR.CorrelationRule.simple_schedule String The frequency at which the rule runs in a human-readable format.
PaloAltoNetworksXDR.CorrelationRule.mapping_strategy String The strategy used for field mapping.
PaloAltoNetworksXDR.CorrelationRule.suppression_fields String Fields used to determine alert suppression.
PaloAltoNetworksXDR.CorrelationRule.alert_domain String The security domain the alert belongs to.
PaloAltoNetworksXDR.CorrelationRule.crontab String The cron expression for the rule execution schedule.
PaloAltoNetworksXDR.CorrelationRule.search_window String The time window the query searches across.
PaloAltoNetworksXDR.CorrelationRule.user_defined_severity String Custom severity level defined by the user.
PaloAltoNetworksXDR.CorrelationRule.drilldown_query_timeframe String The timeframe used for drilldown queries.
PaloAltoNetworksXDR.CorrelationRule.user_defined_category String Custom category defined by the user.
PaloAltoNetworksXDR.CorrelationRule.lookup_mapping String Mapping details for lookups.
PaloAltoNetworksXDR.CorrelationRule.execution_mode String How the rule is executed, for example: SCHEDULED.
PaloAltoNetworksXDR.CorrelationRule.name String The name of the correlation rule.
PaloAltoNetworksXDR.CorrelationRule.is_enabled Boolean Whether the correlation rule is currently active.
PaloAltoNetworksXDR.CorrelationRule.investigation_query_link String The query used for further investigation.
PaloAltoNetworksXDR.CorrelationRule.alert_name String The specific name assigned to the generated alert.
PaloAltoNetworksXDR.CorrelationRule.suppression_enabled Boolean Whether suppression is enabled for this rule.
PaloAltoNetworksXDR.CorrelationRule.action String The action taken when the rule triggers, for example: ALERTS.
PaloAltoNetworksXDR.CorrelationRule.dataset String The dataset the rule queries.
PaloAltoNetworksXDR.CorrelationRule.alert_description String Detailed description of the generated alert.
PaloAltoNetworksXDR.CorrelationRule.timezone String The timezone used for the rule schedule.
PaloAltoNetworksXDR.CorrelationRule.xql_query String The XQL query string executed by the rule.
PaloAltoNetworksXDR.CorrelationRule.alert_fields Unknown Specific fields included in the alert output.
PaloAltoNetworksXDR.CorrelationRule.description String General description of the correlation rule.
PaloAltoNetworksXDR.CorrelationRule.alert_type String The type of alert generated.
PaloAltoNetworksXDR.CorrelationRule.severity String The severity level of the rule.
PaloAltoNetworksXDR.CorrelationRule.rule_id Number The unique identifier for the correlation rule.

xdr-correlation-rule-create

Creates a new correlation rule.

Base Command

xdr-correlation-rule-create

Input

Argument Name Description Required
name The correlation rule name. Required
severity The correlation rule severity. Example: severity=low. Possible values are: info, low, medium, high, critical. Required
xql_query The correlation rule XQL query. Example: xql_query=”dataset = xdr_data | limit 1”. Required
is_enabled Whether the rule is enabled. Example: is_enabled=true. Possible values are: true, false. Required
alert_category The alert category. Example: alert_category=dropper. Possible values are: other, persistence, evasion, tampering, file_type_obfuscation, privilege_escalation, credential_access, lateral_movement, execution, collection, exfiltration, infiltration, dropper, file_privilege_manipulation, reconnaissance, discovery. Required
execution_mode The rule execution mode. Example: execution_mode=scheduled. Possible values are: scheduled, real_time. Required
timezone The correlation rule timezone. Example: timezone=”Asia/Jerusalem”. Required
mapping_strategy The rule mapping strategy. Example: mapping_strategy=auto. Possible values are: auto, custom. Required
description The correlation rule description. Optional
alert_name The alert name. Optional
alert_description The alert description. Optional
alert_fields Alert fields (string or dictionary). Optional
search_window The search window timeframe. Example: search_window=”1 hours”. Optional
schedule The correlation rule schedule. Example: schedule=”10 minutes”. Optional
schedule_linux Linux scheduling for the rule. Example: schedule_linux=”/10 ** *”. Optional
suppression_enabled Whether suppression is enabled. Possible values are: true, false. Optional
suppression_duration Duration of correlation rule suppression. Optional
suppression_fields Suppression fields. Optional
dataset The correlation rule dataset. Example: dataset=alerts. Required
user_defined_severity User-defined severity. Optional
user_defined_category User-defined category. Optional
mitre_defs_json MITRE definitions. For example: ‘{“TA0005 - Defense Evasion”: [“T1014 - Rootkit”]}’. Optional
investigation_query_link Investigation query link. Optional
drilldown_query_timeframe The drilldown query timeframe. Example: drilldown_query_timeframe=”ALERT”. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.CorrelationRule.rule_id String Correlation rule ID.

xdr-correlation-rule-update

Updates an existing correlation rule.

Base Command

xdr-correlation-rule-update

Input

Argument Name Description Required
rule_id Correlation rule ID. Required
name The correlation rule name. Required
severity The correlation rule severity. Example: severity=low. Possible values are: info, low, medium, high, critical. Required
xql_query The correlation rule XQL query. Example: xql_query=”dataset = xdr_data | limit 1”. Required
is_enabled Whether the rule is enabled. Example: is_enabled=true. Possible values are: true, false. Required
alert_category The alert category. Example: alert_category=dropper. Possible values are: other, persistence, evasion, tampering, file_type_obfuscation, privilege_escalation, credential_access, lateral_movement, execution, collection, exfiltration, infiltration, dropper, file_privilege_manipulation, reconnaissance, discovery. Required
execution_mode The rule execution mode. Example: execution_mode=scheduled. Possible values are: scheduled, real_time. Required
timezone The correlation rule timezone. Example: timezone=”Asia/Jerusalem”. Required
mapping_strategy The rule mapping strategy. Example: mapping_strategy=auto. Possible values are: auto, custom. Required
description The correlation rule description. Optional
alert_name The alert name. Optional
alert_description The alert description. Optional
alert_fields Alert fields (string or dictionary). Optional
search_window The search window timeframe. Example: search_window=”1 hours”. Optional
schedule The correlation rule schedule. Example: schedule=”10 minutes”. Optional
schedule_linux Linux scheduling for the rule. Example: schedule_linux=”/10 ** *”. Optional
suppression_enabled Whether suppression is enabled. Possible values are: true, false. Optional
suppression_duration Duration of correlation rule suppression. Optional
suppression_fields Suppression fields. Optional
dataset The correlation rule dataset. Example: dataset=alerts. Required
user_defined_severity User-defined severity. Optional
user_defined_category User-defined category. Optional
mitre_defs_json MITRE definitions. For example: ‘{“TA0005 - Defense Evasion”: [“T1014 - Rootkit”]}’. Optional
investigation_query_link Investigation query link. Optional
drilldown_query_timeframe The drilldown query timeframe. Example: drilldown_query_timeframe=”ALERT”. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.CorrelationRule.rule_id String Correlation rule ID.

xdr-correlation-rule-delete

Deletes correlation rules.

Base Command

xdr-correlation-rule-delete

Input

Argument Name Description Required
rule_id Correlation rule ID. Required

Context Output

There is no context output for this command.

xdr-case-list

Returns a list of cases based on the specified filters.

Base Command

xdr-case-list

Input

Argument Name Description Required
case_id A comma-separated list of case IDs to filter by. Optional
case_domain A comma-separated list of case domains to filter by. Note: this filter is not applied when extra_data is set to true. Optional
severity A comma-separated list of severities to filter by. Note: this filter is not applied when extra_data is set to true. Optional
created_before Filters cases that were created before this date. Supports natural language expressions such as “one year”. Optional
created_after Filters cases that were created after this date. Supports natural language expressions such as “one year”. Optional
status A comma-separated list of statuses to filter by. Optional
sort_field The field by which to sort the results. Note: sorting by severity is not supported when extra_data is set to true. Possible values are: case_id, severity, creation_time. Optional
sort_order The order in which to sort the results. Possible values are: asc, desc. Optional
limit Maximum number of cases to return. Optional
page_size Page size for pagination. Optional
page Page number for pagination. Optional
extra_data Whether to retrieve extra case data including the associated issues, file artifacts, and network artifacts for each case. Possible values are: true, false. Default is false. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.Case.case_id String The unique identifier of the case.
PaloAltoNetworksXDR.Case.case_name String The name of the case.
PaloAltoNetworksXDR.Case.severity String The severity of the case.
PaloAltoNetworksXDR.Case.creation_time String The creation time of the case.
PaloAltoNetworksXDR.Case.modification_time String The modification time of the case.
PaloAltoNetworksXDR.Case.status_progress String The progress status of the case (e.g., New, Under Investigation).
PaloAltoNetworksXDR.Case.description String A detailed description of the case and involved entities.
PaloAltoNetworksXDR.Case.low_severity_issue_count Number The number of low severity issues associated with the case.
PaloAltoNetworksXDR.Case.med_severity_issue_count Number The number of medium severity issues associated with the case.
PaloAltoNetworksXDR.Case.case_domain String The security domain of the case.
PaloAltoNetworksXDR.Case.xdr_url String The direct URL to the incident view in the XDR console.
PaloAltoNetworksXDR.Case.is_blocked Boolean Indicates if the threat was blocked.
PaloAltoNetworksXDR.Case.aggregated_score Number The overall risk score calculated for the case.
PaloAltoNetworksXDR.Case.host_count Number The number of hosts involved in the case.
PaloAltoNetworksXDR.Case.user_count Number The number of users involved in the case.
PaloAltoNetworksXDR.Case.wildfire_hits Number The number of WildFire malware hits associated with the case.
PaloAltoNetworksXDR.Case.tags String A list of tags associated with the case.
PaloAltoNetworksXDR.Case.starred Boolean Whether the case has been starred/flagged.
PaloAltoNetworksXDR.Case.high_severity_issue_count Number The number of high-severity issues associated with the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.critical_severity_issue_count Number The number of critical-severity issues associated with the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.resolved_timestamp String The time the case was resolved. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.assigned_user_mail String The email address of the user assigned to the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.assigned_user_pretty_name String The display name of the user assigned to the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.hosts String The hosts involved in the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.users String The users involved in the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.mitre_tactics_ids_and_names String The MITRE ATT&CK tactics associated with the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.mitre_techniques_ids_and_names String The MITRE ATT&CK techniques associated with the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.issue_categories String The categories of the issues associated with the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.resolve_comment String The comment provided when the case was resolved. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.notes String Notes associated with the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.manual_severity String The severity manually set for the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.manual_description String The description manually set for the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.rule_based_score Number The rule-based risk score of the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.predicted_score Number The predicted risk score of the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.issue_count Number The total number of issues associated with the case. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.issue_id String The unique identifier of the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.case_id String The identifier of the case the issue belongs to. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.detection_timestamp Number The detection time of the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.name String The name of the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.category String The category of the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.severity String The severity of the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.source String The source of the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.action String The action taken for the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.action_pretty String The human-readable action taken for the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.host_ip String The host IP addresses associated with the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.host_name String The host name associated with the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.user_name String The user name associated with the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.action_file_name String The file name involved in the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.action_file_path String The file path involved in the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.mitre_tactic_id_and_name String The MITRE ATT&CK tactic associated with the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.Issues.mitre_technique_id_and_name String The MITRE ATT&CK technique associated with the issue. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.FileArtifacts.case_id String The identifier of the case associated with the file artifact. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.FileArtifacts.type String The type of the file artifact. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.FileArtifacts.file_name String The name of the file. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.FileArtifacts.file_sha256 String The SHA256 hash of the file. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.FileArtifacts.file_wildfire_verdict String The WildFire verdict for the file. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.FileArtifacts.is_malicious Boolean Whether the file has been identified as malicious. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.FileArtifacts.is_process Boolean Whether the file was a running process. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.FileArtifacts.is_manual Boolean Whether the file artifact was added manually. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.FileArtifacts.file_signature_vendor_name String The vendor name from the file signature. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.FileArtifacts.file_signature_status String The status of the file digital signature. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.FileArtifacts.alert_count Number The number of issues associated with the file artifact. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.NetworkArtifacts.case_id String The identifier of the case associated with the network artifact. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.NetworkArtifacts.type String The type of the network artifact. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.NetworkArtifacts.network_remote_ip String The remote IP address associated with the network artifact. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.NetworkArtifacts.network_remote_port Number The remote port associated with the network artifact. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.NetworkArtifacts.network_domain String The domain associated with the network artifact. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.NetworkArtifacts.network_country String The country associated with the network artifact. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.NetworkArtifacts.alert_count Number The number of issues associated with the network artifact. Returned when extra_data is set to true.
PaloAltoNetworksXDR.Case.NetworkArtifacts.is_manual Boolean Whether the network artifact was added manually. Returned when extra_data is set to true.

xdr-case-update

Updates an existing case with the specified details.

Base Command

xdr-case-update

Input

Argument Name Description Required
case_id The ID of the case to update. Required
status The status to set for the case. When set to “resolved”, the resolve_reason argument is required. Possible values are: new, under_investigation, resolved. Optional
resolve_reason The reason for resolving the case. Can only be provided when the status is set to “resolved”, and is required when resolving. Possible values are: resolved_known_issue, resolved_duplicate, resolved_false_positive, resolved_true_positive, resolved_security_testing, resolved_other. Optional
resolve_comment A free-text comment explaining the resolution. Can only be provided when the status is set to “resolved”. Optional
user_severity The user-defined severity to set for the case. Provide an empty string to clear the severity. Possible values are: low, medium, high, critical. Optional
assigned_user A valid Cortex XDR user email address to assign the case to. Optional
notes A free-text note for the case, used for operational or intermediate comments (e.g., a ServiceNow Ticket ID). Optional
custom_fields A JSON object string of tenant-defined custom fields to update on the case. The keys must be the exact custom field names as configured in your Cortex XDR tenant, and the values must match each field’s configuration. Ensure the custom field names are valid for the tenant; the integration only validates that the input is valid JSON. Example: {"my_custom_field": "value", "another_field": 42}. Optional

Context Output

There is no context output for this command.

xdr-case-artifact-list

Retrieves a list of artifacts for a specific case.

Base Command

xdr-case-artifact-list

Input

Argument Name Description Required
case_id The ID of the case for which to retrieve artifacts. Required

Context Output

Path Type Description
PaloAltoNetworksXDR.CaseNetworkArtifact.case_id String The ID of the case associated with the network artifact.
PaloAltoNetworksXDR.CaseNetworkArtifact.network_remote_ip String The remote IP address associated with the artifact.
PaloAltoNetworksXDR.CaseNetworkArtifact.network_remote_port Number The remote port used in the network connection.
PaloAltoNetworksXDR.CaseNetworkArtifact.alert_count Number Number of alerts associated with this network artifact.
PaloAltoNetworksXDR.CaseNetworkArtifact.type String The type of network artifact (e.g., IP).
PaloAltoNetworksXDR.CaseNetworkArtifact.is_manual Boolean Indicates if the artifact was added manually.
PaloAltoNetworksXDR.CaseFileArtifact.case_id String The ID of the case associated with the file artifact.
PaloAltoNetworksXDR.CaseFileArtifact.file_name String The name of the file.
PaloAltoNetworksXDR.CaseFileArtifact.file_sha256 String The SHA256 hash of the file.
PaloAltoNetworksXDR.CaseFileArtifact.file_wildfire_verdict String The verdict from WildFire (e.g., MALWARE, BENIGN).
PaloAltoNetworksXDR.CaseFileArtifact.is_malicious Boolean Whether the file has been identified as malicious.
PaloAltoNetworksXDR.CaseFileArtifact.is_process Boolean Indicates if the file was a running process.
PaloAltoNetworksXDR.CaseFileArtifact.file_signature_vendor_name String The vendor name from the file signature.
PaloAltoNetworksXDR.CaseFileArtifact.file_signature_status String The status of the digital signature (e.g., SIGNATURE_SIGNED).
PaloAltoNetworksXDR.CaseFileArtifact.alert_count Number Number of alerts associated with this file artifact.
PaloAltoNetworksXDR.CaseFileArtifact.low_confidence Boolean Indicates if the detection confidence is low.

xdr-automation-playbook-create

Creates or updates an automation playbook.

Base Command

xdr-automation-playbook-create

Input

Argument Name Description Required
entry_id The entry ID of the file. The playbook should be a zipped YAML file. Required

Context Output

There is no context output for this command.

xdr-automation-playbook-get

Gets an automation playbook.

Base Command

xdr-automation-playbook-get

Input

Argument Name Description Required
field The field to search by. Possible values are: id, name. Required
value The field value to search for. Required

Context Output

There is no context output for this command.

xdr-automation-playbook-delete

Deletes an automation playbook.

Base Command

xdr-automation-playbook-delete

Input

Argument Name Description Required
field The field to search by. Possible values are: id, name. Required
value The field value to search for. Required

Context Output

There is no context output for this command.

xdr-automation-script-delete

Deletes an automation script.

Base Command

xdr-automation-script-delete

Input

Argument Name Description Required
field The field to search by. Possible values are: id, name. Required
value The field value to search for. Required

Context Output

There is no context output for this command.

xdr-automation-script-get

Gets an automation script.

Base Command

xdr-automation-script-get

Input

Argument Name Description Required
field The field to search by. Possible values are: id, name. Required
value The field value to search for. Required

Context Output

There is no context output for this command.

xdr-automation-script-create

Creates or updates an automation script.

Base Command

xdr-automation-script-create

Input

Argument Name Description Required
entry_id The entry ID of the file. The script should be a zipped YAML file. Required

Context Output

There is no context output for this command.

xdr-vulnerability-details-get

Gets vulnerability details by ID.

Base Command

xdr-vulnerability-details-get

Input

Argument Name Description Required
vulnerability_id The vulnerability ID to retrieve details for. Required

Context Output

Path Type Description
PaloAltoNetworksXDR.Vulnerability.vulnerabilityID String The unique identifier (CVE ID).
PaloAltoNetworksXDR.Vulnerability.description String Detailed description of the vulnerability.
PaloAltoNetworksXDR.Vulnerability.publishedDate Number The date the vulnerability was first published.
PaloAltoNetworksXDR.Vulnerability.epss_score Number The Probability of exploitability (0-1).
PaloAltoNetworksXDR.Vulnerability.exploitDetails.exploitMaturity String Current state of exploit availability (e.g., weaponized).
PaloAltoNetworksXDR.Vulnerability.exploitDetails.weaponizedExploitFound Boolean Whether a functional exploit exists in the wild.
PaloAltoNetworksXDR.Vulnerability.exploitDetails.reportedExploited Boolean Whether the vulnerability has been actively exploited.
PaloAltoNetworksXDR.Vulnerability.exploitDetails.reportedExploitedByThreatActors Boolean Whether known threat actors are exploiting this vulnerability.
PaloAltoNetworksXDR.Vulnerability.exploitDetails.reportedExploitedByRansomware Boolean Whether the vulnerability is used in ransomware campaigns.
PaloAltoNetworksXDR.Vulnerability.exploitDetails.reportedExploitedByBotnets Boolean Whether the vulnerability is being leveraged by botnet clusters.
PaloAltoNetworksXDR.Vulnerability.exploitDetails.firstReportedThreatActor Number The timestamp of the first recorded threat actor activity.
PaloAltoNetworksXDR.Vulnerability.exploitDetails.mostRecentReportedThreatActor Number The timestamp of the last recorded threat actor activity.
PaloAltoNetworksXDR.Vulnerability.cisaKevDateDue Number The deadline set by CISA for federal agency remediation.
PaloAltoNetworksXDR.Vulnerability.weaknesses.cweId String The Common Weakness Enumeration ID.
PaloAltoNetworksXDR.Vulnerability.vulncheck-threat-actors String A list of specific threat actor groups associated with the vulnerability.

xdr-healthcheck-run

Runs a system health check on the Cortex XDR environment.

Base Command

xdr-healthcheck-run

Input

There are no input arguments for this command.

Context Output

Path Type Description
PaloAltoNetworksXDR.HealthStatus.status String The health status of the Cortex XDR system.

xdr-endpoint-triage-preset-list

Gets a list of available triage presets.

Base Command

xdr-endpoint-triage-preset-list

Input

There are no input arguments for this command.

Context Output

Path Type Description
PaloAltoNetworksXDR.EndpointTriagePreset.created_by String The user or system entity that created the triage preset.
PaloAltoNetworksXDR.EndpointTriagePreset.description String A brief explanation of the preset’s purpose or contents.
PaloAltoNetworksXDR.EndpointTriagePreset.name String The unique display name of the triage preset.
PaloAltoNetworksXDR.EndpointTriagePreset.os String The operating system platform the preset targets (e.g., windows, linux, macos).
PaloAltoNetworksXDR.EndpointTriagePreset.type String The category or classification of the preset (e.g., standard, custom).
PaloAltoNetworksXDR.EndpointTriagePreset.uuid String The unique universal identifier (UUID) assigned to this specific preset.

xdr-endpoint-triage

Initiates a forensics triage on the specified endpoints. You must have Cortex XDR with the Forensics add-on. The agent also must have the Forensics License enabled.

Base Command

xdr-endpoint-triage

Input

Argument Name Description Required
endpoint_id A comma-separated list of endpoint IDs to initiate triage on. You can find the endpoint ID under the “Inventory” section, under “All Endpoints”. Required
collector_uuid The collector UUID to use for the triage. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.EndpointTriage.TRIAGE_ID String The unique identifier assigned to the created triage action.
PaloAltoNetworksXDR.EndpointTriage.SUCCESSFUL_AGENT_IDS Array A list of agent IDs where the triage action was successfully initiated.
PaloAltoNetworksXDR.EndpointTriage.UNSUCCESSFUL_AGENT_IDS Array A list of agent IDs where the triage action failed to initiate.

xdr-issue-list

Retrieve issues based on filters. Issues with an ‘INFO’ severity level are filtered out.

Base Command

xdr-issue-list

Input

Argument Name Description Required
issue_id A comma-separated list of issue IDs. Optional
external_id A comma-separated list of external IDs. Optional
detection_method A comma-separated list of methods used to detect the activity. Possible values: ‘BIOC’, ‘Correlation’, ‘Analytics’, ‘System’, ‘IOC’. Possible values are: BIOC, Correlation, Analytics, System, IOC. Optional
domain A comma-separated list of domains. Optional
severity A comma-separated list of severities. Possible values: ‘critical’, ‘high’, ‘medium’, ‘low’, ‘info’. Possible values are: info, low, medium, high, critical. Optional
insert_time Filter by issues inserted after this time. Optional
status A comma-separated list of statuses. Possible values: ‘New’, ‘In Progress’, ‘Resolved’. Possible values are: New, In Progress, Resolved. Optional
sort_field The field to sort by. Possible values are: issue_id, severity, observation_time. Optional
sort_order The sort order. Possible values are: asc, desc. Optional
limit The maximum number of results to return. Optional
page_size The page size. Optional
page The page number. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.Issue.observation_time Number The timestamp when the observation occurred.
PaloAltoNetworksXDR.Issue.domain String The security domain associated with the observation.
PaloAltoNetworksXDR.Issue.remediation String Suggested remediation steps.
PaloAltoNetworksXDR.Issue.impact String The potential impact of the observed activity.
PaloAltoNetworksXDR.Issue.status String The current progress status (e.g., New).
PaloAltoNetworksXDR.Issue.status_resolution_comment String Comments regarding the resolution of the status.
PaloAltoNetworksXDR.Issue.status_progress String The current progress status (e.g., New).
PaloAltoNetworksXDR.Issue.asset_ids String List of asset IDs involved.
PaloAltoNetworksXDR.Issue.assigned_to_pretty String The display name of the user assigned to this item.
PaloAltoNetworksXDR.Issue.last_update_timestamp Number The last time this record was updated.
PaloAltoNetworksXDR.Issue.detection_method String The method used to detect the activity (e.g., BIOC).
PaloAltoNetworksXDR.Issue.is_starred Boolean Whether the item has been starred/flagged.
PaloAltoNetworksXDR.Issue.name String The name of the observation or alert.
PaloAltoNetworksXDR.Issue.external_id String The unique UUID for external reference.
PaloAltoNetworksXDR.Issue.insert_time Number The time the record was inserted into the database.
PaloAltoNetworksXDR.Issue.detection_rule_id String The ID of the specific detection rule triggered.
PaloAltoNetworksXDR.Issue.tags String A list of tags associated with the observation.
PaloAltoNetworksXDR.Issue.type String The classification type of the observation.
PaloAltoNetworksXDR.Issue.id Number The numeric ID of the observation.
PaloAltoNetworksXDR.Issue.description String Detailed description of the observed activity.
PaloAltoNetworksXDR.Issue.severity String The severity level (e.g., LOW).
PaloAltoNetworksXDR.Issue.category String The category classification.
PaloAltoNetworksXDR.Issue.is_excluded Boolean Whether this observation is excluded from standard views.

xdr-issue-create

Creates a new issue. Issues with an ‘INFO’ severity level are not displayed in the UI.

Base Command

xdr-issue-create

Input

Argument Name Description Required
name The issue name. Required
description The issue description. Required
observation_time The observation time. Should support english expressions like “one year”. Required
domain The domain. Required
category The category. Required
asset_id A comma-separated list of asset IDs. Optional
mitre_tactic A comma-separated list of MITRE tactics. Optional
mitre_technique A comma-separated list of MITRE techniques. Optional
type The issue type. Optional
extended_description The extended description. Optional
impact The impact. Optional
tags A comma-separated list of tags. Optional
is_excluded Whether the issue is excluded. Possible values are: true, false. Optional
is_starred Whether the issue is starred. Possible values are: true, false. Optional
assigned_to The user assigned to the issue. Optional
assigned_to_pretty The pretty name of the user assigned to the issue. Optional
severity The severity. Possible values are: critical, info, low, medium, high. Required
normalized_fields_json The JSON to add to the “normalized_fields” field in the API. Optional
custom_fields_json The JSON to add to the “custom_fields” field in the API. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.Issue.external_id String The issue external ID.
PaloAltoNetworksXDR.Issue.detection_method String The issue detection method.

xdr-issue-update

Updates an existing issue.

Base Command

xdr-issue-update

Input

Argument Name Description Required
issue_id The issue ID. Required
severity The severity. Possible values are: critical, info, low, medium, high. Optional
status The status. Possible values are: new, in_progress, resolved. Optional
resolve_reason The resolve reason. Possible values are: resolved_threat_handled, resolved_known_issue, resolved_duplicate, resolved_false_positive, resolved_other, resolved_true_positive, resolved_security_testing. Optional
resolve_comment The resolve comment. Optional

Context Output

There is no context output for this command.

Configuration parameters

  • isFetch — Fetch incidents
  • incidentFetchInterval — Incidents Fetch Interval
  • incidentType — Incident type
  • url — Server URL (copy URL from XDR) (required)
  • apikey_id_creds —
  • apikey_creds —
  • dont_format_sublists — Remove legacy incident fields
  • mirror_direction — Incident Mirroring Direction
  • close_xsoar_incident — Close Mirrored XSOAR Incident
  • close_xdr_incident — Close Mirrored Cortex XDR Incident
  • xdr_delay — XDR mirroring delay in minutes
  • custom_xsoar_to_xdr_close_reason_mapping — Custom close-reason mapping (XSOAR -> XDR mirrored incident. Overwrites default close-reason mapping defined by Cortex XSOAR)
  • custom_xdr_to_xsoar_close_reason_mapping — Custom close-reason mapping (XDR -> XSOAR mirrored incident. Overwrites default close-reason mapping defined by Cortex XSOAR)
  • apikey_id — API Key ID
  • apikey — API Key
  • timeout — HTTP Timeout
  • max_fetch — Maximum number of incidents per fetch
  • starred — Only fetch starred incidents
  • starred_incidents_fetch_window — Starred incidents fetch window
  • fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • sync_owners — Sync Incident Owners
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • prevent_only — Prevent Only Mode
  • status — Incident Statuses to Fetch
  • exclude_fields — Minimize Incident Information
  • excluded_alert_fields — Minimize Alert Information
  • close_alerts_in_xdr — Close all related alerts in XDR

Commands (109)

  • endpoint

    Returns information about an endpoint.

  • get-mapping-fields

    Gets mapping fields from remote incident. Note: This method will not update the current incident. It's here for debugging purposes.

  • get-modified-remote-data

    Gets the list of incidents that were modified since the last update. Note: This method is here for debugging purposes. get-modified-remote-data is used as part of a Mirroring feature, which is available since version 6.1.

  • get-remote-data

    Gets remote data from a remote incident. Note: This method will not update the current incident. It's here for debugging purposes.

  • xdr-action-status-get

    Retrieves the status of the requested actions according to the action ID.

  • xdr-allowlist-files

    Adds requested files to the allow list if they are not already on the block list or allow list.

  • xdr-api-key-delete

    Deletes the specified API keys.

  • xdr-api-key-list

    Gets a list of existing API keys.

  • xdr-asset-group-create

    Creates an asset group.

  • xdr-asset-group-delete

    Deletes an asset group.

  • xdr-asset-group-list

    Returns a list of asset groups.

  • xdr-asset-group-update

    Updates an asset group.

  • xdr-asset-list

    Returns a list of assets.

  • xdr-asset-schema-field-options-get

    Gets the enum values of a specified field in the asset schema.

  • xdr-asset-schema-get

    Gets the schema of the asset inventory.

  • xdr-automation-playbook-create

    Creates or updates an automation playbook.

  • xdr-automation-playbook-delete

    Deletes an automation playbook.

  • xdr-automation-playbook-get

    Gets an automation playbook.

  • xdr-automation-script-create

    Creates or updates an automation script.

  • xdr-automation-script-delete

    Deletes an automation script.

  • xdr-automation-script-get

    Gets an automation script.

  • xdr-bioc-create

    Creates a new BIOC.

  • xdr-bioc-delete

    Deletes a BIOC.

  • xdr-bioc-list

    Returns a list of BIOCs.

  • xdr-bioc-update

    Updates an existing BIOC.

  • xdr-blacklist-files Deprecated

    Deprecated. Use `xdr-blocklist-files` instead.

  • xdr-blocklist-files

    Block lists requested files which have not already been block listed or added to allow lists.

  • xdr-case-artifact-list

    Retrieves a list of artifacts for a specific case.

  • xdr-case-list

    Returns a list of cases based on the specified filters.

  • xdr-case-update

    Updates an existing case with the specified details.

  • xdr-correlation-rule-create

    Creates a new correlation rule.

  • xdr-correlation-rule-delete

    Deletes correlation rules.

  • xdr-correlation-rule-list

    Returns a list of correlation rules.

  • xdr-correlation-rule-update

    Updates an existing correlation rule.

  • xdr-create-distribution

    Creates an installation package. This is an asynchronous call that returns the distribution ID. This does not mean that the creation succeeded. To confirm that the package has been created, check the status of the distribution by running the Get Distribution Status API.

  • xdr-delete-endpoints

    Deletes selected endpoints in the Cortex XDR app. You can delete up to 1000 endpoints.

  • xdr-endpoint-alias-change

    Gets a list of endpoints according to the passed filters, and changes their alias name. Filtering by multiple fields will be concatenated using the AND condition (OR is not supported).

  • xdr-endpoint-isolate

    Isolates the specified endpoint.

  • xdr-endpoint-scan Deprecated

    Deprecated. Use `xdr-endpoint-scan-execute` instead.

  • xdr-endpoint-scan-abort

    Cancels the scan of selected endpoints. A scan can only be aborted if the selected endpoints are Pending or In Progress. To scan all endpoints, run the command with the argument all=true. Note that scanning all of the endpoints may cause performance issues and latency.

  • xdr-endpoint-scan-execute

    Runs a scan on a selected endpoint. To scan all endpoints, run this command with argument all=true. Note: Scanning all the endpoints may cause performance issues and latency.

  • xdr-endpoint-tag-add

    Adds a tag to specified endpoint_ids.

  • xdr-endpoint-tag-remove

    Removes a tag from specified endpoint_ids.

  • xdr-endpoint-triage

    Initiates a forensics triage on the specified endpoints. You must have Cortex XDR with the Forensics add-on. The agent also must have the Forensics License enabled.

  • xdr-endpoint-triage-preset-list

    Gets a list of available triage presets.

  • xdr-endpoint-unisolate

    Reverses the isolation of an endpoint.

  • xdr-file-delete-script-execute

    Initiates a new endpoint script execution to delete the specified file.

  • xdr-file-exist-script-execute

    Initiates a new endpoint script execution to check if the file exists.

  • xdr-file-quarantine

    Quarantines a file on selected endpoints. You can select up to 1000 endpoints.

  • xdr-file-restore

    Restores a quarantined file on requested endpoints.

  • xdr-file-retrieve

    Retrieves files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. At least one endpoint ID and one file path are necessary in order to run the command. After running this command, you can use the xdr-action-status-get command with returned action_id, to check the action status.

  • xdr-get-alerts Deprecated

    This command is deprecated, please use xdr-issue-list instead. Returns a list of alerts and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. Multiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value.

  • xdr-get-audit-agent-reports

    Gets agent event reports. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of reports from the start of the result set (start by counting from 0).

  • xdr-get-audit-management-logs

    Gets management logs. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of management logs from the start of the result set (start by counting from 0).

  • xdr-get-cloud-original-alerts Deprecated

    This command is deprecated. Returns information about each alert ID.

  • xdr-get-contributing-event

    Retrieves contributing events for a specific correlation alert.

  • xdr-get-create-distribution-status

    Gets the status of the installation package.

  • xdr-get-distribution-url

    Gets the distribution URL for downloading the installation package.

  • xdr-get-distribution-versions

    Gets a list of all the agent versions to use for creating a distribution list.

  • xdr-get-endpoint-device-control-violations

    Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.

  • xdr-get-endpoints

    Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set. (Start by counting from 0).

  • xdr-get-endpoints-by-status

    Returns the number of the connected\disconnected endpoints.

  • xdr-get-incident-extra-data Deprecated

    This command is deprecated. Use "xdr-case-list extra_data=true" instead. Returns additional data for the specified incident, for example, related alerts, file artifacts, network artifacts, and so on.

  • xdr-get-incidents Deprecated

    This command is deprecated please use xdr-case-list instead. Returns a list of incidents, which you can filter by a list of incident IDs (max. 100), the time the incident was last modified, and the time the incident was created. If you pass multiple filtering arguments, they will be concatenated using the AND condition. The OR condition is not supported.

  • xdr-get-policy

    Gets the policy name for a specific endpoint.

  • xdr-get-quarantine-status

    Retrieves the quarantine status for a selected file.

  • xdr-get-script-code

    Gets the code of a specific script in the script library.

  • xdr-get-script-execution-result-files

    Gets the files retrieved from a specific endpoint during a script execution.

  • xdr-get-script-execution-results

    Retrieve the results of a script execution action.

  • xdr-get-script-execution-status

    Retrieves the status of a script execution action.

  • xdr-get-script-metadata

    Gets the full definition of a specific script in the scripts library.

  • xdr-get-scripts

    Gets a list of scripts available in the scripts library.

  • xdr-get-tenant-info

    Provides information about the tenant.

  • xdr-healthcheck-run

    Runs a system health check on the Cortex XDR environment.

  • xdr-insert-cef-alerts Deprecated

    This command is deprecated. Upload alerts in CEF format from external alert sources. After you map CEF alert fields to Cortex XDR fields, Cortex XDR displays the alerts in related incidents and views. You can send 600 requests per minute. Each request can contain a maximum of 60 alerts.

  • xdr-insert-parsed-alert Deprecated

    This command is deprecated. Uploads an alert from external alert sources in Cortex XDR format. Cortex XDR displays alerts that are parsed successfully in related incidents and views. You can send 600 alerts per minute. Each request can contain a maximum of 60 alerts.

  • xdr-isolate-endpoint Deprecated

    Deprecated. Use `xdr-endpoint-isolate` instead.

  • xdr-issue-create

    Creates a new issue. Issues with an 'INFO' severity level are not displayed in the UI.

  • xdr-issue-list

    Retrieve issues based on filters. Issues with an 'INFO' severity level are filtered out.

  • xdr-issue-update

    Updates an existing issue.

  • xdr-kill-process-script-execute

    Initiates a new endpoint script execution kill process.

  • xdr-list-risky-hosts

    Retrieve the risk score of a specific host or list of hosts with the highest risk score in the environment along with the reason affecting each score.

  • xdr-list-risky-users

    Retrieve the risk score of a specific user or list of users with the highest risk score in the environment along with the reason affecting each score.

  • xdr-list-roles

    Retrieve information about one or more roles created in the environment.

  • xdr-list-user-groups

    Retrieve a list of the current user emails associated with one or more user groups in the environment.

  • xdr-list-users

    Retrieve a list of the current users in the environment.

  • xdr-quarantine-files Deprecated

    Deprecated. Use `xdr-file-quarantine` instead.

  • xdr-remove-allowlist-files

    Removes requested files from allow list.

  • xdr-remove-blocklist-files

    Removes requested files from the block list.

  • xdr-remove-user-role

    Remove one or more users from a role.

  • xdr-replace-featured-field

    Replace the featured hosts\users\IP addresses\active directory groups listed in your environment.

  • xdr-restore-file Deprecated

    Deprecated. Use `xdr-file-restore` instead.

  • xdr-retrieve-file-details

    View the file retrieved by the xdr-retrieve-files command according to the action ID. Before running this command, you can use the xdr-action-status-get command to check if this action completed successfully.

  • xdr-retrieve-files Deprecated

    Deprecated. Use `xdr-file-retrieve` instead.

  • xdr-run-script Deprecated

    Deprecated. Run xdr-script-run instead.

  • xdr-run-script-delete-file Deprecated

    Deprecated. Use `xdr-file-delete-script-execute` instead.

  • xdr-run-script-execute-commands Deprecated

    Deprecated. Use `xdr-script-commands-execute` instead.

  • xdr-run-script-file-exists Deprecated

    Deprecated. Use `xdr-file-exist-script-execute` instead.

  • xdr-run-script-kill-process Deprecated

    Deprecated. Use `xdr-kill-process-script-execute` instead.

  • xdr-run-snippet-code-script Deprecated

    Deprecated. Use `xdr-snippet-code-script-execute` instead.

  • xdr-script-commands-execute

    Initiates a new endpoint script execution of shell commands.

  • xdr-script-run

    Initiates a new endpoint script execution action using a script from the script library and returns the results.

  • xdr-set-user-role

    Add one or more users to a role.

  • xdr-snippet-code-script-execute

    Initiates a new endpoint script execution action using the provided snippet code.

  • xdr-unisolate-endpoint Deprecated

    Deprecated. Use `xdr-endpoint-unisolate` instead.

  • xdr-update-alert Deprecated

    This command is deprecated, please use xdr-issue-update instead. Update one or more alerts with the provided arguments. Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB.

  • xdr-update-incident Deprecated

    This command is deprecated please use xdr-case-update instead. Updates one or more fields of a specified incident. Missing fields will be ignored. To remove the assignment for an incident, pass a null value in the assignee email argument.

  • xdr-vulnerability-details-get

    Gets vulnerability details by ID.

  • xdr-whitelist-files Deprecated

    Deprecated. Use `xdr-allowlist-files` instead.

Source

CortexXDRIR.py CortexXDRIR_test.py CortexXDRIR.yml CortexXDRIR_description.md command_examples.txt
Download History Raw 
category: Endpoint
provider: Palo Alto Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: Cortex XDR - IR
  version: -1
configuration:
- display: Fetch incidents
  name: isFetch
  defaultvalue: 'true'
  type: 8
  section: Collect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  type: 19
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
  defaultvalue: 'Cortex XDR - Lite'
- name: url
  type: 0
  display: 'Server URL (copy URL from XDR)'
  section: Connect
  required: true
- displaypassword: API Key ID
  name: apikey_id_creds
  type: 9
  hiddenusername: true
  display: ''
  section: Connect
  required: false
- display: ''
  name: apikey_creds
  type: 9
  section: Connect
  required: false
  displaypassword: API Key
  hiddenusername: true
- defaultvalue: 'false'
  display: Remove legacy incident fields
  name: dont_format_sublists
  type: 8
  section: Collect
  required: false
  additionalinfo: Not selected for backwards compatibility. Recommended to select. This will remove duplicated incident fields under file_artifacts, network_artifacts, and alerts (like client_id, clientid.)
- display: Incident Mirroring Direction
  name: mirror_direction
  required: false
  type: 15
  section: Collect
  defaultvalue: None
  options:
  - None
  - Incoming
  - Outgoing
  - Both
  hidden:
  - marketplacev2
  - platform
  additionalinfo: Not supported on Cortex platform.
- additionalinfo: When selected, closing the Cortex XDR incident is mirrored in Cortex XSOAR.
  defaultvalue: 'true'
  display: Close Mirrored XSOAR Incident
  name: close_xsoar_incident
  type: 8
  section: Collect
  advanced: true
  required: false
- additionalinfo: "When selected, closing the Cortex XSOAR incident is mirrored in Cortex XDR. Notice: If not selected, but 'Close all related alerts in XDR' is selected, the incident will automatically be closed in Cortex XDR."
  defaultvalue: 'true'
  display: Close Mirrored Cortex XDR Incident
  name: close_xdr_incident
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: '1'
  display: XDR mirroring delay in minutes
  name: xdr_delay
  type: 0
  section: Collect
  required: false
  advanced: true
  additionalinfo: "In the event of a delay in mirroring incoming changes from XDR, use the xdr_delay parameter to extend the look-back period. However, be aware that this may result in increased latency when updating incidents."
- display: Custom close-reason mapping (XSOAR -> XDR mirrored incident. Overwrites default close-reason mapping defined by Cortex XSOAR)
  section: Collect
  advanced: true
  additionalinfo: 'Define how to close the mirrored incidents from Cortex XSOAR into Cortex XDR with a custom close reason mapping. Enter a comma-separated list of close reasons (acceptable format {Cortex XSOAR close reason}={Cortex XDR close reason}) to override the default close reason mapping defined by Cortex XSOAR. Note that the mapping must be configured accordingly with the existing close reasons in Cortex XSOAR and Cortex XDR. Not following this format will result in closing the incident with a default close reason. Example: "Resolved=Other,Duplicate=Other". Refer to ../README.md for possible close-reasons - `XDR Incident Mirroring`.'
  name: custom_xsoar_to_xdr_close_reason_mapping
  defaultvalue: ''
  type: 0
  required: false
- display: Custom close-reason mapping (XDR -> XSOAR mirrored incident. Overwrites default close-reason mapping defined by Cortex XSOAR)
  section: Collect
  advanced: true
  additionalinfo: 'Define how to close the mirrored incidents from Cortex XDR into Cortex XSOAR with a custom close reason mapping. Enter a comma-separated list of close reasons (acceptable format {Cortex XDR close reason}={Cortex XSOAR close reason}) to override the default close reason mapping defined by Cortex XSOAR. Note that the mapping must be configured accordingly with the existing close reasons in Cortex XSOAR and Cortex XDR. Not following this format will result in closing the incident with a default close reason. Example: “Known Issue=Resolved, Duplicate Incident=Other". Refer to ../README.md for possible close-reasons - `XDR Incident Mirroring`.'
  name: custom_xdr_to_xsoar_close_reason_mapping
  defaultvalue: ''
  type: 0
  required: false
- display: API Key ID
  name: apikey_id
  type: 4
  hidden: true
  section: Connect
  required: false
- display: API Key
  name: apikey
  type: 4
  section: Connect
  required: false
  hidden: true
- additionalinfo: The timeout of the HTTP requests sent to Cortex XDR API (in seconds).
  defaultvalue: '120'
  display: HTTP Timeout
  name: timeout
  type: 0
  section: Connect
  required: false
  advanced: true
- display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
  additionalinfo: The maximum number of incidents per fetch. Cannot exceed 100.
  defaultvalue: '10'
- display: Only fetch starred incidents
  name: starred
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 3 days
  display: Starred incidents fetch window
  name: starred_incidents_fetch_window
  type: 0
  section: Collect
  required: false
  additionalinfo: Starred fetch window timestamp (<number> <time unit>, e.g., 12 hours, 7 days). Fetches only starred incidents within the specified time range.
  advanced: true
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  type: 0
  section: Collect
  required: false
  defaultvalue: 3 days
- display: Sync Incident Owners
  name: sync_owners
  type: 8
  section: Collect
  advanced: true
  required: false
  additionalinfo: For Cortex XSOAR version 6.0.0 and above. If selected, for every incident fetched from Cortex XDR to Cortex XSOAR, the incident owners will be synced. Note that once this value is changed and synchronized between the systems, additional changes will not be reflected. For example, if you change the owner in Cortex XSOAR, the new owner will also be changed in Cortex XDR. However, if you now change the owner back in Cortex XDR, this additional change will not be reflected in Cortex XSOAR. In addition, for this change to be reflected, the owners must exist in both Cortex XSOAR and Cortex XDR.
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- additionalinfo: 'Whether the XDR tenant mode is prevent only'
  display: Prevent Only Mode
  name: prevent_only
  type: 8
  section: Connect
  advanced: true
  required: false
- additionalinfo: 'The statuses of the incidents that will be fetched. If no status is provided then incidents of all the statuses will be fetched. Note: An incident whose status was changed to a filtered status after its creation time will not be fetched.'
  display: Incident Statuses to Fetch
  name: status
  options:
  - new
  - under_investigation
  - resolved_known_issue
  - resolved_false_positive
  - resolved_true_positive
  - resolved_security_testing
  - resolved_other
  - resolved_auto
  type: 16
  section: Collect
  advanced: true
  required: false
- additionalinfo: "Whether to fetch only the essential incident's fields - without Network Artifacts and File Artifacts to minimize the incident's information."
  display: Minimize Incident Information
  name: exclude_fields
  required: false
  type: 8
  section: Collect
  defaultvalue: 'true'
  advanced: true
- additionalinfo: "Whether to fetch only the essential alert fields in order to minimize the incident's information. Possible values: null_values to remove all null values from alerts data, or any other field of an alert."
  display: Minimize Alert Information
  name: excluded_alert_fields
  required: false
  type: 16
  section: Collect
  advanced: true
  defaultvalue: 'null_values'
- display: Close all related alerts in XDR
  name: close_alerts_in_xdr
  required: false
  additionalinfo: "Close all related alerts in Cortex XDR once an incident has been closed in Cortex XSOAR."
  advanced: true
  type: 8
  section: Collect
description: Cortex XDR is the world's first detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks.
display: Palo Alto Networks Cortex XDR - Investigation and Response
name: Cortex XDR - IR
script:
  commands:
  - arguments:
    - description: A date in the format 2019-12-31T23:59:00 in UTC. Only incidents that were created on or before the specified date/time will be retrieved.
      name: lte_creation_time
    - description: A date in the format 2019-12-31T23:59:00 in UTC. Only incidents that were created on or after the specified date/time will be retrieved.
      name: gte_creation_time
    - description: Filters returned incidents that were modified on or before the specified date/time, in the format 2019-12-31T23:59:00.
      name: lte_modification_time
    - description: Filters returned incidents that were modified on or after the specified date/time, in the format 2019-12-31T23:59:00.
      name: gte_modification_time
    - description: An array or CSV string of incident IDs.
      isArray: true
      name: incident_id_list
    - description: Filters returned incidents that were created on or after the specified date/time range, for example, 1 month, 2 days, 1 hour, and so on.
      name: since_creation_time
    - description: Filters returned incidents that were modified on or after the specified date/time range, for example, 1 month, 2 days, 1 hour, and so on.
      name: since_modification_time
    - auto: PREDEFINED
      description: Sorts returned incidents by the date/time that the incident was last modified ("asc" - ascending, "desc" - descending).
      name: sort_by_modification_time
      predefined:
      - asc
      - desc
    - auto: PREDEFINED
      description: Sorts returned incidents by the date/time that the incident was created ("asc" - ascending, "desc" - descending).
      name: sort_by_creation_time
      predefined:
      - asc
      - desc
    - defaultValue: '0'
      description: Page number (for pagination). 0 is the first page.
      name: page
    - defaultValue: '100'
      description: Maximum number of incidents to return per page. The default and maximum is 100.
      name: limit
    - description: 'Filters only incidents in the specified status. The options are: new, under_investigation, resolved_known_issue, resolved_false_positive, resolved_true_positive resolved_security_testing, resolved_other, resolved_auto.'
      name: status
    - auto: PREDEFINED
      description: 'Whether the incident is starred.'
      name: starred
      predefined:
      - 'true'
      - 'false'
    - description: Deprecated. Use gte_creation_time instead.
      defaultValue: 3 days
      name: starred_incidents_fetch_window
      deprecated: true
    description: |-
      This command is deprecated please use xdr-case-list instead. Returns a list of incidents, which you can filter by a list of incident IDs (max. 100), the time the incident was last modified, and the time the incident was created.
      If you pass multiple filtering arguments, they will be concatenated using the AND condition. The OR condition is not supported.
    name: xdr-get-incidents
    deprecated: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.Incident.incident_id
      description: Unique ID assigned to each returned incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.manual_severity
      description: Incident severity assigned by the user. This does not affect the calculated severity. Can be "low", "medium", "high".
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.manual_description
      description: Incident description provided by the user.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.assigned_user_mail
      description: Email address of the assigned user.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.high_severity_alert_count
      description: Number of alerts with the severity HIGH.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.host_count
      description: Number of hosts involved in the incident.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.xdr_url
      description: A link to the incident view on Cortex XDR.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.assigned_user_pretty_name
      description: Full name of the user assigned to the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alert_count
      description: Total number of alerts in the incident.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.med_severity_alert_count
      description: Number of alerts with the severity MEDIUM.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.user_count
      description: Number of users involved in the incident.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.severity
      description: |
        Calculated severity of the incident. Valid values are: "low","medium","high".
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.low_severity_alert_count
      description: Number of alerts with the severity LOW.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.status
      description: |
        Current status of the incident. Valid values are: "new","under_investigation","resolved_known_issue","resolved_duplicate_incident","resolved_false_positive","resolved_true_positive","resolved_security_testing" or "resolved_other".
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.description
      description: Description of the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.resolve_comment
      description: Comments entered by the user when the incident was resolved.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.notes
      description: Comments entered by the user regarding the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.creation_time
      description: Date and time the incident was created on Cortex XDR.
      type: date
    - contextPath: PaloAltoNetworksXDR.Incident.detection_time
      description: Date and time that the first alert occurred in the incident.
      type: date
    - contextPath: PaloAltoNetworksXDR.Incident.modification_time
      description: Date and time that the incident was last modified.
      type: date
  - arguments:
    - description: The ID of the incident for which to get additional data.
      name: incident_id
      required: true
    - defaultValue: '1000'
      description: Maximum number of alerts to return.
      name: alerts_limit
    - defaultValue: 'False'
      description: Return data only if the incident was changed since the last time it was mirrored into Cortex XSOAR.  This flag should be used only from within a Cortex XDR incident.
      name: return_only_updated_incident
    - defaultValue: 'False'
      description: "Whether to exclude Network Artifacts and File Artifacts from incident data."
      name: excluding_artifacts
    description: This command is deprecated. Use "xdr-case-list extra_data=true" instead. Returns additional data for the specified incident, for example, related alerts, file artifacts, network artifacts, and so on.
    name: xdr-get-incident-extra-data
    deprecated: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.Incident.incident_id
      description: Unique ID assigned to each returned incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.creation_time
      description: Date and time the incident was created on Cortex XDR.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.modification_time
      description: Date and time that the incident was last modified.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.detection_time
      description: Date and time that the first alert occurred in the incident.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.status
      description: |-
        Current status of the incident. Valid values are:
        "new","under_investigation","resolved_known_issue","resolved_duplicate","resolved_false_positive","resolved_true_positive","resolved_security_testing","resolved_other".
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.severity
      description: 'Calculated severity of the incident. Valid values are: "low","medium","high".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.description
      description: Description of the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.assigned_user_mail
      description: Email address of the assigned user.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.assigned_user_pretty_name
      description: Full name of the user assigned to the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alert_count
      description: Total number of alerts in the incident.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.low_severity_alert_count
      description: Number of alerts with the severity LOW.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.med_severity_alert_count
      description: Number of alerts with the severity MEDIUM.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.high_severity_alert_count
      description: Number of alerts with the severity HIGH.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.user_count
      description: Number of users involved in the incident.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.host_count
      description: Number of hosts involved in the incident.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.notes
      description: Comments entered by the user regarding the incident.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.resolve_comment
      description: Comments entered by the user when the incident was resolved.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.manual_severity
      description: 'Incident severity assigned by the user. This does not affect the calculated severity. Can be "low", "medium", "high".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.manual_description
      description: Incident description provided by the user.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.xdr_url
      description: A link to the incident view on Cortex XDR.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.starred
      description: Whether the incident is starred.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_techniques_ids_and_names
      description: Incident MITRE techniques IDs and names.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_tactics_ids_and_names
      description: Incident MITRE tactics IDs and names.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.alert_id
      description: Unique ID for each alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.detection_timestamp
      description: Date and time the alert occurred.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.source
      description: The product/vendor from which this alert came.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.severity
      description: 'Severity of the alert. Valid values are: "low","medium","high".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.name
      description: Calculated name of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.category
      description: Category of the alert, for example, Spyware Detected via Anti-Spyware profile.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.description
      description: Description of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.host_ip_list
      description: Host IP address involved in the alert.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.host_name
      description: Hostname involved in the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.user_name
      description: User name involved with the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.event_type
      description: 'Event type. Valid values are: "Process Execution","Network Event","File Event","Registry Event","Injection Event","Load Image Event","Windows Event Log".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action
      description: 'The action that triggered the alert. Valid values are: "REPORTED", "BLOCKED", "POST_DETECTED", "SCANNED", "DOWNLOAD", "PROMPT_ALLOW", "PROMPT_BLOCK", "DETECTED", "BLOCKED_1", "BLOCKED_2", "BLOCKED_3", "BLOCKED_5", "BLOCKED_6", "BLOCKED_7", "BLOCKED_8", "BLOCKED_9", "BLOCKED_10", "BLOCKED_11", "BLOCKED_13", "BLOCKED_14", "BLOCKED_15", "BLOCKED_16", "BLOCKED_17", "BLOCKED_24", "BLOCKED_25", "DETECTED_0", "DETECTED_4", "DETECTED_18", "DETECTED_19", "DETECTED_20", "DETECTED_21", "DETECTED_22", "DETECTED_23".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_pretty
      description: 'The action that triggered the alert. Valid values are: "Detected (Reported)" "Prevented (Blocked)" "Detected (Post Detected)" "Detected (Scanned)" "Detected (Download)" "Detected (Prompt Allow)" "Prevented (Prompt Block)" "Detected" "Prevented (Denied The Session)" "Prevented (Dropped The Session)" "Prevented (Dropped The Session And Sent a TCP Reset)" "Prevented (Blocked The URL)" "Prevented (Blocked The IP)" "Prevented (Dropped The Packet)" "Prevented (Dropped All Packets)" "Prevented (Terminated The Session And Sent a TCP Reset To Both Sides Of The Connection)" "Prevented (Terminated The Session And Sent a TCP Reset To The Client)" "Prevented (Terminated The Session And Sent a TCP Reset To The Server)" "Prevented (Continue)" "Prevented (Block-Override)" "Prevented (Override-Lockout)" "Prevented (Override)" "Prevented (Random-Drop)" "Prevented (Silently Dropped The Session With An ICMP Unreachable Message To The Host Or Application)" "Prevented (Block)" "Detected (Allowed The Session)" "Detected (Raised An Alert)" "Detected (Syncookie Sent)" "Detected (Forward)" "Detected (Wildfire Upload Success)" "Detected (Wildfire Upload Failure)" "Detected (Wildfire Upload Skip)" "Detected (Sinkhole)".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_name
      description: Image name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_command_line
      description: Command line.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_status
      description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_vendor
      description: Signature vendor name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_image_name
      description: Image name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_line
      description: Command line.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_status
      description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_vendor
      description: Signature vendor.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_causality_id
      description: Causality ID.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_name
      description: Image name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_command_line
      description: Command line.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_sha256
      description: Image SHA256 hash.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_signature_status
      description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_signature_vendor
      description: Signature vendor name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_path
      description: File path.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_md5
      description: MD5 hash of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_sha256
      description: SHA256 hash of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_registry_data
      description: Registry data.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_registry_full_key
      description: Registry full key.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_local_ip
      description: Local IP address.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_local_port
      description: Local port.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_remote_ip
      description: Remote IP address.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_remote_port
      description: Remote port.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_external_hostname
      description: External hostname.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.fw_app_id
      description: Firewall app ID.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.is_whitelisted
      description: 'Whether the alert is on the allow list. Valid values are: "Yes" "No".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.starred
      description: Whether the alert is starred.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.type
      description: Network artifact type.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_port
      description: The remote port related to the artifact.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.alert_count
      description: Number of alerts related to the artifact.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_ip
      description: The remote IP address related to the artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.is_manual
      description: Whether the artifact was created by the user (manually).
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_domain
      description: The domain related to the artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.type
      description: 'The artifact type. Valid values are: "META", "GID", "CID", "HASH", "IP", "DOMAIN", "REGISTRY", "HOSTNAME".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_country
      description: The country related to the artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_status
      description: 'Digital signature status of the file. Valid values are: "SIGNATURE_UNAVAILABLE" "SIGNATURE_SIGNED" "SIGNATURE_INVALID" "SIGNATURE_UNSIGNED" "SIGNATURE_WEAK_HASH".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_process
      description: Whether the file artifact is related to a process execution.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_name
      description: Name of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_wildfire_verdict
      description: 'The file verdict, calculated by Wildfire. Valid values are: "BENIGN" "MALWARE" "GRAYWARE" "PHISHING" "UNKNOWN".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.alert_count
      description: Number of alerts related to the artifact.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_malicious
      description: Whether the artifact is malicious, as decided by the Wildfire verdict.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_manual
      description: Whether the artifact was created by the user (manually).
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.type
      description: 'The artifact type. Valid values are: "META" "GID" "CID" "HASH" "IP" "DOMAIN" "REGISTRY" "HOSTNAME".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256
      description: SHA256 hash of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_vendor_name
      description: File signature vendor name.
      type: String
    - contextPath: Account.Username
      description: The username in the relevant system.
      type: String
    - contextPath: Endpoint.Hostname
      description: The hostname that is mapped to this endpoint.
      type: String
    - contextPath: Endpoint.ID
      description: The agent ID of the endpoint.
      type: String
    - contextPath: File.Path
      description: The path where the file is located.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Name
      description: The full file name (including the file extension).
      type: String
    - contextPath: Process.Name
      description: The name of the process.
      type: String
    - contextPath: Process.MD5
      description: The MD5 hash of the process.
      type: String
    - contextPath: Process.SHA256
      description: The SHA256 hash of the process.
      type: String
    - contextPath: Process.PID
      description: The PID of the process.
      type: String
    - contextPath: Process.Path
      description: The file system path to the binary file.
      type: String
    - contextPath: Process.Start Time
      description: The timestamp of the process start time.
      type: String
    - contextPath: Process.CommandLine
      description: The full command line (including arguments).
      type: String
    - contextPath: Process.is_malicious
      description: Whether the artifact is malicious, as decided by the Wildfire verdict.
      type: boolean
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.Geo.Country
      description: 'The country in which the IP address is located.'
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
  - arguments:
    - description: XDR incident ID. You can get the incident ID from the output of the 'xdr-get-incidents' command or the 'xdr-get-incident-extra-details' command.
      name: incident_id
      required: true
    - auto: PREDEFINED
      description: Severity to assign to the incident.
      name: manual_severity
      predefined:
      - HIGH
      - MEDIUM
      - LOW
    - description: Email address of the user to assign to the incident.
      name: assigned_user_mail
    - auto: PREDEFINED
      description: 'Status of the incident.'
      name: status
      predefined:
      - NEW
      - UNDER_INVESTIGATION
      - RESOLVED_KNOWN_ISSUE
      - RESOLVED_DUPLICATE
      - RESOLVED_FALSE_POSITIVE
      - RESOLVED_TRUE_POSITIVE
      - RESOLVED_SECURITY_TESTING
      - RESOLVED_OTHER
    - description: Comment explaining why the incident was resolved. This should be set when the incident is resolved.
      name: resolve_comment
    - auto: PREDEFINED
      description: If true, will remove all assigned users from the incident.
      name: unassign_user
      predefined:
      - 'true'
      - 'false'
    - description: Add a comment to the incident.
      name: add_comment
    - auto: PREDEFINED
      description: Whether to resolve alerts related to a resolved incident. The incident is considered resolved when the status argument includes the "RESOLVED" or "resolve_comment" value.
      name: resolve_alerts
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
    description: This command is deprecated please use xdr-case-update instead. Updates one or more fields of a specified incident. Missing fields will be ignored. To remove the assignment for an incident, pass a null value in the assignee email argument.
    name: xdr-update-incident
    deprecated: true
  - arguments:
    - description: Product name.
      name: product
      required: true
    - description: Vendor name.
      name: vendor
      required: true
    - description: Source IP address.
      name: local_ip
    - description: Source port.
      name: local_port
      required: true
    - description: |-
        Destination IP address.
      name: remote_ip
      required: true
    - description: |-
        Destination port.
      name: remote_port
      required: true
    - description: The time the alert occurred in milliseconds, or a date in the format 2019-10-23T10:00:00. If not set, the event time will be defined as now.
      name: event_timestamp
    - auto: PREDEFINED
      defaultValue: Medium
      description: |-
        The alert severity.
      name: severity
      predefined:
      - Informational
      - Low
      - Medium
      - High
    - description: The alert name.
      name: alert_name
      required: true
    - description: The alert description.
      name: alert_description
    description: |-
      This command is deprecated. Uploads an alert from external alert sources in Cortex XDR format. Cortex XDR displays alerts that are parsed
      successfully in related incidents and views. You can send 600 alerts per minute. Each request can contain a
      maximum of 60 alerts.
    name: xdr-insert-parsed-alert
    deprecated: true
  - arguments:
    - description: List of alerts in CEF format.
      isArray: true
      name: cef_alerts
      required: true
    description: This command is deprecated. Upload alerts in CEF format from external alert sources. After you map CEF alert fields to Cortex XDR fields, Cortex XDR displays the alerts in related incidents and views. You can send 600 requests per minute. Each request can contain a maximum of 60 alerts.
    name: xdr-insert-cef-alerts
    deprecated: true
  - arguments:
    - description: The incident ID. Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: The endpoint ID to isolate. You can retrieve the string from the xdr-get-endpoints command.
      name: endpoint_id
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to suppress an error when trying to isolate a disconnected endpoint. When set to false, an error will be returned.
      name: suppress_disconnected_endpoint_error
      predefined:
      - 'true'
      - 'false'
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Isolates the specified endpoint.
    execution: true
    name: xdr-endpoint-isolate
    outputs:
    - contextPath: PaloAltoNetworksXDR.Isolation.endpoint_id
      description: The endpoint ID.
      type: String
    polling: true
    compliantpolicies:
    - EndPoint Isolation
  - arguments:
    - description: The incident ID. Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: The endpoint ID to isolate. You can retrieve the string from the xdr-get-endpoints command.
      name: endpoint_id
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to suppress an error when trying to isolate a disconnected endpoint. When set to false, an error will be returned.
      name: suppress_disconnected_endpoint_error
      predefined:
      - 'true'
      - 'false'
    deprecated: true
    description: Deprecated. Use `xdr-endpoint-isolate` instead.
    execution: true
    name: xdr-isolate-endpoint
    outputs:
    - contextPath: PaloAltoNetworksXDR.Isolation.endpoint_id
      description: The endpoint ID.
      type: String
  - arguments:
    - description: The incident ID. Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: The endpoint ID for which to reverse the isolation. You can retrieve it from the xdr-get-endpoints command.
      name: endpoint_id
      required: true
    - description: |-
        Whether to suppress an error when trying to unisolate a disconnected endpoint. When set to false, an error will be returned.
      name: suppress_disconnected_endpoint_error
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    - description: |-
        Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: |-
        The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Reverses the isolation of an endpoint.
    execution: true
    name: xdr-endpoint-unisolate
    outputs:
    - contextPath: PaloAltoNetworksXDR.UnIsolation.endpoint_id
      description: Isolates the specified endpoint.
      type: String
    polling: true
  - deprecated: true
    description: Deprecated. Use `xdr-endpoint-unisolate` instead.
    execution: true
    name: xdr-unisolate-endpoint
    outputs:
    - contextPath: PaloAltoNetworksXDR.UnIsolation.endpoint_id
      description: Isolates the specified endpoint.
      type: String
    arguments:
    - description: The incident ID. Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: The endpoint ID for which to reverse the isolation. You can retrieve it from the xdr-get-endpoints command.
      name: endpoint_id
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to suppress an error when trying to unisolate a disconnected endpoint. When set to false, an error will be returned.
      name: suppress_disconnected_endpoint_error
      predefined:
      - 'true'
      - 'false'
  - arguments:
    - description: 'A comma-separated list of endpoints statuses to filter. Valid values are: connected, disconnected, lost, uninstalled, windows, linux, macos, android, isolated, unisolated.'
      name: status
      isArray: true
    - description: A comma-separated list of endpoint IDs.
      isArray: true
      name: endpoint_id_list
    - description: |-
        A comma-separated list of distribution package names or installation package names.
        Example: dist_name1,dist_name2.
      isArray: true
      name: dist_name
    - description: |-
        A comma-separated list of private IP addresses.
        Example: 10.1.1.1,192.168.1.1.
      isArray: true
      name: ip_list
    - description: |-
        A comma-separated list of public IP addresses that correlate to the last IPv4 address from which the Cortex XDR agent connected (know as `Last Origin IP`).
        Example: 8.8.8.8,1.1.1.1.
      isArray: true
      name: public_ip_list
    - description: |-
        The group name to which the agent belongs.
        Example: group_name1,group_name2.
      isArray: true
      name: group_name
    - description: 'The endpoint platform.'
      isArray: true
      name: platform
      auto: PREDEFINED
      predefined:
      - windows
      - linux
      - macos
      - android
    - description: |-
        A comma-separated list of alias names.
        Examples: alias_name1,alias_name2.
      name: alias_name
      isArray: true
    - description: |-
        Specifies whether the endpoint was isolated or unisolated.
      name: isolate
      auto: PREDEFINED
      predefined:
      - isolated
      - unisolated
    - description: |-
        Hostname
        Example: hostname1,hostname2.
      name: hostname
      isArray: true
    - description: |-
        Include agents that were first seen on and after this date.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: first_seen_gte
    - description: |-
        Include agents that were first seen on and before this date.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: first_seen_lte
    - description: |-
        Include agents that were last seen on and after this date.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: last_seen_gte
    - description: |-
        All the agents that were last seen before {last_seen_lte}.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: last_seen_lte
    - defaultValue: '0'
      description: Page number (for pagination). 0 is the first page.
      name: page
    - description: Maximum number of endpoints to return per page. The default and maximum is 30.
      name: limit
      defaultValue: '30'
    - auto: PREDEFINED
      description: Specifies whether to sort endpoints by the first time or last time they were seen.
      name: sort_by
      predefined:
      - first_seen
      - last_seen
    - name: sort_order
      description: The order by which to sort results. Can be "asc" (ascending) or "desc" (descending).
      auto: PREDEFINED
      defaultValue: asc
      predefined:
      - asc
      - desc
    - name: username
      description: The usernames to query for. Accepts a single user, or comma-separated list of usernames.
      isArray: true
    - auto: PREDEFINED
      defaultValue: "false"
      description: Whether to return all endpoints. If true, will override the 'limit' and 'page' arguments.
      name: all_results
      predefined:
      - "false"
      - "true"
    - auto: PREDEFINED
      defaultValue: "false"
      description: Whether to return timestamp or date string values.
      name: convert_timestamp_to_datestring
      predefined:
      - "false"
      - "true"
    description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set. (Start by counting from 0).
    name: xdr-get-endpoints
    outputs:
    - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_id
      description: The endpoint ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_name
      description: The endpoint name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_type
      description: The endpoint type.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_status
      description: The status of the endpoint.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.os_type
      description: The endpoint operating type.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.ip
      description: A list of IP addresses.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Endpoint.users
      description: A list of users.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Endpoint.domain
      description: The endpoint domain.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.alias
      description: The endpoint aliases.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.first_seen
      description: First seen date/time in epoch (milliseconds).
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Endpoint.last_seen
      description: Last seen date/time in epoch (milliseconds).
      type: Date
    - contextPath: PaloAltoNetworksXDR.Endpoint.content_version
      description: Content version.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.installation_package
      description: Installation package.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.active_directory
      description: Active directory.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.install_date
      description: Install date in epoch (milliseconds).
      type: Date
    - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_version
      description: Endpoint version.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.is_isolated
      description: Whether the endpoint is isolated.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.group_name
      description: The name of the group to which the endpoint belongs.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.count
      description: Number of endpoints returned.
      type: String
    - contextPath: Endpoint.Hostname
      description: The hostname that is mapped to this endpoint.
      type: String
    - contextPath: Endpoint.ID
      description: The unique ID within the tool retrieving the endpoint.
      type: String
    - contextPath: Endpoint.IPAddress
      description: The IP address of the endpoint.
      type: String
    - contextPath: Endpoint.Domain
      description: The domain of the endpoint.
      type: String
    - contextPath: Endpoint.OS
      description: The endpoint's operating system.
      type: String
    - contextPath: Account.Username
      description: The username in the relevant system.
      type: String
    - contextPath: Account.Domain
      description: The domain of the account.
      type: String
    - contextPath: Endpoint.Status
      description: The endpoint's status.
      type: String
    - contextPath: Endpoint.IsIsolated
      description: The endpoint's isolation status.
      type: String
    - contextPath: Endpoint.MACAddress
      description: The endpoint's MAC address.
      type: String
    - contextPath: Endpoint.Vendor
      description: The integration name of the endpoint vendor.
      type: String
  - arguments:
    - description: The status of the endpoint to use as a filter.
      name: status
      auto: PREDEFINED
      predefined:
      - connected
      - disconnected
    - description: A comma-separated list of endpoint IDs to use as a filter.
      isArray: true
      name: endpoint_id_list
    - description: |-
        A comma-separated list of distribution package names or installation package names to use as a filter.
        Example: dist_name1,dist_name2.
      isArray: true
      name: dist_name
    - description: |-
        A comma-separated list of IP addresses to use as a filter.
        Example: 8.8.8.8,1.1.1.1.
      isArray: true
      name: ip_list
    - description: A comma-separated list of group names to which the agent belongs to use as a filter.
      isArray: true
      name: group_name
    - description: The endpoint platform to use as a filter.
      isArray: true
      name: platform
      auto: PREDEFINED
      predefined:
      - windows
      - linux
      - macos
      - android
    - description: |-
        A comma-separated list of alias names to use as a filter.
        Examples: alias_name1,alias_name2.
      isArray: true
      name: alias_name
    - auto: PREDEFINED
      description: Specifies whether the endpoint was isolated or unisolated to use as a filter.
      name: isolate
      predefined:
      - isolated
      - unisolated
    - description: A comma-separated list of hostnames to use as a filter.
      isArray: true
      name: hostname
    - description: |-
        Include agents that were first seen on and after this date.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: first_seen_gte
    - description: |-
        Include agents that were first seen on and before this date.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: first_seen_lte
    - description: |-
        Include agents that were last seen on and after this date.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: last_seen_gte
    - description: |-
        Include agents that were last seen on and before this date.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: last_seen_lte
    - name: username
      description: The usernames to use as a filter. Accepts a single user, or comma-separated list of usernames.
      isArray: true
    - name: new_alias_name
      required: true
      description: |-
        The alias name to change to.
        Note: If you send an empty field, (e.g., new_alias_name=\"\") the current alias name is deleted.
    - name: scan_status
      description: The scan status of the endpoint to use as a filter.
      auto: PREDEFINED
      predefined:
      - none
      - pending
      - in_progress
      - canceled
      - aborted
      - pending_cancellation
      - success
      - error
    description: Gets a list of endpoints according to the passed filters, and changes their alias name. Filtering by multiple fields will be concatenated using the AND condition (OR is not supported).
    name: xdr-endpoint-alias-change
  - description: Gets a list of all the agent versions to use for creating a distribution list.
    name: xdr-get-distribution-versions
    outputs:
    - contextPath: PaloAltoNetworksXDR.DistributionVersions.windows
      description: A list of Windows agent versions.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.DistributionVersions.linux
      description: A list of Linux agent versions.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.DistributionVersions.macos
      description: A list of Mac agent versions.
      type: Unknown
    arguments: []
  - arguments:
    - description: The name of the installation package.
      name: name
      required: true
    - auto: PREDEFINED
      description: "The platform type."
      name: platform
      predefined:
      - windows
      - linux
      - macos
      - android
      required: true
    - auto: PREDEFINED
      description: |-
        The type of package to create.
        standalone - An installation for a new agent.
        upgrade - An upgrade of an agent from ESM.
      name: package_type
      predefined:
      - standalone
      - upgrade
      required: true
    - description: Agent version returned from xdr-get-distribution-versions. Not required for an Android platform.
      name: agent_version
      required: true
    - description: Information about the package.
      name: description
    description: Creates an installation package. This is an asynchronous call that returns the distribution ID. This does not mean that the creation succeeded. To confirm that the package has been created, check the status of the distribution by running the Get Distribution Status API.
    name: xdr-create-distribution
    outputs:
    - contextPath: PaloAltoNetworksXDR.Distribution.id
      description: The installation package ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.Distribution.name
      description: The name of the installation package.
      type: String
    - contextPath: PaloAltoNetworksXDR.Distribution.platform
      description: The installation operating system.
      type: String
    - contextPath: PaloAltoNetworksXDR.Distribution.agent_version
      description: Agent version.
      type: String
    - contextPath: PaloAltoNetworksXDR.Distribution.description
      description: Description of the package.
      type: String
  - arguments:
    - description: |-
        The ID of the installation package.
        Copy the distribution ID from the "id" field on the Endpoints > Agent Installation page.
      name: distribution_id
      required: true
    - auto: PREDEFINED
      description: |-
        The installation package type. Valid
        values are:
        • upgrade
        • sh - For Linux
        • rpm - For Linux
        • deb - For Linux
        • pkg - For Mac
        • x86 - For Windows
        • x64 - For Windows.
      name: package_type
      predefined:
      - upgrade
      - sh
      - rpm
      - deb
      - pkg
      - x86
      - x64
      required: true
    - name: download_package
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Supported only for package_type x64 or x86. Whether to actually download the installation package file.
      defaultValue: "false"
    description: Gets the distribution URL for downloading the installation package.
    name: xdr-get-distribution-url
    outputs:
    - contextPath: PaloAltoNetworksXDR.Distribution.id
      description: Distribution ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.Distribution.url
      description: URL for downloading the installation package.
      type: String
  - arguments:
    - description: A comma-separated list of distribution IDs to get the status for.
      isArray: true
      name: distribution_ids
      required: true
    description: Gets the status of the installation package.
    name: xdr-get-create-distribution-status
    outputs:
    - contextPath: PaloAltoNetworksXDR.Distribution.id
      description: Distribution ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.Distribution.status
      description: The status of the installation package.
      type: String
  - arguments:
    - description: "User's email address."
      name: email
    - description: The audit log type.
      name: type
      auto: PREDEFINED
      predefined:
      - LIVE_TERMINAL
      - RULES
      - AUTH
      - RESPONSE
      - INCIDENT_MANAGEMENT
      - ENDPOINT_MANAGEMENT
      - ALERT_WHITELIST
      - PUBLIC_API
      - DISTRIBUTIONS
      - STARRED_INCIDENTS
      - POLICY_PROFILES
      - DEVICE_CONTROL_PROFILE
      - HOST_FIREWALL_PROFILE
      - POLICY_RULES
      - PROTECTION_POLICY
      - DEVICE_CONTROL_TEMP_EXCEPTIONS
      - DEVICE_CONTROL_GLOBAL_EXCEPTIONS
      - GLOBAL_EXCEPTIONS
      - MSSP
      - REPORTING
      - DASHBOARD
      - BROKER_VM
    - description: The audit log subtype.
      name: sub_type
    - auto: PREDEFINED
      description: Result type.
      name: result
      predefined:
      - SUCCESS
      - FAIL
      - PARTIAL
    - description: |-
        Return logs for which the timestamp is after 'log_time_after'.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: timestamp_gte
    - description: |-
        Return logs for which the timestamp is before the 'log_time_after'.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: timestamp_lte
    - defaultValue: '0'
      description: Page number (for pagination). 0 is the first page.
      name: page
    - defaultValue: '30'
      description: Maximum number of audit logs to return per page. The default and maximum is 30.
      name: limit
    - auto: PREDEFINED
      description: Specifies the field by which to sort the results. By default the sort is defined as creation-time and DESC.
      name: sort_by
      predefined:
      - type
      - sub_type
      - result
      - timestamp
    - auto: PREDEFINED
      defaultValue: desc
      description: The sort order. Can be "asc" (ascending) or "desc" (descending).
      name: sort_order
      predefined:
      - asc
      - desc
    description: Gets management logs. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of management logs from the start of the result set (start by counting from 0).
    name: xdr-get-audit-management-logs
    outputs:
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ID
      description: Audit log ID.
      type: Number
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_OWNER_NAME
      description: Audit owner name.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_OWNER_EMAIL
      description: Audit owner email address.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ASSET_JSON
      description: Asset JSON.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ASSET_NAMES
      description: Audit asset names.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_HOSTNAME
      description: Hostname.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_RESULT
      description: Audit result.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_REASON
      description: Audit reason.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_DESCRIPTION
      description: Description of the audit.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ENTITY
      description: Audit entity (e.g., AUTH, DISTRIBUTIONS).
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ENTITY_SUBTYPE
      description: Entity subtype (e.g., Login, Create).
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_CASE_ID
      description: Audit case ID.
      type: Number
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_INSERT_TIME
      description: Log's insert time.
      type: Date
  - arguments:
    - description: A comma-separated list of endpoint IDs.
      isArray: true
      name: endpoint_ids
    - description: A comma-separated list of endpoint names.
      isArray: true
      name: endpoint_names
    - description: The report type.
      isArray: true
      name: type
      auto: PREDEFINED
      predefined:
      - Installation
      - Policy
      - Action
      - Agent Service
      - Agent Modules
      - Agent Status
    - auto: PREDEFINED
      description: The report subtype.
      isArray: true
      name: sub_type
      predefined:
      - Install
      - Uninstall
      - Upgrade
      - Local Configuration
      - Content Update
      - Policy Update
      - Process Exception
      - Hash Exception
      - Scan
      - File Retrieval
      - File Scan
      - Terminate Process
      - Isolate
      - Cancel Isolation
      - Payload Execution
      - Quarantine
      - Restore
      - Stop
      - Start
      - Module Initialization
      - Local Analysis Model
      - Local Analysis Feature Extraction
      - Fully Protected
      - OS Incompatible
      - Software Incompatible
      - Kernel Driver Initialization
      - Kernel Extension Initialization
      - Proxy Communication
      - Quota Exceeded
      - Minimal Content
      - Reboot Required
      - Missing Disc Access
    - auto: PREDEFINED
      description: The result type. Can be "Success" or "Fail". If not passed, returns all event reports.
      isArray: true
      name: result
      predefined:
      - Success
      - Fail
    - description: |-
        Return logs for which the timestamp is greater than 'log_time_after'.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: timestamp_gte
    - description: |-
        Return logs for which the timestamp is before the 'timestamp_lte'.

        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: timestamp_lte
    - defaultValue: '0'
      description: Page number (for pagination). 0 is the first page.
      name: page
    - defaultValue: '30'
      description: The maximum number of reports to return. Default and maximum is 30.
      name: limit
    - auto: PREDEFINED
      description: The field by which to sort results.
      name: sort_by
      predefined:
      - type
      - category
      - trapsversion
      - timestamp
      - domain
    - auto: PREDEFINED
      defaultValue: asc
      description: The sort order. Can be "asc" (ascending) or "desc" (descending).
      name: sort_order
      predefined:
      - asc
      - desc
    description: Gets agent event reports. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of reports from the start of the result set (start by counting from 0).
    name: xdr-get-audit-agent-reports
    outputs:
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.ENDPOINTID
      description: Endpoint ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.ENDPOINTNAME
      description: Endpoint name.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.DOMAIN
      description: Agent domain.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.TRAPSVERSION
      description: Traps version.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.RECEIVEDTIME
      description: Received time in epoch time.
      type: Date
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.TIMESTAMP
      description: Timestamp in epoch time.
      type: Date
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.CATEGORY
      description: Report category (e.g., Audit).
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.TYPE
      description: Report type (e.g., Action, Policy).
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.SUBTYPE
      description: Report subtype (e.g., Fully Protected,Policy Update,Cancel Isolation).
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.RESULT
      description: Report result.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.REASON
      description: Report reason.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.DESCRIPTION
      description: Description of the agent report.
      type: String
    - contextPath: Endpoint.ID
      description: The unique ID within the tool retrieving the endpoint.
      type: String
    - contextPath: Endpoint.Hostname
      description: The hostname that is mapped to this endpoint.
      type: String
    - contextPath: Endpoint.Domain
      description: The domain of the endpoint.
      type: String
  - arguments:
    - description: Links the response action to the triggered incident.
      name: incident_id
    - description: String that represents a list of hashed files you want to add to the block list. Must be a valid SHA256 hash.
      isArray: true
      name: hash_list
      required: true
    - description: String that represents additional information regarding the action.
      name: comment
    - description: Whether to retrieve a regular response or detailed response. False = regular response. True = detailed response.
      name: detailed_response
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    description: Block lists requested files which have not already been block listed or added to allow lists.
    name: xdr-blocklist-files
    outputs:
    - contextPath: PaloAltoNetworksXDR.blocklist.added_hashes
      description: Number of file hashes added to the block list.
      type: Number
    - contextPath: PaloAltoNetworksXDR.blocklist.excluded_hashes
      description: Number of file hashes excluded from the block list.
      type: Number
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: String that represents a list of hashed files you want to add to the block list. Must be a valid SHA256 hash.
      isArray: true
      name: hash_list
      required: true
    - description: String that represents additional information regarding the action.
      name: comment
    deprecated: true
    description: Deprecated. Use `xdr-blocklist-files` instead.
    name: xdr-blacklist-files
  - arguments:
    - description: Links the response action to the triggered incident.
      name: incident_id
    - description: String that represents a list of hashed files you want to add to allow lists. Must be a valid SHA256 hash.
      isArray: true
      name: hash_list
      required: true
    - description: String that represents additional information regarding the action.
      name: comment
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to retrieve a regular response or detailed response. False = regular response. True = detailed response.
      name: detailed_response
      predefined:
      - 'true'
      - 'false'
    description: Adds requested files to the allow list if they are not already on the block list or allow list.
    name: xdr-allowlist-files
    outputs:
    - contextPath: PaloAltoNetworksXDR.allowlist.added_hashes
      description: Number of added file hashes to allow list.
      type: Number
    - contextPath: PaloAltoNetworksXDR.allowlist.excluded_hashes
      description: Number of excluded file hashes from allow list.
      type: Number
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: String that represents a list of hashed files you want to add to the allow list. Must be a valid SHA256 hash.
      isArray: true
      name: hash_list
      required: true
    - description: String that represents additional information regarding the action.
      name: comment
    deprecated: true
    description: Deprecated. Use `xdr-allowlist-files` instead.
    name: xdr-whitelist-files
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: List of endpoint IDs.
      isArray: true
      name: endpoint_id_list
      required: true
    - description: String that represents the path of the file you want to quarantine.
      name: file_path
      required: true
    - description: String that represents the file's hash. Must be a valid SHA256 hash.
      name: file_hash
      required: true
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Quarantines a file on selected endpoints. You can select up to 1000 endpoints.
    name: xdr-file-quarantine
    polling: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
  - deprecated: true
    description: Deprecated. Use `xdr-file-quarantine` instead.
    name: xdr-quarantine-files
    arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: List of endpoint IDs.
      isArray: true
      name: endpoint_id_list
      required: true
    - description: String that represents the path of the file you want to quarantine.
      name: file_path
      required: true
    - description: String that represents the file's hash. Must be a valid SHA256 hash.
      name: file_hash
      required: true
  - arguments:
    - description: String that represents the endpoint ID.
      name: endpoint_id
      required: true
    - description: String that represents the file hash. Must be a valid SHA256 hash.
      name: file_hash
      required: true
    - description: String that represents the file path.
      name: file_path
      required: true
    description: Retrieves the quarantine status for a selected file.
    name: xdr-get-quarantine-status
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: The hash code of the file. Must be a valid SHA256 hash.
      name: file_hash
      required: true
    - description: String that represents the endpoint ID. If you do not enter a specific endpoint ID, the request will run restore on all endpoints that relate to the quarantined file you defined.
      name: endpoint_id
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Restores a quarantined file on requested endpoints.
    name: xdr-file-restore
    polling: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
  - arguments:
    - description: Allows to link the response action to the incident that triggered it.
      name: incident_id
    - description: The hash code of the file. Must be a valid SHA256 hash.
      name: file_hash
      required: true
    - description: The endpoint ID. If you do not enter a specific endpoint ID, the request will run restore on all endpoints that relate to the quarantined file you defined.
      name: endpoint_id
    deprecated: true
    description: Deprecated. Use `xdr-file-restore` instead.
    name: xdr-restore-file
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: List of endpoint IDs.
      isArray: true
      name: endpoint_id_list
    - description: Name of the distribution list.
      isArray: true
      name: dist_name
    - description: Greater than or equal to first seen timestamp in milliseconds.
      name: gte_first_seen
    - description: Greater than or equal to last seen timestamp in milliseconds.
      name: gte_last_seen
    - description: Less than or equal to first seen timestamp in milliseconds.
      name: lte_first_seen
    - description: Less than or equal to last seen timestamp in milliseconds.
      name: lte_last_seen
    - description: List of IP addresses.
      isArray: true
      name: ip_list
    - description: Name of the endpoint group.
      isArray: true
      name: group_name
    - auto: PREDEFINED
      description: Type of operating system.
      isArray: true
      name: platform
      predefined:
      - windows
      - linux
      - macos
      - android
    - description: Endpoint alias name.
      isArray: true
      name: alias
    - auto: PREDEFINED
      description: Whether an endpoint has been isolated.
      name: isolate
      predefined:
      - isolated
      - unisolated
    - description: Name of the host.
      isArray: true
      name: hostname
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to scan all of the endpoints. Scanning all of the endpoints may cause performance issues and latency.
      name: all
      predefined:
      - 'true'
      - 'false'
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    description: 'Runs a scan on a selected endpoint. To scan all endpoints, run this command with argument all=true. Note: Scanning all the endpoints may cause performance issues and latency.'
    execution: true
    name: xdr-endpoint-scan-execute
    outputs:
    - contextPath: PaloAltoNetworksXDR.endpointScan.actionId
      description: The action ID of the scan request.
      type: Number
    - contextPath: PaloAltoNetworksXDR.endpointScan.aborted
      description: Was the scan aborted?
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
    polling: true
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: List of endpoint IDs.
      isArray: true
      name: endpoint_id_list
    - description: Name of the distribution list.
      isArray: true
      name: dist_name
    - description: Greater than or equal to first seen timestamp in milliseconds.
      name: gte_first_seen
    - description: Greater than or equal to last seen timestamp in milliseconds.
      name: gte_last_seen
    - description: Less than or equal to first seen timestamp in milliseconds.
      name: lte_first_seen
    - description: Less than or equal to last seen timestamp in milliseconds.
      name: lte_last_seen
    - description: List of IP addresses.
      isArray: true
      name: ip_list
    - description: Name of the endpoint group.
      isArray: true
      name: group_name
    - auto: PREDEFINED
      description: Type of operating system.
      isArray: true
      name: platform
      predefined:
      - windows
      - linux
      - macos
      - android
    - description: Endpoint alias name.
      isArray: true
      name: alias
    - auto: PREDEFINED
      description: Whether an endpoint has been isolated.
      name: isolate
      predefined:
      - isolated
      - unisolated
    - description: Name of the host.
      isArray: true
      name: hostname
    - auto: PREDEFINED
      defaultValue: 'false'
      description: 'Whether to scan all of the endpoints. Note: Scanning all of the endpoints may cause performance issues and latency.'
      name: all
      predefined:
      - 'true'
      - 'false'
    deprecated: true
    description: Deprecated. Use `xdr-endpoint-scan-execute` instead.
    execution: true
    name: xdr-endpoint-scan
    outputs:
    - contextPath: PaloAltoNetworksXDR.endpointScan.actionId
      description: The action ID of the scan request.
      type: Number
    - contextPath: PaloAltoNetworksXDR.endpointScan.aborted
      description: Was the scan aborted?
      type: Boolean
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: List of endpoint IDs.
      isArray: true
      name: endpoint_id_list
    - description: Name of the distribution list.
      isArray: true
      name: dist_name
    - description: Greater than or equal to first seen timestamp in milliseconds.
      name: gte_first_seen
    - description: Greater than or equal to last seen timestamp in milliseconds.
      name: gte_last_seen
    - description: Less than or equal to first seen timestamp in milliseconds.
      name: lte_first_seen
    - description: Less than or equal to last seen timestamp in milliseconds.
      name: lte_last_seen
    - description: List of IP addresses.
      isArray: true
      name: ip_list
    - description: Name of the endpoint group.
      isArray: true
      name: group_name
    - description: Type of operating system.
      isArray: true
      name: platform
      auto: PREDEFINED
      predefined:
      - windows
      - linux
      - macos
      - android
    - description: Endpoint alias name.
      isArray: true
      name: alias
    - description: Whether an endpoint has been isolated.
      name: isolate
      auto: PREDEFINED
      predefined:
      - isolated
      - unisolated
    - description: Name of the host.
      isArray: true
      name: hostname
    - auto: PREDEFINED
      defaultValue: 'false'
      description: 'Whether to scan all of the endpoints. Note: Scanning all of the endpoints may cause performance issues and latency.'
      name: all
      predefined:
      - 'true'
      - 'false'
    description: Cancels the scan of selected endpoints. A scan can only be aborted if the selected endpoints are Pending or In Progress. To scan all endpoints, run the command with the argument all=true. Note that scanning all of the endpoints may cause performance issues and latency.
    execution: true
    name: xdr-endpoint-scan-abort
    outputs:
    - contextPath: PaloAltoNetworksXDR.endpointScan.actionId
      description: The action ID of the abort scan request.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.endpointScan.aborted
      description: Was the scan aborted?
      type: Boolean
  - description: "Gets mapping fields from remote incident. Note: This method will not update the current incident. It's here for debugging purposes."
    name: get-mapping-fields
    arguments: []
  - arguments:
    - description: The remote incident ID.
      name: id
      required: true
    - defaultValue: '0'
      description: UTC timestamp in seconds. The incident is only updated if it was modified after the last update time.
      name: lastUpdate
    description: "Gets remote data from a remote incident. Note: This method will not update the current incident. It's here for debugging purposes."
    name: get-remote-data
  - arguments:
    - description: "Date string representing the local date time in the ISO 8601 format (for example: 2019-10-23T10:00:00). The incident is only returned if it was modified after the last update time."
      name: lastUpdate
    description: 'Gets the list of incidents that were modified since the last update. Note: This method is here for debugging purposes. get-modified-remote-data is used as part of a Mirroring feature, which is available since version 6.1.'
    name: get-modified-remote-data
  - arguments:
    - description: The endpoint ID. Can be retrieved by running the xdr-get-endpoints command.
      name: endpoint_id
      required: true
    description: Gets the policy name for a specific endpoint.
    name: xdr-get-policy
    outputs:
    - contextPath: PaloAltoNetworksXDR.Policy
      description: The policy allocated with the endpoint.
      type: string
    - contextPath: PaloAltoNetworksXDR.Policy.policy_name
      description: Name of the policy allocated with the endpoint.
      type: string
    - contextPath: PaloAltoNetworksXDR.Policy.endpoint_id
      description: Endpoint ID.
      type: string
  - arguments:
    - description: A comma-separated list of the script names.
      isArray: true
      name: script_name
    - description: A comma-separated list of the script descriptions.
      isArray: true
      name: description
    - description: A comma-separated list of the users who created the script.
      isArray: true
      name: created_by
    - description: The maximum number of scripts returned to the War Room.
      name: limit
    - description: (Int) Offset in the data set.
      name: offset
    - auto: PREDEFINED
      description: Whether the script can be executed on a Windows operating system.
      name: windows_supported
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Whether the script can be executed on a Linux operating system.
      name: linux_supported
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Whether the script can be executed on a Mac operating system.
      name: macos_supported
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Whether the script has a high-risk outcome.
      name: is_high_risk
      predefined:
      - 'true'
      - 'false'
    description: Gets a list of scripts available in the scripts library.
    name: xdr-get-scripts
    outputs:
    - contextPath: PaloAltoNetworksXDR.Scripts
      description: The scripts command results.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Scripts.script_id
      description: Script ID.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Scripts.name
      description: Name of the script.
      type: string
    - contextPath: PaloAltoNetworksXDR.Scripts.description
      description: Description of the script.
      type: string
    - contextPath: PaloAltoNetworksXDR.Scripts.modification_date
      description: Timestamp of when the script was last modified.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Scripts.created_by
      description: Name of the user who created the script.
      type: string
    - contextPath: PaloAltoNetworksXDR.Scripts.windows_supported
      description: Whether the script can be executed on a Windows operating system.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Scripts.linux_supported
      description: Whether the script can be executed on a Linux operating system.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Scripts.macos_supported
      description: Whether the script can be executed on Mac operating system.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Scripts.is_high_risk
      description: Whether the script has a high-risk outcome.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Scripts.script_uid
      description: Globally Unique Identifier of the script, used to identify the script when executing.
      type: string
  - arguments:
    - description: A comma-separated list of endpoint IDs. You can retrieve the endpoint IDs from the xdr-get-endpoints command.
      name: endpoint_ids
      required: true
    description: Deletes selected endpoints in the Cortex XDR app. You can delete up to 1000 endpoints.
    name: xdr-delete-endpoints
  - arguments:
    - description: A comma-separated list of endpoint IDs. You can retrieve the endpoint IDs from the xdr-get-endpoints command.
      isArray: true
      name: endpoint_ids
    - description: 'Type of violation.'
      name: type
      auto: PREDEFINED
      predefined:
      - cd-rom
      - disk drive
      - floppy disk
      - portable device
    - description: 'Timestamp of the violation. Violations that are greater than or equal to this timestamp will be returned. Values can be in either ISO date format, relative time, or epoch timestamp. For example:  "2019-10-21T23:45:00" (ISO date format), "3 days ago" (relative time) 1579039377301 (epoch time).'
      name: timestamp_gte
    - description: 'Timestamp of the violation. Violations that are less than or equal to this timestamp will be returned. Values can be in either ISO date format, relative time, or epoch timestamp. For example:  "2019-10-21T23:45:00" (ISO date format), "3 days ago" (relative time) 1579039377301 (epoch time).'
      name: timestamp_lte
    - description: A comma-separated list of IP addresses.
      isArray: true
      name: ip_list
    - description: Name of the vendor.
      isArray: true
      name: vendor
    - description: Vendor ID.
      isArray: true
      name: vendor_id
    - description: Name of the product.
      isArray: true
      name: product
    - description: Product ID.
      isArray: true
      name: product_id
    - description: Serial number.
      isArray: true
      name: serial
    - description: Hostname.
      isArray: true
      name: hostname
    - description: A comma-separated list of violation IDs.
      isArray: true
      name: violation_id_list
    - description: Username.
      isArray: true
      name: username
    description: Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.
    name: xdr-get-endpoint-device-control-violations
    outputs:
    - contextPath: PaloAltoNetworksXDR.EndpointViolations
      description: Endpoint violations command results.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations
      description: A list of violations.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.os_type
      description: Type of the operating system.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.hostname
      description: Hostname of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.username
      description: Username of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.ip
      description: IP address of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.timestamp
      description: Timestamp of the violation.
      type: number
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.violation_id
      description: Violation ID.
      type: number
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.type
      description: Type of violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.vendor_id
      description: Vendor ID of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.vendor
      description: Name of the vendor of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.product_id
      description: Product ID of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.product
      description: Name of the product of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.serial
      description: Serial number of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.endpoint_id
      description: Endpoint ID of the violation.
      type: string
  - arguments:
    - description: Allows to link the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs.
      isArray: true
      name: endpoint_ids
      required: true
    - description: A comma-separated list of file paths on the Windows platform.
      isArray: true
      name: windows_file_paths
    - description: A comma-separated list of file paths on the Linux platform.
      isArray: true
      name: linux_file_paths
    - description: A comma-separated list of file paths on the Mac platform.
      isArray: true
      name: mac_file_paths
    - description: A comma-separated list of file paths in any platform. Can be used instead of the mac/windows/linux file paths. The order of the files path list must be parallel to the endpoints list order, so the first file path in the list is related to the first endpoint and so on.
      isArray: true
      name: generic_file_path
    - description: 'The delimiter used to separate multiple file paths. Set to a different character (for example, ";") when a file path contains a comma.'
      name: paths_separator
      defaultValue: ','
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Retrieves files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. At least one endpoint ID and one file path are necessary in order to run the command. After running this command, you can use the xdr-action-status-get command with returned action_id, to check the action status.
    name: xdr-file-retrieve
    outputs:
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.action_id
      description: ID of the action to retrieve files from selected endpoints.
      type: string
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.endpoint_id
      description: Endpoint ID. Added only when the operation is successful.
      type: string
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.file_link
      description: Link to the file. Added only when the operation is successful.
      type: string
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.status
      description: The action status. Added only when the operation is unsuccessful.
      type: string
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
    polling: true
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs.
      isArray: true
      name: endpoint_ids
      required: true
    - description: A comma-separated list of file paths on the Windows platform.
      isArray: true
      name: windows_file_paths
    - description: A comma-separated list of file paths on the Linux platform.
      isArray: true
      name: linux_file_paths
    - description: A comma-separated list of file paths on the Mac platform.
      isArray: true
      name: mac_file_paths
    - description: A comma-separated list of file paths in any platform. Can be used instead of the mac/windows/linux file paths. The order of the files path list must be parallel to the endpoints list order, so the first file path in the list is related to the first endpoint and so on.
      isArray: true
      name: generic_file_path
    deprecated: true
    description: Deprecated. Use `xdr-file-retrieve` instead.
    name: xdr-retrieve-files
    outputs:
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.action_id
      description: ID of the action to retrieve files from selected endpoints.
      type: string
  - arguments:
    - description: Action IDs retrieved from the xdr-retrieve-files command.
      isArray: true
      name: action_id
      required: true
    description: View the file retrieved by the xdr-retrieve-files command according to the action ID. Before running this command, you can use the xdr-action-status-get command to check if this action completed successfully.
    name: xdr-retrieve-file-details
    outputs:
    - contextPath: File
      description: The file details command results.
      type: Unknown
    - contextPath: File.Name
      description: The full file name (including the file extension).
      type: String
    - contextPath: File.EntryID
      description: The ID for locating the file in the War Room.
      type: String
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: Number
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Extension
      description: 'The file extension. For example: "xls".'
      type: String
    - contextPath: File.Type
      description: The file type, as determined by libmagic (same as displayed in file entries).
      type: String
  - arguments:
    - description: Unique identifier of the script, returned by the xdr-get-scripts command.
      name: script_uid
      required: true
    description: Gets the full definition of a specific script in the scripts library.
    name: xdr-get-script-metadata
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata
      description: The script metadata command results.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.script_id
      description: Script ID.
      type: number
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.name
      description: Script name.
      type: string
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.description
      description: Description of the script.
      type: string
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.modification_date
      description: Timestamp of when the script was last modified.
      type: unknown
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.created_by
      description: Name of the user who created the script.
      type: string
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.is_high_risk
      description: Whether the script has a high-risk outcome.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.windows_supported
      description: Whether the script can be executed on a Windows operating system.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.linux_supported
      description: Whether the script can be executed on a Linux operating system.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.macos_supported
      description: Whether the script can be executed on a Mac operating system.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.entry_point
      description: Name of the entry point selected for the script. An empty string indicates the script was defined as just run.
      type: string
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.script_input
      description: Name and type for the specified entry point.
      type: string
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.script_output_type
      description: Type of the output.
      type: string
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.script_output_dictionary_definitions
      description: If the script_output_type is a dictionary, an array with friendly name, name, and type for each output.
      type: Unknown
  - arguments:
    - description: Unique identifier of the script, returned by the xdr-get-scripts command.
      name: script_uid
      required: true
    description: Gets the code of a specific script in the script library.
    name: xdr-get-script-code
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptCode
      description: The script code command results.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.ScriptCode.code
      description: The code of a specific script in the script library.
      type: string
    - contextPath: PaloAltoNetworksXDR.ScriptCode.script_uid
      description: Unique identifier of the script.
      type: string
  - arguments:
    - description: The action IDs of the selected request. After performing an action, you will receive an action ID.
      isArray: true
      name: action_id
      required: true
    description: Retrieves the status of the requested actions according to the action ID.
    name: xdr-action-status-get
    outputs:
    - contextPath: PaloAltoNetworksXDR.GetActionStatus
      description: The action status command results.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.endpoint_id
      description: Endpoint ID.
      type: string
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.status
      description: The status of the specific endpoint ID.
      type: string
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.action_id
      description: The specified action ID.
      type: number
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      name: endpoint_ids
      required: true
    - description: Unique identifier of the script. Can be retrieved by running the xdr-get-scripts command.
      name: script_uid
      required: true
    - description: Dictionary containing the parameter name as key and its value for this execution as the value. For example, {"param1":"param1_value","param2":"param2_value"}.
      name: parameters
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    description: Deprecated. Run xdr-script-run instead.
    name: xdr-run-script
    deprecated: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      name: endpoint_ids
      required: true
    - description: Unique identifier of the script. Can be retrieved by running the xdr-get-scripts command.
      name: script_uid
      required: true
    - description: Dictionary containing the parameter name as key and its value for this execution as the value. For example, {"param1":"param1_value","param2":"param2_value"}.
      name: parameters
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    - description: Interval in seconds between each poll.
      defaultValue: '10'
      name: polling_interval_in_seconds
    - description: Polling timeout in seconds.
      name: polling_timeout_in_seconds
      defaultValue: '600'
    - description: The action ID for polling use.
      name: action_id
      deprecated: true
    - name: hide_polling_output
      deprecated: true
      description: Whether to hide the polling result (automatically filled by polling).
    description: Initiates a new endpoint script execution action using a script from the script library and returns the results.
    name: xdr-script-run
    polling: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptResult.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.retrieved_files
      description: Number of successfully retrieved files.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_ip_address
      description: Endpoint IP address.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_name
      description: Name of successfully retrieved files.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.failed_files
      description: Number of files failed to be retrieved.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_status
      description: Endpoint status.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.domain
      description: Domain to which the endpoint belongs.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_id
      description: Endpoint ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.execution_status
      description: Execution status of this endpoint.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.return_value
      description: Value returned by the script in case the type is not a dictionary.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.standard_output
      description: The STDOUT and the STDERR logged by the script during the execution.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.retention_date
      description: Timestamp in which the retrieved files will be deleted from the server.
      type: Date
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      name: endpoint_ids
      required: true
    - description: Section of a script to initiate on an endpoint (e.g., print("7")).
      name: snippet_code
      required: true
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: Action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Initiates a new endpoint script execution action using the provided snippet code.
    name: xdr-snippet-code-script-execute
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
    polling: true
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: |-
        A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      name: endpoint_ids
      required: true
    - description: |-
        Section of a script you want to initiate on an endpoint (e.g., print("7")).
      name: snippet_code
      required: true
    deprecated: true
    description: Deprecated. Use `xdr-snippet-code-script-execute` instead.
    name: xdr-run-snippet-code-script
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
  - arguments:
    - description: Action IDs retrieved from the xdr-run-script command.
      isArray: true
      name: action_id
      required: true
    description: Retrieves the status of a script execution action.
    name: xdr-get-script-execution-status
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.general_status
      description: General status of the action, considering the status of all the endpoints.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.error_message
      description: Error message regarding permissions for running APIs or the action doesn't exist.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_timeout
      description: Number of endpoints in the "timeout" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_pending_abort
      description: Number of endpoints in the "pending abort" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_pending
      description: Number of endpoints in the "pending" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_in_progress
      description: Number of endpoints in the "in progress" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_failed
      description: Number of endpoints in the "failed" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_expired
      description: Number of endpoints in the "expired" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_completed_successfully
      description: Number of endpoints in the "completed successfully" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_canceled
      description: Number of endpoints in the "canceled" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_aborted
      description: Number of endpoints in the "aborted" status.
      type: Number
  - arguments:
    - description: Action IDs retrieved from the xdr-run-script command.
      isArray: true
      name: action_id
      required: true
    description: Retrieve the results of a script execution action.
    name: xdr-get-script-execution-results
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptResult.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.retrieved_files
      description: Number of successfully retrieved files.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_ip_address
      description: Endpoint IP address.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_name
      description: Name of successfully retrieved files.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.failed_files
      description: Number of files failed to be retrieved.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_status
      description: Endpoint status.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.domain
      description: Domain to which the endpoint belongs.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_id
      description: Endpoint ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.execution_status
      description: Execution status of this endpoint.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.return_value
      description: Value returned by the script in case the type is not a dictionary.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.standard_output
      description: The STDOUT and the STDERR logged by the script during the execution.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.retention_date
      description: Timestamp in which the retrieved files will be deleted from the server.
      type: Date
  - arguments:
    - description: Action IDs retrieved from the xdr-run-script command.
      isArray: true
      name: action_id
      required: true
    - description: Endpoint ID. Can be retrieved by running the xdr-get-endpoints command.
      isArray: true
      name: endpoint_id
      required: true
    description: Gets the files retrieved from a specific endpoint during a script execution.
    name: xdr-get-script-execution-result-files
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: EntryID of the file.
      type: String
    - contextPath: File.Info
      description: Information about the file.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The extension of the file.
      type: String
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      name: endpoint_ids
      required: true
    - description: A comma-separated list of shell commands to execute. Set the `is_raw_command` argument to `true` to prevent splitting by commas. (Useful when using `||`, `&&`, `;` separators for controlling the flow of multiple commands).
      name: commands
      required: true
    - description: Whether to pass the command as-is. When false, the command is split by commas and sent as a list of commands, that are run independently.
      name: is_raw_command
      type: Boolean
      required: false
    - description: Type of shell command.
      auto: PREDEFINED
      name: command_type
      predefined:
      - 'powershell'
      - 'native'
      required: false
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Initiates a new endpoint script execution of shell commands.
    name: xdr-script-commands-execute
    polling: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      name: endpoint_ids
      required: true
    - description: A comma-separated list of shell commands to execute.
      name: commands
      required: true
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    deprecated: true
    description: Deprecated. Use `xdr-script-commands-execute` instead.
    name: xdr-run-script-execute-commands
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      isArray: true
      name: endpoint_ids
      required: true
    - description: A comma-separated list of paths of the files to delete. All of the given file paths will run on all of the endpoints.
      isArray: true
      name: file_path
      required: true
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Initiates a new endpoint script execution to delete the specified file.
    name: xdr-file-delete-script-execute
    polling: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      isArray: true
      name: endpoint_ids
      required: true
    - description: A comma-separated list of paths of the files to delete. All of the given file paths will run on all of the endpoints.
      isArray: true
      name: file_path
      required: true
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    deprecated: true
    description: Deprecated. Use `xdr-file-delete-script-execute` instead.
    name: xdr-run-script-delete-file
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      isArray: true
      name: endpoint_ids
      required: true
    - description: A comma-separated list of paths of the files to check for existence. All of the given file paths will run on all of the endpoints.
      isArray: true
      name: file_path
      required: true
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Initiates a new endpoint script execution to check if the file exists.
    name: xdr-file-exist-script-execute
    polling: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      isArray: true
      name: endpoint_ids
      required: true
    - description: A comma-separated list of paths of the files to check for existence. All of the given file paths will run on all of the endpoints.
      isArray: true
      name: file_path
      required: true
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    deprecated: true
    description: Deprecated. Use `xdr-file-exist-script-execute` instead.
    name: xdr-run-script-file-exists
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
  - arguments:
    - description: Allows to link the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      isArray: true
      name: endpoint_ids
      required: true
    - description: Names of processes to kill. Will kill all of the given processes on all of the endpoints.
      isArray: true
      name: process_name
      required: true
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Initiates a new endpoint script execution kill process.
    name: xdr-kill-process-script-execute
    polling: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      isArray: true
      name: endpoint_ids
      required: true
    - description: Names of processes to kill. Will kill all of the given processes on all of the endpoints.
      isArray: true
      name: process_name
      required: true
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    deprecated: true
    description: Deprecated. Use `xdr-kill-process-script-execute` instead.
    name: xdr-run-script-kill-process
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
  - arguments:
    - description: The endpoint ID.
      isArray: true
      name: id
    - default: true
      description: The endpoint IP address.
      isArray: true
      name: ip
    - description: The endpoint hostname.
      isArray: true
      name: hostname
    description: Returns information about an endpoint.
    name: endpoint
    outputs:
    - contextPath: Endpoint.Hostname
      description: The endpoint hostname.
      type: String
    - contextPath: Endpoint.OS
      description: The endpoint operation system.
      type: String
    - contextPath: Endpoint.IPAddress
      description: The endpoint IP address.
      type: String
    - contextPath: Endpoint.ID
      description: The endpoint ID.
      type: String
    - contextPath: Endpoint.Status
      description: The endpoint status.
      type: String
    - contextPath: Endpoint.IsIsolated
      description: The endpoint isolation status.
      type: String
    - contextPath: Endpoint.MACAddress
      description: The endpoint MAC address.
      type: String
    - contextPath: Endpoint.Vendor
      description: The integration name of the endpoint vendor.
      type: String
  - arguments:
    - description: 'A comma-separated list of endpoint statuses to filter. Valid values are: connected, disconnected, lost, uninstalled, windows, linux, macos, android, isolated, unisolated.'
      name: status
      required: true
      isArray: true
    - description: |-
        All the agents that were last seen after {last_seen_gte}. Supported
                values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00"
                (date).
      name: last_seen_gte
    - description: |-
        All the agents that were last seen before {last_seen_lte}. Supported
                values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00"
                (date).
      name: last_seen_lte
    description: Returns the number of the connected\disconnected endpoints.
    name: xdr-get-endpoints-by-status
    outputs:
    - contextPath: PaloAltoNetworksXDR.EndpointsStatus.status
      description: The endpoint status.
      type: String
    - contextPath: PaloAltoNetworksXDR.EndpointsStatus.count
      description: The number of endpoints with this status.
      type: Number
  - arguments:
    - description: A comma-separated list of alert IDs.
      isArray: true
      name: alert_ids
      required: true
    - description: Whether to return only a subset of the alert fields. Filtering the fields can reduce response size for large alerts.
      name: filter_alert_fields
      auto: PREDEFINED
      defaultValue: 'true'
      predefined:
      - 'true'
      - 'false'
    - description: Whether to return events_from_decider context output as a dictionary (the raw API response) or as a list (improved for playbook automation) - relevant only when filter_alert_fields is set to False.
      name: events_from_decider_format
      auto: PREDEFINED
      defaultValue: 'dict'
      predefined:
      - 'list'
      - 'dict'
    description: This command is deprecated. Returns information about each alert ID.
    name: xdr-get-cloud-original-alerts
    deprecated: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event._time
      description: The timestamp of the occurrence of the event.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.vendor
      description: Vendor name.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.event_timestamp
      description: Event timestamp.
      type: Number
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.event_type
      description: Event type (static 500).
      type: Number
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.cloud_provider
      description: The cloud provider - GCP, AZURE, or AWS.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.project
      description: The project in which the event occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.cloud_provider_event_id
      description: The ID given to the event by the cloud provider, if the ID exists.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.cloud_correlation_id
      description: The ID the cloud provider is using to aggregate events that are part of the same general event.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.operation_name_orig
      description: The name of the operation that occurred, as supplied by the cloud provider.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.operation_name
      description: The normalized name of the operation performed by the event.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_orig
      description: Contains the original identity related fields as provided by the cloud provider.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_name
      description: The name of the identity that initiated the action.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_uuid
      description: Same as identity_name but also contains the UUID of the identity if it exists.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_type
      description: An enum representing the type of the identity.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_sub_type
      description: An enum representing the sub-type of the identity, respective to its identity_type.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_name
      description: The name of the identity that invoked the action as it appears in the log.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_uuid
      description: The UUID of the identity that invoked the action as it appears in the log.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_type
      description: An enum that represents the type of identity event that invoked the action.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_sub_type
      description: An enum that represents the respective sub_type of the type of identity (identity_type) that has invoked the action.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.operation_status
      description: Status of whether the operation has succeed or failed, if provided.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.operation_status_orig
      description: The operation status code as it appears in the log, including the lookup from the code number to code name.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.operation_status_orig_code
      description: The operation status code as it appears in the log.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.operation_status_reason_provided
      description: Description of the error, if the log record indicates an error and the cloud provider supplied the reason.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.resource_type
      description: The normalized type of the service that emitted the log row.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.resource_type_orig
      description: The type of the service that emitted the log as provided by the cloud provider.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.resource_sub_type
      description: The sub-type respective to the resource_type field, normalized across all cloud providers.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.resource_sub_type_orig
      description: The sub-type of the service that emitted this log row as provided by the cloud provider.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.region
      description: The cloud region of the resource that emitted the log.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.zone
      description: The availability zone of the resource that emitted the log.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.referenced_resource
      description: The cloud resource referenced in the audit log.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.referenced_resource_name
      description: Same as referenced_resource but provides only the substring that represents the resource name instead of the full asset ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.referenced_resources_count
      description: The number of extracted resources referenced in this audit log.
      type: Number
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.user_agent
      description: The user agent provided in the call to the API of the cloud provider.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.caller_ip
      description: The IP of the caller that performed the action in the log.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.caller_ip_geolocation
      description: The geolocation associated with the caller_ip's value.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.caller_ip_asn
      description: The ASN of the caller_ip's value.
      type: Number
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.caller_project
      description: The project of the caller entity.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.raw_log
      description: The raw log that is being normalized.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.log_name
      description: The name of the log that contains the log row.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.caller_ip_asn_org
      description: The organization associated with the ASN of the caller_ip's value.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.event_base_id
      description: Event base ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.ingestion_time
      description: Ingestion time.
      type: String
  - arguments:
    - description: The unique ID of the alert.
      isArray: true
      name: alert_id
    - auto: PREDEFINED
      description: The severity of the alert.
      isArray: true
      name: severity
      predefined:
      - low
      - medium
      - high
    - description: "A custom filter. When using this argument, other filter arguments are not relevant. example: \n`{\n                \"OR\": [\n                    {\n                        \"SEARCH_FIELD\": \"actor_process_command_line\",\n                        \"SEARCH_TYPE\": \"EQ\",\n                        \"SEARCH_VALUE\": \"path_to_file\"\n                    }\n                ]\n            }`."
      name: custom_filter
    - auto: PREDEFINED
      description: Account type.
      isArray: true
      name: Identity_type
      predefined:
      - ANONYMOUS
      - APPLICATION
      - COMPUTE
      - FEDERATED_IDENTITY
      - SERVICE
      - SERVICE_ACCOUNT
      - TEMPORARY_CREDENTIALS
      - TOKEN
      - UNKNOWN
      - USER
    - description: A unique identifier per agent.
      isArray: true
      name: agent_id
    - description: The hostname to connect to. In case of a proxy connection, this value will differ from action_remote_ip.
      isArray: true
      name: action_external_hostname
    - description: A string identifying the user rule.
      isArray: true
      name: rule_id
    - description: The name of the user rule.
      isArray: true
      name: rule_name
    - description: The alert name.
      isArray: true
      name: alert_name
    - description: The alert source.
      isArray: true
      name: alert_source
    - auto: PREDEFINED
      description: Supports relative times or “custom” time option. If you choose the "custom" option, you should use start_time and end_time arguments.
      name: time_frame
      predefined:
      - 60 minutes
      - 3 hours
      - 12 hours
      - 24 hours
      - 2 days
      - 7 days
      - 14 days
      - 30 days
      - custom
    - description: The name assigned to the user_id during agent runtime.
      isArray: true
      name: user_name
    - description: The file name of the binary file.
      isArray: true
      name: actor_process_image_name
    - description: CGO CMD.
      isArray: true
      name: causality_actor_process_image_command_line
    - description: |-
        Trimmed to 128 unicode chars during event serialization.
        Full value reported as part of the original process event.
      isArray: true
      name: actor_process_image_command_line
    - description: The command line of the process created.
      isArray: true
      name: action_process_image_command_line
    - description: SHA256 hash of the binary file.
      isArray: true
      name: actor_process_image_sha256
    - description: SHA256 hash of the binary file.
      isArray: true
      name: causality_actor_process_image_sha256
    - description: SHA256 of the binary file.
      isArray: true
      name: action_process_image_sha256
    - description: SHA256 of the file related to the event.
      isArray: true
      name: action_file_image_sha256
    - description: The name of the registry.
      isArray: true
      name: action_registry_name
    - description: The key data of the registry.
      isArray: true
      name: action_registry_key_data
    - description: The host IP address.
      isArray: true
      name: host_ip
    - description: The local IP address for the connection.
      isArray: true
      name: action_local_ip
    - description: Remote IP address for the connection.
      isArray: true
      name: action_remote_ip
    - auto: PREDEFINED
      description: Alert action status.
      name: alert_action_status
      predefined:
      - detected
      - detected (allowed the session)
      - detected (download)
      - detected (forward)
      - detected (post detected)
      - detected (prompt allow)
      - detected (raised an alert)
      - detected (reported)
      - detected (on write)
      - detected (scanned)
      - detected (sinkhole)
      - detected (syncookie sent)
      - detected (wildfire upload failure)
      - detected (wildfire upload success)
      - detected (wildfire upload skip)
      - detected (xdr managed threat hunting)
      - prevented (block)
      - prevented (blocked)
      - prevented (block-override)
      - prevented (blocked the url)
      - prevented (blocked the ip)
      - prevented (continue)
      - prevented (denied the session)
      - prevented (dropped all packets)
      - prevented (dropped the session)
      - prevented (dropped the session and sent a tcp reset)
      - prevented (dropped the packet)
      - prevented (override)
      - prevented (override-lockout)
      - prevented (post detected)
      - prevented (prompt block)
      - prevented (random-drop)
      - prevented (silently dropped the session with an icmp unreachable message to the host or application)
      - prevented (terminated the session and sent a tcp reset to both sides of the connection)
      - prevented (terminated the session and sent a tcp reset to the client)
      - prevented (terminated the session and sent a tcp reset to the server)
      - prevented (on write)
    - description: The local IP address for the connection.
      isArray: true
      name: action_local_port
    - description: The remote port for the connection.
      isArray: true
      name: action_remote_port
    - description: The hostname connected to. In case of a proxy connection, this value will differ from action_remote_ip.
      isArray: true
      name: dst_action_external_hostname
    - defaultValue: source_insert_ts
      description: The field by which to sort the results.
      isArray: true
      name: sort_field
    - auto: PREDEFINED
      description: The order in which to sort the results.
      name: sort_order
      predefined:
      - DESC
      - ASC
    - defaultValue: '0'
      description: The first page from which we bring the alerts.
      isArray: true
      name: offset
    - defaultValue: '50'
      description: The last page from which we bring the alerts.
      isArray: true
      name: limit
    - description: Relevant when "time_frame" argument is "custom". Supports epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss.000Z).
      name: start_time
    - description: Relevant when "time_frame" argument is "custom". Supports epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss.000Z).
      name: end_time
    - auto: PREDEFINED
      description: Whether the alert is starred or not.
      name: starred
      predefined:
      - 'true'
      - 'false'
    - description: The MITRE attack technique.
      isArray: true
      name: mitre_technique_id_and_name
    description: "This command is deprecated, please use xdr-issue-list instead. Returns a list of alerts and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. \nMultiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value."
    name: xdr-get-alerts
    deprecated: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.Alert.internal_id
      description: The unique ID of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.source_insert_ts
      description: The detection timestamp.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Alert.alert_name
      description: The name of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.severity
      description: The severity of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_category
      description: The category of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_action_status
      description: |-
        The alert action. Possible values.

        DETECTED: detected
        DETECTED_0: detected (allowed the session)
        DOWNLOAD: detected (download)
        DETECTED_19: detected (forward)
        POST_DETECTED: detected (post detected)
        PROMPT_ALLOW: detected (prompt allow)
        DETECTED_4: detected (raised an alert)
        REPORTED: detected (reported)
        REPORTED_TRIGGER_4: detected (on write)
        SCANNED: detected (scanned)
        DETECTED_23: detected (sinkhole)
        DETECTED_18: detected (syncookie sent)
        DETECTED_21: detected (wildfire upload failure)
        DETECTED_20: detected (wildfire upload success)
        DETECTED_22: detected (wildfire upload skip)
        DETECTED_MTH: detected (xdr managed threat hunting)
        BLOCKED_25: prevented (block)
        BLOCKED: prevented (blocked)
        BLOCKED_14: prevented (block-override)
        BLOCKED_5: prevented (blocked the url)
        BLOCKED_6: prevented (blocked the ip)
        BLOCKED_13: prevented (continue)
        BLOCKED_1: prevented (denied the session)
        BLOCKED_8: prevented (dropped all packets)
        BLOCKED_2: prevented (dropped the session)
        BLOCKED_3: prevented (dropped the session and sent a tcp reset)
        BLOCKED_7: prevented (dropped the packet)
        BLOCKED_16: prevented (override)
        BLOCKED_15: prevented (override-lockout)
        BLOCKED_26: prevented (post detected)
        PROMPT_BLOCK: prevented (prompt block)
        BLOCKED_17: prevented (random-drop)
        BLOCKED_24: prevented (silently dropped the session with an icmp unreachable message to the host or application)
        BLOCKED_9: prevented (terminated the session and sent a tcp reset to both sides of the connection)
        BLOCKED_10: prevented (terminated the session and sent a tcp reset to the client)
        BLOCKED_11: prevented (terminated the session and sent a tcp reset to the server)
        BLOCKED_TRIGGER_4: prevented (on write).

      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_action_status_readable
      description: The alert action.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_name
      description: The alert name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_description
      description: The alert description.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.agent_ip_addresses
      description: The host IP address.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.agent_hostname
      description: The hostname.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.mitre_tactic_id_and_name
      description: The MITRE attack tactic.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.mitre_technique_id_and_name
      description: The MITRE attack technique.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.starred
      description: Whether the alert is starred or not.
      type: Boolean
  - arguments:
    - description: Links the response action to the incident that triggered it.
      name: incident_id
    - description: String that represents a list of hashed files to add to the allow list. Must be a valid SHA256 hash.
      isArray: true
      name: hash_list
      required: true
    - description: String that represents additional information regarding the action.
      name: comment
    description: Removes requested files from allow list.
    name: xdr-remove-allowlist-files
    outputs:
    - contextPath: PaloAltoNetworksXDR.allowlist.removed_hashes
      description: Removed file hash.
      type: Number
  - arguments:
    - description: Links the response action to the incident that triggered it.
      name: incident_id
    - description: String that represents a list of hashed files to add to the allow list. Must be a valid SHA256 hash.
      isArray: true
      name: hash_list
      required: true
    - description: String that represents additional information regarding the action.
      name: comment
    description: Removes requested files from the block list.
    name: xdr-remove-blocklist-files
    outputs:
    - contextPath: PaloAltoNetworksXDR.blocklist.removed_hashes
      description: Removed file hash from block list.
      type: Number
  - arguments:
    - description: The alert ID's from where to retrieve the contributing events.
      isArray: true
      name: alert_ids
      required: true
    - defaultValue: '50'
      description: The maximum number of contributing events to retrieve.
      name: limit
    - defaultValue: '1'
      description: The page number to retrieve. Minimum is 1.
      name: page_number
    - defaultValue: '50'
      description: The page size.
      name: page_size
    description: Retrieves contributing events for a specific correlation alert.
    name: xdr-get-contributing-event
    outputs:
    - contextPath: PaloAltoNetworksXDR.ContributingEvent.alertID
      description: The alert ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.ContributingEvent.events
      description: The contributing events.
      type: Unknown
  - arguments:
    - auto: PREDEFINED
      description: The field type to change.
      name: field_type
      predefined:
      - hosts
      - users
      - ip_addresses
      - ad_groups
      required: true
    - description: The string value, which defines the new field. Maximum length is 256 characters.
      isArray: true
      name: values
      required: true
    - description: The string value, which represents additional information regarding the featured alert field.
      name: comments
    - auto: PREDEFINED
      defaultValue: group
      description: |-
        The string value to replace an active directory group or organizational unit.
      name: ad_type
      predefined:
      - group
      - ou
    description: Replace the featured hosts\users\IP addresses\active directory groups listed in your environment.
    name: xdr-replace-featured-field
    outputs:
    - contextPath: PaloAltoNetworksXDR.FeaturedField.fieldType
      description: The field type that changed.
      type: String
    - contextPath: PaloAltoNetworksXDR.FeaturedField.fields
      description: String value that defines the new field.
      type: String
  - arguments:
    - description: A comma-separated list of endpoint IDs.
      isArray: true
      name: endpoint_ids
      required: true
    - description: Tag to add.
      name: tag
      required: true
    description: Adds a tag to specified endpoint_ids.
    name: xdr-endpoint-tag-add
  - arguments:
    - description: A comma-separated list of endpoint IDs.
      isArray: true
      required: true
      name: endpoint_ids
    - description: Tag to remove from specified endpoint_ids.
      name: tag
      required: true
    description: Removes a tag from specified endpoint_ids.
    name: xdr-endpoint-tag-remove
  - name: xdr-get-tenant-info
    outputs:
    - contextPath: PaloAltoNetworksXDR.TenantInformation.pro_per_endpoint_expiration
      description: Expiration time pro per endpoint.
      type: Date
    - contextPath: PaloAltoNetworksXDR.TenantInformation.purchased_pro_per_endpoint.agents
      description: Number of endpoint agents purchased.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.data_enabled_pro_per_endpoint
      description: Enabled data per pro endpoint.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.prevent_expiration
      description: Number of prevent expirations.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.purchased_prevent
      description: Number of purchased prevents.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.installed_prevent
      description: Number of installed prevents.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.pro_tb_expiration
      description: pro_tb license expiration time.
      type: Date
    - contextPath: PaloAltoNetworksXDR.TenantInformation.purchased_pro_tb.tb
      description: Number of pro_tbs purchased.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.installed_pro_tb
      description: Number of pro_tbs installed.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.compute_unit_expiration
      description: Compute unit expiration time.
      type: Date
    - contextPath: PaloAltoNetworksXDR.TenantInformation.purchased_compute_unit
      description: Number of compute units purchased.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.compute_unit_is_trial
      description: Whether the compute unit is a trial.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.TenantInformation.host_insights_expiration
      description: Host insight expiration date.
      type: Date
    - contextPath: PaloAltoNetworksXDR.TenantInformation.enabled_host_insights
      description: Number of host insights enabled.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.purchased_host_insights
      description: Number of purchased host insights.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.forensics_expiration
      description: Forensic expiration date.
      type: Date
    - contextPath: PaloAltoNetworksXDR.TenantInformation.purchased_forensics
      description: Number of forensics purchased.
      type: Number
    arguments: []
    description: Provides information about the tenant.
  - name: xdr-list-users
    description: Retrieve a list of the current users in the environment.
    arguments: []
    outputs:
    - contextPath: PaloAltoNetworksXDR.User.user_email
      description: Email address of the user.
      type: string
    - contextPath: PaloAltoNetworksXDR.User.user_first_name
      description: First name of the user.
      type: string
    - contextPath: PaloAltoNetworksXDR.User.user_last_name
      description: Last name of the user.
      type: string
    - contextPath: PaloAltoNetworksXDR.User.role_name
      description: Role name associated with the user.
      type: string
    - contextPath: PaloAltoNetworksXDR.User.last_logged_in
      description: Timestamp of when the user last logged in.
      type: Number
    - contextPath: PaloAltoNetworksXDR.User.user_type
      description: Type of user.
      type: string
    - contextPath: PaloAltoNetworksXDR.User.groups
      description: Name of user groups associated with the user, if applicable.
      type: array
    - contextPath: PaloAltoNetworksXDR.User.scope
      description: Name of scope associated with the user, if applicable.
      type: array
  - arguments:
    - description: |
        Unique ID of a specific user.
        User ID could be either of the `foo/dummy` format, or just `dummy`.
      name: user_id
    - description: Limit the number of users that will appear in the list. (Use limit when no specific host is requested.)
      name: limit
      defaultValue: '10'
    name: xdr-list-risky-users
    description: Retrieve the risk score of a specific user or list of users with the highest risk score in the environment along with the reason affecting each score.
    outputs:
    - contextPath: PaloAltoNetworksXDR.RiskyUser.type
      description: Form of identification element.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyUser.id
      description: Identification value of the type field.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyUser.score
      description: The score assigned to the user.
      type: Number
    - contextPath: PaloAltoNetworksXDR.RiskyUser.reasons.date created
      description: Date when the incident was created.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyUser.reasons.description
      description: Description of the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyUser.reasons.severity
      description: The severity of the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyUser.reasons.status
      description: The incident status.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyUser.reasons.points
      description: The score.
      type: Number
  - arguments:
    - description: The host name of a specific host.
      name: host_id
    - description: Limit the number of hosts that will appear in the list. By default, the limit is 50 hosts.(Use limit when no specific host is requested.)
      name: limit
      defaultValue: '10'
    name: xdr-list-risky-hosts
    description: Retrieve the risk score of a specific host or list of hosts with the highest risk score in the environment along with the reason affecting each score.
    outputs:
    - contextPath: PaloAltoNetworksXDR.RiskyHost.type
      description: Form of identification element.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyHost.id
      description: Identification value of the type field.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyHost.score
      description: The score assigned to the host.
      type: Number
    - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.date created
      description: Date when the incident was created.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.description
      description: Description of the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.severity
      description: The severity of the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.status
      description: The incident status.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.points
      description: The score.
      type: Number
  - arguments:
    - description: A comma-separated list of one or more user group names for the associated users.
      name: group_names
      isArray: true
      required: true
    name: xdr-list-user-groups
    description: Retrieve a list of the current user emails associated with one or more user groups in the environment.
    outputs:
    - contextPath: PaloAltoNetworksXDR.UserGroup.group_name
      description: Name of the user group.
      type: String
    - contextPath: PaloAltoNetworksXDR.UserGroup.description
      description: Description of the user group, if available.
      type: String
    - contextPath: PaloAltoNetworksXDR.UserGroup.pretty_name
      description: Name of the user group as it appears in the management console.
      type: String
    - contextPath: PaloAltoNetworksXDR.UserGroup.insert_time
      description: Timestamp of when the user group was created.
      type: Number
    - contextPath: PaloAltoNetworksXDR.UserGroup.update_time
      description: Timestamp of when the user group was last updated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.UserGroup.user_email
      description: List of email addresses belonging to the users associated with the user group.
      type: array
    - contextPath: PaloAltoNetworksXDR.UserGroup.source
      description: Type of user group.
      type: String
  - arguments:
    - description: A comma-separated list of one or more role names in your environment for which to retrieve detailed information.
      name: role_names
      required: true
    name: xdr-list-roles
    description: Retrieve information about one or more roles created in the environment.
    outputs:
    - contextPath: PaloAltoNetworksXDR.Role.pretty_name
      description: Name of the role as it appears in the management console.
      type: String
    - contextPath: PaloAltoNetworksXDR.Role.permissions
      description: List of permissions associated with this role.
      type: array
    - contextPath: PaloAltoNetworksXDR.Role.insert_time
      description: Timestamp of when the role was created.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Role.update_time
      description: Timestamp of when the role was last updated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Role.created_by
      description: Email of the user who created the role.
      type: String
    - contextPath: PaloAltoNetworksXDR.Role.description
      description: Description of the role, if available.
      type: String
    - contextPath: PaloAltoNetworksXDR.Role.groups
      description: Group names associated with the role.
      type: array
    - contextPath: PaloAltoNetworksXDR.Role.users
      description: Email address of users associated with the role.
      type: array
  - arguments:
    - description: A comma-separated list of one or more user emails of users you want to add to a role.
      name: user_emails
      required: true
      isArray: true
    - description: Name of the role to add a user to.
      name: role_name
      required: true
    name: xdr-set-user-role
    description: Add one or more users to a role.
  - arguments:
    - description: A comma-separate list of one or more user emails of users to remove from a role.
      name: user_emails
      required: true
      isArray: true
    name: xdr-remove-user-role
    description: Remove one or more users from a role.
  - arguments:
    - description: A comma-separated list of alert IDs.
      name: alert_ids
      required: true
      isArray: true
    - auto: PREDEFINED
      description: Required severity to update alerts to.
      name: severity
      required: false
      predefined:
      - critical
      - high
      - medium
      - low
    - auto: PREDEFINED
      description: New status for updated alerts.
      name: status
      required: false
      predefined:
      - new
      - resolved_threat_handled
      - under_investigation
      - resolved_security_testing
      - resolved_auto
      - resolved_known_issue
      - resolved_duplicate
      - resolved_other
      - resolved_false_positive
      - resolved_true_positive
    - description: Comment to append to updated alerts.
      name: comment
      required: false
    description: |-
      This command is deprecated, please use xdr-issue-update instead. Update one or more alerts with the provided arguments.
      Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB.
    name: xdr-update-alert
    deprecated: true
  - arguments:
    - description: A comma-separated list of API key IDs to retrieve.
      isArray: true
      name: api_id
    - description: A comma-separated list of API key roles to retrieve.
      isArray: true
      name: role
    - description: 'Filters API keys that expire before this date. For example: "1 year". Filters API keys that have an expiration date.'
      name: expires_before
    - description: 'Filters API keys that expire after this date. For example: "1 year". Filters API keys that have an expiration date.'
      name: expires_after
    description: Gets a list of existing API keys.
    name: xdr-api-key-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.APIKeyData.id
      description: The API key ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.APIKeyData.roles
      description: The roles associated with the API key.
      type: String
    - contextPath: PaloAltoNetworksXDR.APIKeyData.expiration
      description: The expiration date of the API key.
      type: Date
  - arguments:
    - description: A comma-separated list of API key IDs to delete.
      isArray: true
      name: api_id
      required: true
    description: Deletes the specified API keys.
    name: xdr-api-key-delete
  - arguments:
    - description: 'A comma-separated list of asset IDs. For example: "1,2,3". When using this argument, the other filters will not be used.'
      isArray: true
      name: asset_id
    - description: 'The field used to sort the results. For example: xdm.asset.first_observed. For additional sortable fields, see the documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Get-all-or-filtered-assets.'
      name: sort_field
    - auto: PREDEFINED
      description: The order in which to sort the results.
      name: sort_order
      predefined:
      - asc
      - desc
    - description: 'The JSON to use for the "filter" field in the API. You can use xdr-asset-schema-get to retrieve the schema. For more details, see the documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Get-all-or-filtered-assets.'
      name: filter_json
    - description: Maximum number of assets to return. Default is 50.
      name: limit
      defaultValue: '50'
    - description: Page size for pagination.
      name: page_size
      defaultValue: '50'
    - defaultValue: '0'
      description: Page number for pagination.
      name: page
    description: Returns a list of assets.
    name: xdr-asset-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_id
      description: The unique identifier of the asset.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_name
      description: The name of the asset (e.g., image SHA).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_strong_id
      description: The strong identifier (SHA256) of the asset.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_provider
      description: The provider of the asset.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_external_provider_id
      description: External provider ID (if applicable).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_first_observed
      description: Timestamp when the asset was first observed.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_last_observed
      description: Timestamp when the asset was last observed.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_type_id
      description: The ID of the asset type (e.g., CORE_IMAGE).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_type_name
      description: The name of the asset type.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_type_category
      description: The category of the asset (e.g., Container Image).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_type_class
      description: The class of the asset (e.g., Compute).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_development_cycle_stages
      description: The development cycle stages (e.g., RUNTIME).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_architecture
      description: The architecture of the image (e.g., amd64).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_digest
      description: The image digest hash.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_identifier
      description: The image identifier.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_names
      description: List of names/tags associated with the image.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_os
      description: The OS version of the image.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_os_distribution
      description: The OS distribution (e.g., UBUNTU).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_os_family
      description: The OS family (e.g., Linux).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_os_release
      description: The OS release name (e.g., noble).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_labels
      description: Labels associated with the image.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_layers
      description: List of layers making up the image.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_layers_created_at
      description: Timestamp of when the layer was created.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_layers_instruction
      description: The instruction used to create the layer (e.g., RUN, ADD).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_layers_size
      description: The size of the layer in bytes.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_related_cases_cases_breakdown
      description: Breakdown of related cases by severity.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_related_cases_critical_cases
      description: Count of critical cases.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_related_issues_issues_breakdown
      description: Breakdown of related issues by severity.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_relations
      description: Relations to other assets.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_group_ids
      description: Group IDs associated with the asset.
      type: Number
  - name: xdr-asset-schema-get
    description: Gets the schema of the asset inventory.
    outputs:
    - contextPath: PaloAltoNetworksXDR.AssetSchema.field_name
      description: The name of the field.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetSchema.field_type
      description: The type of the field.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetSchema.field_pretty_name
      description: The pretty name of the field.
      type: String
  - arguments:
    - description: "The name of the field to get options for. You can use xdr-asset-schema-get to retrieve the schema. The field must be of type ENUM, for example: xdm.asset.provider."
      name: field_name
      required: true
    description: Gets the enum values of a specified field in the asset schema.
    name: xdr-asset-schema-field-options-get
    outputs:
    - contextPath: PaloAltoNetworksXDR.AssetSchema.field_name
      description: The name of the field.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetSchema.options
      description: The enum values of the field.
      type: Unknown
  - arguments:
    - description: The name of the asset group.
      name: group_name
      required: true
    - auto: PREDEFINED
      description: The type of the asset group.
      name: group_type
      predefined:
      - Static
      - Dynamic
      required: true
    - description: The description of the asset group.
      name: group_description
    - description: 'Define the filter conditions for selecting which assets to be included in a dynamic Asset Group. For example: "{\"AND\":[{\"SEARCH_FIELD\":\"xdm.asset.type.class\",\"SEARCH_TYPE\":\"NEQ\",\"SEARCH_VALUE\":\"Other\"}]}". The SEARCH_FIELD needs to be in lower case. For more information, please refer to the documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Create-an-Asset-Group.'
      name: membership_predicate_json
    description: Creates an asset group.
    name: xdr-asset-group-create
  - arguments:
    - description: The ID of the asset group to delete.
      name: group_id
      required: true
    description: Deletes an asset group.
    name: xdr-asset-group-delete
  - arguments:
    - description: 'The field by which to sort the results. For example: XDM.ASSET_GROUP.NAME. Use the documentation for finding more fields https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Get-all-or-filtered-asset-groups.'
      name: sort_field
    - auto: PREDEFINED
      description: The order in which to sort the results.
      name: sort_order
      predefined:
      - asc
      - desc
    - description: 'The JSON to use for the "filter" field in the API. For example: "{\"AND\": [{\"SEARCH_FIELD\": \"XDM.ASSET_GROUP.TYPE\", \"SEARCH_TYPE\": \"EQ\", \"SEARCH_VALUE\": \"Dynamic\"}]}". For more information, please refer to the documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Get-all-or-filtered-asset-groups.'
      name: filter_json
    - defaultValue: '50'
      description: Maximum number of asset groups to return. Default is 50.
      name: limit
    - description: Page size for pagination.
      name: page_size
    - defaultValue: '0'
      description: Page number for pagination. 0 is the first page.
      name: page
    description: Returns a list of asset groups.
    name: xdr-asset-group-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_ID
      description: The unique identifier of the asset group.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_NAME
      description: The name of the asset group.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_TYPE
      description: The type of the asset group (Static or Dynamic).
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_FILTER
      description: The filter query string used to define the members of the XDM asset group.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_DESCRIPTION
      description: The description of the asset group.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_CREATION_TIME
      description: The timestamp when the group was created (Epoch).
      type: Date
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_LAST_UPDATE_TIME
      description: The timestamp when the group was last updated (Epoch).
      type: Date
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_CREATED_BY_PRETTY
      description: The user or API key that created the group.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_MODIFIED_BY_PRETTY
      description: The user or API key that last modified the group.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_MEMBERSHIP_PREDICATE
      description: The JSON object defining the search criteria for dynamic groups.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.AssetGroup.IS_USED_BY_SBAC
      description: Indicates whether this asset group is currently utilized to define Scope-Based Access Control (SBAC) rules.
      type: Boolean
  - arguments:
    - description: The ID of the asset group to update.
      name: group_id
      required: true
    - description: The name of the asset group.
      name: group_name
    - auto: PREDEFINED
      description: The type of the asset group.
      name: group_type
      predefined:
      - Static
      - Dynamic
    - description: The description of the asset group.
      name: group_description
    - description: 'Define the filter conditions for selecting which assets to be included in a dynamic Asset Group. For example: "{\"AND\":[{\"SEARCH_FIELD\":\"xdm.asset.type.class\",\"SEARCH_TYPE\":\"NEQ\",\"SEARCH_VALUE\":\"Other\"}]}". The SEARCH_FIELD needs to be in lower case. For more information, please refer to the documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Update-an-Asset-Group.'
      name: membership_predicate_json
    description: Updates an asset group.
    name: xdr-asset-group-update
  - arguments:
    - description: The entry ID of the file. The script should be a zipped YAML file.
      name: entry_id
      required: true
    description: Creates or updates an automation script.
    name: xdr-automation-script-create
  - arguments:
    - description: The field to search by.
      name: field
      required: true
      auto: PREDEFINED
      predefined:
      - id
      - name
    - description: The field value to search for.
      name: value
      required: true
    description: Gets an automation script.
    name: xdr-automation-script-get
  - arguments:
    - description: The field to search by.
      name: field
      required: true
      auto: PREDEFINED
      predefined:
      - id
      - name
    - description: The field value to search for.
      name: value
      required: true
    description: Deletes an automation script.
    name: xdr-automation-script-delete
  - arguments:
    - description: The entry ID of the file. The playbook should be a zipped YAML file.
      name: entry_id
      required: true
    description: Creates or updates an automation playbook.
    name: xdr-automation-playbook-create
  - arguments:
    - description: The field to search by.
      name: field
      required: true
      auto: PREDEFINED
      predefined:
      - id
      - name
    - description: The field value to search for.
      name: value
      required: true
    description: Gets an automation playbook.
    name: xdr-automation-playbook-get
  - arguments:
    - description: The field to search by.
      name: field
      required: true
      auto: PREDEFINED
      predefined:
      - id
      - name
    - description: The field value to search for.
      name: value
      required: true
    description: Deletes an automation playbook.
    name: xdr-automation-playbook-delete
  - arguments:
    - description: A comma-separated list of case IDs to filter by.
      isArray: true
      name: case_id
    - description: "A comma-separated list of case domains to filter by. Note: this filter is not applied when extra_data is set to true."
      isArray: true
      name: case_domain
    - description: "A comma-separated list of severities to filter by. Note: this filter is not applied when extra_data is set to true."
      isArray: true
      name: severity
    - description: Filters cases that were created before this date. Supports natural language expressions such as "one year".
      name: created_before
    - description: Filters cases that were created after this date. Supports natural language expressions such as "one year".
      name: created_after
    - description: A comma-separated list of statuses to filter by.
      isArray: true
      name: status
    - auto: PREDEFINED
      description: "The field by which to sort the results. Note: sorting by severity is not supported when extra_data is set to true."
      name: sort_field
      predefined:
      - case_id
      - severity
      - creation_time
    - auto: PREDEFINED
      description: The order in which to sort the results.
      name: sort_order
      predefined:
      - asc
      - desc
    - description: Maximum number of cases to return.
      name: limit
    - description: Page size for pagination.
      name: page_size
    - description: Page number for pagination.
      name: page
    - description: Whether to retrieve extra case data including the associated issues, file artifacts, and network artifacts for each case.
      name: extra_data
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "false"
    description: Returns a list of cases based on the specified filters.
    name: xdr-case-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.Case.case_id
      description: The unique identifier of the case.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.case_name
      description: The name of the case.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.severity
      description: The severity of the case.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.creation_time
      description: The creation time of the case.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.modification_time
      description: The modification time of the case.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.status_progress
      description: The progress status of the case (e.g., New, Under Investigation).
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.description
      description: A detailed description of the case and involved entities.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.low_severity_issue_count
      description: The number of low severity issues associated with the case.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.med_severity_issue_count
      description: The number of medium severity issues associated with the case.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.case_domain
      description: The security domain of the case.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.xdr_url
      description: The direct URL to the incident view in the XDR console.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.is_blocked
      description: Indicates if the threat was blocked.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Case.aggregated_score
      description: The overall risk score calculated for the case.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.host_count
      description: The number of hosts involved in the case.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.user_count
      description: The number of users involved in the case.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.wildfire_hits
      description: The number of WildFire malware hits associated with the case.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.tags
      description: A list of tags associated with the case.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.starred
      description: Whether the case has been starred/flagged.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Case.high_severity_issue_count
      description: The number of high-severity issues associated with the case. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.critical_severity_issue_count
      description: The number of critical-severity issues associated with the case. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.resolved_timestamp
      description: The time the case was resolved. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.assigned_user_mail
      description: The email address of the user assigned to the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.assigned_user_pretty_name
      description: The display name of the user assigned to the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.hosts
      description: The hosts involved in the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.users
      description: The users involved in the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.mitre_tactics_ids_and_names
      description: The MITRE ATT&CK tactics associated with the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.mitre_techniques_ids_and_names
      description: The MITRE ATT&CK techniques associated with the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.issue_categories
      description: The categories of the issues associated with the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.resolve_comment
      description: The comment provided when the case was resolved. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.notes
      description: Notes associated with the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.manual_severity
      description: The severity manually set for the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.manual_description
      description: The description manually set for the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.rule_based_score
      description: The rule-based risk score of the case. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.predicted_score
      description: The predicted risk score of the case. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.issue_count
      description: The total number of issues associated with the case. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.Issues.issue_id
      description: The unique identifier of the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.case_id
      description: The identifier of the case the issue belongs to. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.detection_timestamp
      description: The detection time of the issue. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.Issues.name
      description: The name of the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.category
      description: The category of the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.severity
      description: The severity of the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.source
      description: The source of the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.action
      description: The action taken for the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.action_pretty
      description: The human-readable action taken for the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.host_ip
      description: The host IP addresses associated with the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.host_name
      description: The host name associated with the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.user_name
      description: The user name associated with the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.action_file_name
      description: The file name involved in the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.action_file_path
      description: The file path involved in the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.mitre_tactic_id_and_name
      description: The MITRE ATT&CK tactic associated with the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.mitre_technique_id_and_name
      description: The MITRE ATT&CK technique associated with the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.case_id
      description: The identifier of the case associated with the file artifact. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.type
      description: The type of the file artifact. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.file_name
      description: The name of the file. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.file_sha256
      description: The SHA256 hash of the file. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.file_wildfire_verdict
      description: The WildFire verdict for the file. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.is_malicious
      description: Whether the file has been identified as malicious. Returned when extra_data is set to true.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.is_process
      description: Whether the file was a running process. Returned when extra_data is set to true.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.is_manual
      description: Whether the file artifact was added manually. Returned when extra_data is set to true.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.file_signature_vendor_name
      description: The vendor name from the file signature. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.file_signature_status
      description: The status of the file digital signature. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.alert_count
      description: The number of issues associated with the file artifact. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.case_id
      description: The identifier of the case associated with the network artifact. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.type
      description: The type of the network artifact. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.network_remote_ip
      description: The remote IP address associated with the network artifact. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.network_remote_port
      description: The remote port associated with the network artifact. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.network_domain
      description: The domain associated with the network artifact. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.network_country
      description: The country associated with the network artifact. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.alert_count
      description: The number of issues associated with the network artifact. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.is_manual
      description: Whether the network artifact was added manually. Returned when extra_data is set to true.
      type: Boolean
  - arguments:
    - description: The ID of the case to update.
      name: case_id
      required: true
    - auto: PREDEFINED
      description: The status to set for the case. When set to "resolved", the resolve_reason argument is required.
      name: status
      predefined:
      - new
      - under_investigation
      - resolved
    - auto: PREDEFINED
      description: The reason for resolving the case. Can only be provided when status is set to "resolved", and is required when resolving.
      name: resolve_reason
      predefined:
      - resolved_known_issue
      - resolved_duplicate
      - resolved_false_positive
      - resolved_true_positive
      - resolved_security_testing
      - resolved_other
    - description: The free-text comment explaining the resolution. Can only be provided when status is set to "resolved".
      name: resolve_comment
    - auto: PREDEFINED
      description: The user-defined severity to set for the case. Provide an empty string to clear the severity.
      name: user_severity
      predefined:
      - low
      - medium
      - high
      - critical
    - description: The valid Cortex XDR user email address to assign the case to.
      name: assigned_user
    - description: The free-text note for the case, used for operational or intermediate comments (e.g., a ServiceNow Ticket ID).
      name: notes
    - description: 'The JSON object string of tenant-defined custom fields to update on the case. The keys must be the exact custom field names as configured in your Cortex XDR tenant, and the values must match each field''s configuration. It is the user''s responsibility to ensure the custom field names are valid/correct for the tenant; the integration does not validate field names, only that the input is valid JSON. Example: {"my_custom_field": "value", "another_field": 42}.'
      name: custom_fields
    description: Updates an existing case with the specified details.
    name: xdr-case-update
  - arguments:
    - description: The ID of the case for which to retrieve artifacts.
      name: case_id
      required: true
    description: Retrieves a list of artifacts for a specific case.
    name: xdr-case-artifact-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.CaseNetworkArtifact.case_id
      description: The ID of the case associated with the network artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseNetworkArtifact.network_remote_ip
      description: The remote IP address associated with the artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseNetworkArtifact.network_remote_port
      description: The remote port used in the network connection.
      type: Number
    - contextPath: PaloAltoNetworksXDR.CaseNetworkArtifact.alert_count
      description: Number of alerts associated with this network artifact.
      type: Number
    - contextPath: PaloAltoNetworksXDR.CaseNetworkArtifact.type
      description: The type of network artifact (e.g., IP).
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseNetworkArtifact.is_manual
      description: Indicates if the artifact was added manually.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.case_id
      description: The ID of the case associated with the file artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.file_name
      description: The name of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.file_sha256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.file_wildfire_verdict
      description: The verdict from WildFire (e.g., MALWARE, BENIGN).
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.is_malicious
      description: Whether the file has been identified as malicious.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.is_process
      description: Indicates if the file was a running process.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.file_signature_vendor_name
      description: The vendor name from the file signature.
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.file_signature_status
      description: The status of the digital signature (e.g., SIGNATURE_SIGNED).
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.alert_count
      description: Number of alerts associated with this file artifact.
      type: Number
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.low_confidence
      description: Indicates if the detection confidence is low.
      type: Boolean
  - arguments:
    - description: The BIOC name to filter by. Can filter by only one name at a time.
      name: name
    - auto: PREDEFINED
      description: 'The BIOC severity to filter by.'
      name: severity
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - auto: PREDEFINED
      description: 'The BIOC type to filter by.'
      name: type
      predefined:
      - other
      - persistence
      - evasion
      - tampering
      - file_type_obfuscation
      - privilege_escalation
      - credential_access
      - lateral_movement
      - execution
      - collection
      - exfiltration
      - infiltration
      - dropper
      - file_privilege_manipulation
      - reconnaissance
      - discovery
    - auto: PREDEFINED
      description: 'Whether the BIOC is XQL.'
      name: is_xql
      predefined:
      - 'true'
      - 'false'
    - description: 'The BIOC comment to filter by.'
      name: comment
    - auto: PREDEFINED
      description: 'The BIOC status to filter by. Options are enabled or disabled.'
      name: status
      predefined:
      - enabled
      - disabled
    - description: 'The BIOC indicator to filter by.'
      name: indicator
    - description: "The MITRE technique ID and name. Must be in format 'ID - Name', for example: ['T1566 - Phishing']."
      isArray: true
      name: mitre_technique_id_and_name
    - description: "The MITRE tactic ID and name. Must be in format 'ID - Name', for example: ['T1566 - Phishing']."
      isArray: true
      name: mitre_tactic_id_and_name
    - auto: PREDEFINED
      description: Whether to return extended data.
      name: extra_data
      predefined:
      - 'true'
      - 'false'
    - description: Maximum number of results to return.
      name: limit
    - description: Page size.
      name: page_size
    - description: Page number.
      name: page
    description: Returns a list of BIOCs.
    name: xdr-bioc-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.BIOC.rule_id
      description: BIOC rule ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.BIOC.name
      description: BIOC name.
      type: String
    - contextPath: PaloAltoNetworksXDR.BIOC.type
      description: BIOC type.
      type: String
    - contextPath: PaloAltoNetworksXDR.BIOC.severity
      description: BIOC severity.
      type: String
    - contextPath: PaloAltoNetworksXDR.BIOC.status
      description: BIOC status.
      type: String
    - contextPath: PaloAltoNetworksXDR.BIOC.is_xql
      description: Whether the BIOC is XQL.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.BIOC.comment
      description: The BIOC comment.
      type: String
    - contextPath: PaloAltoNetworksXDR.BIOC.indicator
      description: The BIOC indicator.
      type: String
  - arguments:
    - description: The BIOC name.
      name: name
      required: true
    - auto: PREDEFINED
      description: The BIOC severity.
      name: severity
      required: true
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - auto: PREDEFINED
      description: The BIOC type.
      name: type
      predefined:
      - other
      - persistence
      - evasion
      - tampering
      - file_type_obfuscation
      - privilege_escalation
      - credential_access
      - lateral_movement
      - execution
      - collection
      - exfiltration
      - infiltration
      - dropper
      - file_privilege_manipulation
      - reconnaissance
      - discovery
    - auto: PREDEFINED
      description: Whether the new BIOC is XQL.
      name: is_xql
      predefined:
      - 'true'
      - 'false'
    - description: The BIOC comment.
      name: comment
    - auto: PREDEFINED
      description: The BIOC status.
      name: status
      predefined:
      - enabled
      - disabled
    - description: |-
        The BIOC indicator,
        for example: '{\"runOnCGO\":true,\"investigationType\":\"FILE_EVENT\",\"investigation\":{\"FILE_EVENT\":{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"action_file_name\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":\"testfile.exe\"}]}}}}'.
        For more information, refer to the documentation https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Insert-or-update-BIOCs.
      isArray: true
      name: indicator
      required: true
    - description: "The MITRE technique ID and name. Must be in format 'ID - Name', for example: ['T1566 - Phishing']."
      isArray: true
      name: mitre_technique_id_and_name
    - description: "The MITRE tactic ID and name. Must be in format 'ID - Name', for example: ['TA0001 - Initial Access']."
      isArray: true
      name: mitre_tactic_id_and_name
    description: Creates a new BIOC.
    name: xdr-bioc-create
    outputs:
    - contextPath: PaloAltoNetworksXDR.BIOC.rule_id
      description: BIOC ID.
      type: String
  - arguments:
    - description: BIOC rule ID.
      name: rule_id
      required: true
    - description: BIOC name.
      name: name
      required: true
    - auto: PREDEFINED
      description: BIOC severity.
      name: severity
      required: true
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - auto: PREDEFINED
      description: BIOC type.
      name: type
      predefined:
      - other
      - persistence
      - evasion
      - tampering
      - file_type_obfuscation
      - privilege_escalation
      - credential_access
      - lateral_movement
      - execution
      - collection
      - exfiltration
      - infiltration
      - dropper
      - file_privilege_manipulation
      - reconnaissance
      - discovery
    - auto: PREDEFINED
      description: Whether the BIOC is XQL.
      name: is_xql
      predefined:
      - 'true'
      - 'false'
    - description: BIOC comment.
      name: comment
    - auto: PREDEFINED
      description: BIOC status.
      name: status
      predefined:
      - enabled
      - disabled
    - description: |-
        The BIOC indicator,
        for example: '{\"runOnCGO\":true,\"investigationType\":\"FILE_EVENT\",\"investigation\":{\"FILE_EVENT\":{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"action_file_name\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":\"testfile.exe\"}]}}}}'.
        For more information, refer to the documentation https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Insert-or-update-BIOCs.
      isArray: true
      name: indicator
      required: true
    - description: "The MITRE technique ID and name. Must be in format 'ID - Name', for example: ['T1566 - Phishing']."
      isArray: true
      name: mitre_technique_id_and_name
    - description: "The MITRE tactic ID and name. Must be in format 'ID - Name', for example: ['TA0001 - Initial Access']."
      isArray: true
      name: mitre_tactic_id_and_name
    description: Updates an existing BIOC.
    name: xdr-bioc-update
    outputs:
    - contextPath: PaloAltoNetworksXDR.BIOC.rule_id
      description: BIOC ID.
      type: String
  - arguments:
    - description: BIOC name.
      name: name
    - auto: PREDEFINED
      description: BIOC severity.
      name: severity
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - auto: PREDEFINED
      description: BIOC type.
      name: type
      predefined:
      - other
      - persistence
      - evasion
      - tampering
      - file_type_obfuscation
      - privilege_escalation
      - credential_access
      - lateral_movement
      - execution
      - collection
      - exfiltration
      - infiltration
      - dropper
      - file_privilege_manipulation
      - reconnaissance
      - discovery
    - auto: PREDEFINED
      description: Whether the BIOC is XQL.
      name: is_xql
      predefined:
      - 'true'
      - 'false'
    - description: BIOC comment.
      name: comment
    - description: BIOC indicator.
      isArray: true
      name: indicator
    - description: "The MITRE technique ID and name. Must be in format 'ID - Name', for example: ['T1566 - Phishing']."
      isArray: true
      name: mitre_technique_id_and_name
    - description: "The MITRE tactic ID and name. Must be in format 'ID - Name', for example: ['TA0001 - Initial Access']."
      isArray: true
      name: mitre_tactic_id_and_name
    description: Deletes a BIOC.
    name: xdr-bioc-delete
  - arguments:
    - description: Correlation rule name.
      name: name
    - auto: PREDEFINED
      description: Correlation rule severity.
      name: severity
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - description: Correlation rule XQL query.
      name: xql_query
    - auto: PREDEFINED
      description: Whether the correlation rule is XQL.
      name: is_xql
      predefined:
      - 'true'
      - 'false'
    - description: Correlation rule dataset.
      name: dataset
    - description: Alert name.
      name: alert_name
    - description: Alert category.
      name: alert_category
    - description: Alert fields. Can be a string or a dictionary.
      name: alert_fields
    - description: Alert domain.
      name: alert_domain
    - description: Filter JSON.
      name: filter_json
    - auto: PREDEFINED
      description: Whether to return extended view.
      name: extra_data
      predefined:
      - 'true'
      - 'false'
    - description: Maximum number of results to return.
      name: limit
    - description: Page size.
      name: page_size
    - description: Page number.
      name: page
    description: Returns a list of correlation rules.
    name: xdr-correlation-rule-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.suppression_duration
      description: The duration for which alerts are suppressed.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.alert_category
      description: The category of the alert (e.g., DROPPER).
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.mitre_defs
      description: MITRE ATT&CK definitions associated with the rule.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.simple_schedule
      description: The frequency at which the rule runs in a human-readable format.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.mapping_strategy
      description: The strategy used for field mapping.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.suppression_fields
      description: Fields used to determine alert suppression.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.alert_domain
      description: The security domain the alert belongs to.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.crontab
      description: The cron expression for the rule execution schedule.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.search_window
      description: The time window the query searches across.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.user_defined_severity
      description: Custom severity level defined by the user.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.drilldown_query_timeframe
      description: The timeframe used for drilldown queries.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.user_defined_category
      description: Custom category defined by the user.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.lookup_mapping
      description: Mapping details for lookups.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.execution_mode
      description: "How the rule is executed, for example: SCHEDULED."
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.name
      description: The name of the correlation rule.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.is_enabled
      description: Whether the correlation rule is currently active.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.investigation_query_link
      description: The query used for further investigation.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.alert_name
      description: The specific name assigned to the generated alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.suppression_enabled
      description: Whether suppression is enabled for this rule.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.action
      description: "The action taken when the rule triggers, for example: ALERTS."
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.dataset
      description: The dataset the rule queries.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.alert_description
      description: Detailed description of the generated alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.timezone
      description: The timezone used for the rule schedule.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.xql_query
      description: The XQL query string executed by the rule.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.alert_fields
      description: Specific fields included in the alert output.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.description
      description: General description of the correlation rule.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.alert_type
      description: The type of alert generated.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.severity
      description: The severity level of the rule.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.rule_id
      description: The unique identifier for the correlation rule.
      type: Number
  - arguments:
    - description: The correlation rule name.
      name: name
      required: true
    - auto: PREDEFINED
      description: 'The correlation rule severity. Example: severity=low.'
      name: severity
      required: true
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - description: 'The correlation rule XQL query. Example: xql_query="dataset = xdr_data | limit 1".'
      name: xql_query
      required: true
    - auto: PREDEFINED
      description: 'Whether the rule is enabled. Example: is_enabled=true.'
      name: is_enabled
      required: true
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: 'The alert category. Example: alert_category=dropper.'
      name: alert_category
      required: true
      predefined:
      - other
      - persistence
      - evasion
      - tampering
      - file_type_obfuscation
      - privilege_escalation
      - credential_access
      - lateral_movement
      - execution
      - collection
      - exfiltration
      - infiltration
      - dropper
      - file_privilege_manipulation
      - reconnaissance
      - discovery
    - auto: PREDEFINED
      description: 'The rule execution mode. Example: execution_mode=scheduled.'
      name: execution_mode
      required: true
      predefined:
      - scheduled
      - real_time
    - description: 'The correlation rule timezone. Example: timezone="Asia/Jerusalem".'
      name: timezone
      required: true
    - auto: PREDEFINED
      description: 'The rule mapping strategy. Example: mapping_strategy=auto.'
      name: mapping_strategy
      required: true
      predefined:
      - auto
      - custom
    - description: The correlation rule description.
      name: description
    - description: The alert name.
      name: alert_name
    - description: The alert description.
      name: alert_description
    - description: Alert fields (string or dictionary).
      name: alert_fields
    - description: 'The search window timeframe. Example: search_window="1 hours".'
      name: search_window
    - description: 'The correlation rule schedule. Example: schedule="10 minutes".'
      name: schedule
    - description: 'Linux scheduling for the rule. Example: schedule_linux="*/10 * * * *".'
      name: schedule_linux
    - auto: PREDEFINED
      description: Whether suppression is enabled.
      name: suppression_enabled
      predefined:
      - 'true'
      - 'false'
    - description: Duration of correlation rule suppression.
      name: suppression_duration
    - description: Suppression fields.
      name: suppression_fields
    - description: 'The correlation rule dataset. Example: dataset=alerts.'
      name: dataset
      required: true
    - description: User-defined severity.
      name: user_defined_severity
    - description: User-defined category.
      name: user_defined_category
    - description: "MITRE definitions. For example: '{\"TA0005 - Defense Evasion\": [\"T1014 - Rootkit\"]}'."
      name: mitre_defs_json
    - description: Investigation query link.
      name: investigation_query_link
    - description: 'The drilldown query timeframe. Example: drilldown_query_timeframe="ALERT".'
      name: drilldown_query_timeframe
    description: Creates a new correlation rule.
    name: xdr-correlation-rule-create
    outputs:
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.rule_id
      description: Correlation rule ID.
      type: String
  - arguments:
    - description: Correlation rule ID.
      name: rule_id
      required: true
    - description: The correlation rule name.
      name: name
      required: true
    - auto: PREDEFINED
      description: 'The correlation rule severity. Example: severity=low.'
      name: severity
      required: true
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - description: 'The correlation rule XQL query. Example: xql_query="dataset = xdr_data | limit 1".'
      name: xql_query
      required: true
    - auto: PREDEFINED
      description: 'Whether the rule is enabled. Example: is_enabled=true.'
      name: is_enabled
      required: true
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: 'The alert category. Example: alert_category=dropper.'
      name: alert_category
      required: true
      predefined:
      - other
      - persistence
      - evasion
      - tampering
      - file_type_obfuscation
      - privilege_escalation
      - credential_access
      - lateral_movement
      - execution
      - collection
      - exfiltration
      - infiltration
      - dropper
      - file_privilege_manipulation
      - reconnaissance
      - discovery
    - description: 'The rule execution mode. Example: execution_mode=scheduled.'
      name: execution_mode
      required: true
      predefined:
      - scheduled
      - real_time
    - description: 'The correlation rule timezone. Example: timezone="Asia/Jerusalem".'
      name: timezone
      required: true
    - auto: PREDEFINED
      description: 'The rule mapping strategy. Example: mapping_strategy=auto.'
      name: mapping_strategy
      required: true
      predefined:
      - auto
      - custom
    - description: The correlation rule description.
      name: description
    - description: The alert name.
      name: alert_name
    - description: The alert description.
      name: alert_description
    - description: Alert fields (string or dictionary).
      name: alert_fields
    - description: 'The search window timeframe. Example: search_window="1 hours".'
      name: search_window
    - description: 'The correlation rule schedule. Example: schedule="10 minutes".'
      name: schedule
    - description: 'Linux scheduling for the rule. Example: schedule_linux="*/10 * * * *".'
      name: schedule_linux
    - auto: PREDEFINED
      description: Whether suppression is enabled.
      name: suppression_enabled
      predefined:
      - 'true'
      - 'false'
    - description: Duration of correlation rule suppression.
      name: suppression_duration
    - description: Suppression fields.
      name: suppression_fields
    - description: 'The correlation rule dataset. Example: dataset=alerts.'
      name: dataset
      required: true
    - description: User-defined severity.
      name: user_defined_severity
    - description: User-defined category.
      name: user_defined_category
    - description: "MITRE definitions. For example: '{\"TA0005 - Defense Evasion\": [\"T1014 - Rootkit\"]}'."
      name: mitre_defs_json
    - description: Investigation query link.
      name: investigation_query_link
    - description: 'The drilldown query timeframe. Example: drilldown_query_timeframe="ALERT".'
      name: drilldown_query_timeframe
    description: Updates an existing correlation rule.
    name: xdr-correlation-rule-update
    outputs:
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.rule_id
      description: Correlation rule ID.
      type: String
  - arguments:
    - description: Correlation rule ID.
      isArray: true
      name: rule_id
      required: true
    description: Deletes correlation rules.
    name: xdr-correlation-rule-delete
  - arguments:
    - description: The vulnerability ID to retrieve details for.
      name: vulnerability_id
      required: true
    description: Gets vulnerability details by ID.
    name: xdr-vulnerability-details-get
    outputs:
    - contextPath: PaloAltoNetworksXDR.Vulnerability.vulnerabilityID
      description: The unique identifier (CVE ID).
      type: String
    - contextPath: PaloAltoNetworksXDR.Vulnerability.description
      description: Detailed description of the vulnerability.
      type: String
    - contextPath: PaloAltoNetworksXDR.Vulnerability.publishedDate
      description: The date the vulnerability was first published.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Vulnerability.epss_score
      description: The Probability of exploitability (0-1).
      type: Number
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.exploitMaturity
      description: Current state of exploit availability (e.g., weaponized).
      type: String
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.weaponizedExploitFound
      description: Whether a functional exploit exists in the wild.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.reportedExploited
      description: Whether the vulnerability has been actively exploited.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.reportedExploitedByThreatActors
      description: Whether known threat actors are exploiting this vulnerability.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.reportedExploitedByRansomware
      description: Whether the vulnerability is used in ransomware campaigns.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.reportedExploitedByBotnets
      description: Whether the vulnerability is being leveraged by botnet clusters.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.firstReportedThreatActor
      description: The timestamp of the first recorded threat actor activity.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.mostRecentReportedThreatActor
      description: The timestamp of the last recorded threat actor activity.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Vulnerability.cisaKevDateDue
      description: The deadline set by CISA for federal agency remediation.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Vulnerability.weaknesses.cweId
      description: The Common Weakness Enumeration ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.Vulnerability.vulncheck-threat-actors
      description: A list of specific threat actor groups associated with the vulnerability.
      type: String
  - description: Runs a system health check on the Cortex XDR environment.
    name: xdr-healthcheck-run
    outputs:
    - contextPath: PaloAltoNetworksXDR.HealthStatus.status
      description: The health status of the Cortex XDR system.
      type: String
  - description: Gets a list of available triage presets.
    name: xdr-endpoint-triage-preset-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.EndpointTriagePreset.created_by
      description: The user or system entity that created the triage preset.
      type: String
    - contextPath: PaloAltoNetworksXDR.EndpointTriagePreset.description
      description: A brief explanation of the preset's purpose or contents.
      type: String
    - contextPath: PaloAltoNetworksXDR.EndpointTriagePreset.name
      description: The unique display name of the triage preset.
      type: String
    - contextPath: PaloAltoNetworksXDR.EndpointTriagePreset.os
      description: The operating system platform the preset targets (e.g., windows, linux, macos).
      type: String
    - contextPath: PaloAltoNetworksXDR.EndpointTriagePreset.type
      description: The category or classification of the preset (e.g., standard, custom).
      type: String
    - contextPath: PaloAltoNetworksXDR.EndpointTriagePreset.uuid
      description: The unique universal identifier (UUID) assigned to this specific preset.
      type: String
  - arguments:
    - description: A comma-separated list of endpoint IDs to initiate triage on. You can find the endpoint ID under the "Inventory" section, under "All Endpoints".
      isArray: true
      name: endpoint_id
      required: true
    - description: The collector UUID to use for the triage.
      name: collector_uuid
    description: Initiates a forensics triage on the specified endpoints. You must have Cortex XDR with the Forensics add-on. The agent also must have the Forensics License enabled.
    name: xdr-endpoint-triage
    outputs:
    - contextPath: PaloAltoNetworksXDR.EndpointTriage.TRIAGE_ID
      description: The unique identifier assigned to the created triage action.
      type: String
    - contextPath: PaloAltoNetworksXDR.EndpointTriage.SUCCESSFUL_AGENT_IDS
      description: A list of agent IDs where the triage action was successfully initiated.
      type: Array
    - contextPath: PaloAltoNetworksXDR.EndpointTriage.UNSUCCESSFUL_AGENT_IDS
      description: A list of agent IDs where the triage action failed to initiate.
      type: Array
  - name: xdr-issue-list
    description: Retrieve issues based on filters. Issues with an 'INFO' severity level are filtered out.
    arguments:
    - name: issue_id
      description: A comma-separated list of issue IDs.
      isArray: true
    - name: external_id
      description: A comma-separated list of external IDs.
      isArray: true
    - name: detection_method
      description: "A comma-separated list of methods used to detect the activity. Possible values: 'BIOC', 'Correlation', 'Analytics', 'System', 'IOC'."
      auto: PREDEFINED
      isArray: true
      predefined:
      - BIOC
      - Correlation
      - Analytics
      - System
      - IOC
    - name: domain
      description: A comma-separated list of domains.
      isArray: true
    - name: severity
      description: "A comma-separated list of severities. Possible values: 'critical', 'high', 'medium', 'low', 'info'."
      auto: PREDEFINED
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - name: insert_time
      description: Filter by issues inserted after this time.
    - name: status
      description: "A comma-separated list of statuses. Possible values: 'new', 'in_progress', 'resolved'."
      auto: PREDEFINED
      predefined:
      - new
      - in_progress
      - resolved
      isArray: true
    - name: sort_field
      description: The field to sort by.
      auto: PREDEFINED
      predefined:
      - issue_id
      - severity
      - observation_time
    - name: sort_order
      description: The sort order.
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - name: limit
      description: The maximum number of results to return.
    - name: page_size
      description: The page size.
    - name: page
      description: The page number.
    outputs:
    - contextPath: PaloAltoNetworksXDR.Issue.observation_time
      description: The timestamp when the observation occurred.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Issue.domain
      description: The security domain associated with the observation.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.remediation
      description: Suggested remediation steps.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.impact
      description: The potential impact of the observed activity.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.status
      description: The current progress status (e.g., New).
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.status_resolution_comment
      description: Comments regarding the resolution of the status.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.status_progress
      description: The current progress status (e.g., New).
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.asset_ids
      description: List of asset IDs involved.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.assigned_to_pretty
      description: The display name of the user assigned to this item.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.last_update_timestamp
      description: The last time this record was updated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Issue.detection_method
      description: The method used to detect the activity (e.g., BIOC).
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.is_starred
      description: Whether the item has been starred/flagged.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Issue.name
      description: The name of the observation or alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.external_id
      description: The unique UUID for external reference.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.insert_time
      description: The time the record was inserted into the database.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Issue.detection_rule_id
      description: The ID of the specific detection rule triggered.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.tags
      description: A list of tags associated with the observation.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.type
      description: The classification type of the observation.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.id
      description: The numeric ID of the observation.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Issue.description
      description: Detailed description of the observed activity.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.severity
      description: The severity level (e.g., LOW).
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.category
      description: The category classification.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.is_excluded
      description: Whether this observation is excluded from standard views.
      type: Boolean
  - name: xdr-issue-create
    description: Creates a new issue. Issues with an 'INFO' severity level are not displayed in the UI.
    arguments:
    - name: name
      description: The issue name.
      required: true
    - name: description
      description: The issue description.
      required: true
    - name: observation_time
      description: The observation time. Supports natural language expressions such as "one year".
      required: true
    - name: domain
      description: The domain.
      required: true
    - name: category
      description: The category.
      required: true
    - name: asset_id
      description: A comma-separated list of asset IDs.
      isArray: true
    - name: mitre_tactic
      description: A comma-separated list of MITRE tactics.
      isArray: true
    - name: mitre_technique
      description: A comma-separated list of MITRE techniques.
      isArray: true
    - name: type
      description: The issue type.
    - name: extended_description
      description: The extended description.
    - name: impact
      description: The impact.
    - name: tags
      description: A comma-separated list of tags.
      isArray: true
    - name: is_excluded
      description: Whether the issue is excluded.
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: is_starred
      description: Whether the issue is starred.
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: assigned_to
      description: The user assigned to the issue.
    - name: assigned_to_pretty
      description: The pretty name of the user assigned to the issue.
    - name: severity
      description: The severity.
      required: true
      auto: PREDEFINED
      predefined:
      - critical
      - info
      - low
      - medium
      - high
    - name: normalized_fields_json
      description: The JSON to add to the "normalized_fields" field in the API.
    - name: custom_fields_json
      description: The JSON to add to the "custom_fields" field in the API.
    outputs:
    - contextPath: PaloAltoNetworksXDR.Issue.external_id
      description: The issue external ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.detection_method
      description: The issue detection method.
      type: String
  - name: xdr-issue-update
    description: Updates an existing issue.
    arguments:
    - name: issue_id
      description: The issue ID.
      required: true
    - name: severity
      description: The severity.
      auto: PREDEFINED
      predefined:
      - critical
      - info
      - low
      - medium
      - high
    - name: status
      description: The status.
      auto: PREDEFINED
      predefined:
      - new
      - in_progress
      - resolved
    - name: resolve_reason
      description: The resolve reason.
      auto: PREDEFINED
      predefined:
      - resolved_threat_handled
      - resolved_known_issue
      - resolved_duplicate
      - resolved_false_positive
      - resolved_other
      - resolved_true_positive
      - resolved_security_testing
    - name: resolve_comment
      description: The resolve comment.
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  isfetch:xpanse: false
  script: ''
  subtype: python3
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  type: python
tests:
- Test XDR Playbook execute script commands
- Test XDR Playbook quarantine file command
- Test XDR Playbook general commands
- Test XDR Playbook retrieve file command
defaultmapperin: Cortex XDR - IR-mapper
defaultmapperout: Cortex XDR - IR-out-mapper
fromversion: 5.0.0