Cortex XDR - IR CTF

Cortex XDR is the world's first detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks.

Endpoint · Capture The Flag - 01

Details

IDCortex XDR - IR CTF
ProviderPalo Alto Networks
CategoryEndpoint
From Version8.2.0
Docker Imagedemisto/python3:3.12.13.10116658

README

This integration is a Mock customized only for the Capture The Flag challenge.

Commands

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

get-mapping-fields

Gets mapping fields from remote incident. Note: This method will not update the current incident, it’s here for debugging purposes.

Base Command

get-mapping-fields

Input

| Argument Name | Description | Required |
| — | — | — |

Context Output

There is no context output for this command.

xdr-get-incident-extra-data-ctf

Returns additional data for the specified incident, for example, related alerts, file artifacts, network artifacts, and so on.

Base Command

xdr-get-incident-extra-data-ctf

Input

Argument Name Description Required
incident_id The ID of the incident for which to get additional data. Required
alerts_limit Maximum number of alerts to return. Default is 1000. Optional
return_only_updated_incident Return data only if the incident was changed since the last time it was mirrored into Cortex XSOAR. This flag should be used only from within a Cortex XDR incident. Default is False. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.Incident.incident_id String Unique ID assigned to each returned incident.
PaloAltoNetworksXDR.Incident.creation_time Date Date and time the incident was created on Cortex XDR.
PaloAltoNetworksXDR.Incident.modification_time Date Date and time that the incident was last modified.
PaloAltoNetworksXDR.Incident.detection_time Date Date and time that the first alert occurred in the incident.
PaloAltoNetworksXDR.Incident.status String Current status of the incident. Valid values are:
“new”,”under_investigation”,”resolved_known_issue”,”resolved_duplicate”,”resolved_false_positive”,”resolved_true_positive”,”resolved_security_testing”,”resolved_other”.    
PaloAltoNetworksXDR.Incident.severity String Calculated severity of the incident. Valid values are: “low”,”medium”,”high”.
PaloAltoNetworksXDR.Incident.description String Dynamic calculated description of the incident.
PaloAltoNetworksXDR.Incident.assigned_user_mail String Email address of the assigned user.
PaloAltoNetworksXDR.Incident.assigned_user_pretty_name String Full name of the user assigned to the incident.
PaloAltoNetworksXDR.Incident.alert_count Number Total number of alerts in the incident.
PaloAltoNetworksXDR.Incident.low_severity_alert_count Number Number of alerts with the severity LOW.
PaloAltoNetworksXDR.Incident.med_severity_alert_count Number Number of alerts with the severity MEDIUM.
PaloAltoNetworksXDR.Incident.high_severity_alert_count Number Number of alerts with the severity HIGH.
PaloAltoNetworksXDR.Incident.user_count Number Number of users involved in the incident.
PaloAltoNetworksXDR.Incident.host_count Number Number of hosts involved in the incident.
PaloAltoNetworksXDR.Incident.notes Unknown Comments entered by the user regarding the incident.
PaloAltoNetworksXDR.Incident.resolve_comment String Comments entered by the user when the incident was resolved.
PaloAltoNetworksXDR.Incident.manual_severity String Incident severity assigned by the user. This does not affect the calculated severity of low, medium, or high.
PaloAltoNetworksXDR.Incident.manual_description String Incident description provided by the user.
PaloAltoNetworksXDR.Incident.xdr_url String A link to the incident view on Cortex XDR.
PaloAltoNetworksXDR.Incident.starred Boolean Incident starred.
PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_techniques_ids_and_names String Incident Mitre techniques IDs and names.
PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_tactics_ids_and_names String Incident Mitre tactics ids and names.
PaloAltoNetworksXDR.Incident.alerts.alert_id String Unique ID for each alert.
PaloAltoNetworksXDR.Incident.alerts.detection_timestamp Date Date and time that the alert occurred.
PaloAltoNetworksXDR.Incident.alerts.source String Source of the alert. The product/vendor this alert came from.
PaloAltoNetworksXDR.Incident.alerts.severity String Severity of the alert.Valid values are: “low”,”medium”,”high”””.
PaloAltoNetworksXDR.Incident.alerts.name String Calculated name of the alert.
PaloAltoNetworksXDR.Incident.alerts.category String Category of the alert, for example, Spyware Detected via Anti-Spyware profile.
PaloAltoNetworksXDR.Incident.alerts.description String Textual description of the alert.
PaloAltoNetworksXDR.Incident.alerts.host_ip_list Unknown Host IP involved in the alert.
PaloAltoNetworksXDR.Incident.alerts.host_name String Host name involved in the alert.
PaloAltoNetworksXDR.Incident.alerts.user_name String User name involved with the alert.
PaloAltoNetworksXDR.Incident.alerts.event_type String Event type. Valid values are: “Process Execution”,”Network Event”,”File Event”,”Registry Event”,”Injection Event”,”Load Image Event”,”Windows Event Log”.
PaloAltoNetworksXDR.Incident.alerts.action String The action that triggered the alert. Valid values are: “REPORTED”, “BLOCKED”, “POST_DETECTED”, “SCANNED”, “DOWNLOAD”, “PROMPT_ALLOW”, “PROMPT_BLOCK”, “DETECTED”, “BLOCKED_1”, “BLOCKED_2”, “BLOCKED_3”, “BLOCKED_5”, “BLOCKED_6”, “BLOCKED_7”, “BLOCKED_8”, “BLOCKED_9”, “BLOCKED_10”, “BLOCKED_11”, “BLOCKED_13”, “BLOCKED_14”, “BLOCKED_15”, “BLOCKED_16”, “BLOCKED_17”, “BLOCKED_24”, “BLOCKED_25”, “DETECTED_0”, “DETECTED_4”, “DETECTED_18”, “DETECTED_19”, “DETECTED_20”, “DETECTED_21”, “DETECTED_22”, “DETECTED_23”.
PaloAltoNetworksXDR.Incident.alerts.action_pretty String The action that triggered the alert. Valid values are: “Detected (Reported)” “Prevented (Blocked)” “Detected (Post Detected)” “Detected (Scanned)” “Detected (Download)” “Detected (Prompt Allow)” “Prevented (Prompt Block)” “Detected” “Prevented (Denied The Session)” “Prevented (Dropped The Session)” “Prevented (Dropped The Session And Sent a TCP Reset)” “Prevented (Blocked The URL)” “Prevented (Blocked The IP)” “Prevented (Dropped The Packet)” “Prevented (Dropped All Packets)” “Prevented (Terminated The Session And Sent a TCP Reset To Both Sides Of The Connection)” “Prevented (Terminated The Session And Sent a TCP Reset To The Client)” “Prevented (Terminated The Session And Sent a TCP Reset To The Server)” “Prevented (Continue)” “Prevented (Block-Override)” “Prevented (Override-Lockout)” “Prevented (Override)” “Prevented (Random-Drop)” “Prevented (Silently Dropped The Session With An ICMP Unreachable Message To The Host Or Application)” “Prevented (Block)” “Detected (Allowed The Session)” “Detected (Raised An Alert)” “Detected (Syncookie Sent)” “Detected (Forward)” “Detected (Wildfire Upload Success)” “Detected (Wildfire Upload Failure)” “Detected (Wildfire Upload Skip)” “Detected (Sinkhole)”.
PaloAltoNetworksXDR.Incident.alerts.actor_process_image_name String Image name.
PaloAltoNetworksXDR.Incident.alerts.actor_process_command_line String Command line.
PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_status String Signature status. Valid values are: “Signed” “Invalid Signature” “Unsigned” “Revoked” “Signature Fail” “N/A” “Weak Hash”.
PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_vendor String Signature vendor name.
PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_image_name String Image name.
PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_line String Command line.
PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_status String Signature status. Valid values are: “Signed” “Invalid Signature” “Unsigned” “Revoked” “Signature Fail” “N/A” “Weak Hash”.
PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_vendor String Signature vendor.
PaloAltoNetworksXDR.Incident.alerts.causality_actor_causality_id Unknown Causality ID.
PaloAltoNetworksXDR.Incident.alerts.action_process_image_name String Image name.
PaloAltoNetworksXDR.Incident.alerts.action_process_image_command_line String Command line.
PaloAltoNetworksXDR.Incident.alerts.action_process_image_sha256 String Image SHA256.
PaloAltoNetworksXDR.Incident.alerts.action_process_signature_status String Signature status. Valid values are: “Signed” “Invalid Signature” “Unsigned” “Revoked” “Signature Fail” “N/A” “Weak Hash”.
PaloAltoNetworksXDR.Incident.alerts.action_process_signature_vendor String Signature vendor name.
PaloAltoNetworksXDR.Incident.alerts.action_file_path String File path.
PaloAltoNetworksXDR.Incident.alerts.action_file_md5 String File MD5.
PaloAltoNetworksXDR.Incident.alerts.action_file_sha256 String File SHA256.
PaloAltoNetworksXDR.Incident.alerts.action_registry_data String Registry data.
PaloAltoNetworksXDR.Incident.alerts.action_registry_full_key String Registry full key.
PaloAltoNetworksXDR.Incident.alerts.action_local_ip String Local IP.
PaloAltoNetworksXDR.Incident.alerts.action_local_port Number Local port.
PaloAltoNetworksXDR.Incident.alerts.action_remote_ip String Remote IP.
PaloAltoNetworksXDR.Incident.alerts.action_remote_port Number Remote port.
PaloAltoNetworksXDR.Incident.alerts.action_external_hostname String External hostname.
PaloAltoNetworksXDR.Incident.alerts.fw_app_id Unknown Firewall app id.
PaloAltoNetworksXDR.Incident.alerts.is_whitelisted String Is the alert on allow list. Valid values are: “Yes” “No”.
PaloAltoNetworksXDR.Incident.alerts.starred Boolean Alert starred.
PaloAltoNetworksXDR.Incident.network_artifacts.type String Network artifact type.
PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_port number The remote port related to the artifact.
PaloAltoNetworksXDR.Incident.network_artifacts.alert_count number Number of alerts related to the artifact.
PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_ip String The remote IP related to the artifact.
PaloAltoNetworksXDR.Incident.network_artifacts.is_manual boolean Whether the artifact was created by the user (manually).
PaloAltoNetworksXDR.Incident.network_artifacts.network_domain String The domain related to the artifact.
PaloAltoNetworksXDR.Incident.network_artifacts.type String The artifact type. Valid values are: “META”, “GID”, “CID”, “HASH”, “IP”, “DOMAIN”, “REGISTRY”, “HOSTNAME”.
PaloAltoNetworksXDR.Incident.network_artifacts.network_country String The country related to the artifact.
PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_status String Digital signature status of the file. Valid values are: “SIGNATURE_UNAVAILABLE” “SIGNATURE_SIGNED” “SIGNATURE_INVALID” “SIGNATURE_UNSIGNED” “SIGNATURE_WEAK_HASH”.
PaloAltoNetworksXDR.Incident.file_artifacts.is_process boolean Whether the file artifact is related to a process execution.
PaloAltoNetworksXDR.Incident.file_artifacts.file_name String Name of the file.
PaloAltoNetworksXDR.Incident.file_artifacts.file_wildfire_verdict String The file verdict, calculated by Wildfire. Valid values are: “BENIGN” “MALWARE” “GRAYWARE” “PHISHING” “UNKNOWN”.
PaloAltoNetworksXDR.Incident.file_artifacts.alert_count number Number of alerts related to the artifact.
PaloAltoNetworksXDR.Incident.file_artifacts.is_malicious boolean Whether the artifact is malicious, as decided by the Wildfire verdict.
PaloAltoNetworksXDR.Incident.file_artifacts.is_manual boolean Whether the artifact was created by the user (manually).
PaloAltoNetworksXDR.Incident.file_artifacts.type String The artifact type. Valid values are: “META” “GID” “CID” “HASH” “IP” “DOMAIN” “REGISTRY” “HOSTNAME”.
PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256 String SHA256 hash of the file.
PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_vendor_name String File signature vendor name.
Account.Username String The username in the relevant system.
Endpoint.Hostname String The hostname that is mapped to this endpoint.
File.Path String The path where the file is located.
File.MD5 String The MD5 hash of the file.
File.SHA256 String The SHA256 hash of the file.
File.Name String The full file name (including file extension).
Process.Name String The name of the process.
Process.MD5 String The MD5 hash of the process.
Process.SHA256 String The SHA256 hash of the process.
Process.PID String The PID of the process.
Process.Path String The file system path to the binary file.
Process.Start Time String The timestamp of the process start time.
Process.CommandLine String The full command line (including arguments).
IP.Address String IP address.
IP.Geo.Country String The country in which the IP address is located.
Domain.Name String The domain name, for example: “google.com”.

xdr-endpoint-isolate-ctf

Isolates the specified endpoint.

Base Command

xdr-endpoint-isolate-ctf

Input

Argument Name Description Required
incident_id Allows linking the response action to the incident that triggered it. Optional
endpoint_id The endpoint ID (string) to isolate. You can retrieve the string from the xdr-get-endpoints command. Required
suppress_disconnected_endpoint_error Whether to suppress an error when trying to isolate a disconnected endpoint. When sets to false, an error will be returned. Possible values are: true, false. Default is false. Optional
interval_in_seconds Interval in seconds between each poll. Optional
timeout_in_seconds Polling timeout in seconds. Optional
action_id For polling use. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.Isolation.endpoint_id String The endpoint ID.

xdr-file-retrieve-ctf

Retrieves files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. At least one endpoint ID and one file path are necessary in order to run the command. After running this command, you can use the xdr-action-status-get command with returned action_id, to check the action status.

Base Command

xdr-file-retrieve-ctf

Input

Argument Name Description Required
endpoint_ids A comma-separated list of endpoint IDs. Required
generic_file_path A comma-separated list of file paths in any platform. Can be used instead of the mac/windows/linux file paths. The order of the files path list must be parallel to the endpoints list order, so the first file path in the list is related to the first endpoint and so on. Required

Context Output

Path Type Description
PaloAltoNetworksXDR.RetrievedFiles.action_id string ID of the action to retrieve files from selected endpoints.
PaloAltoNetworksXDR.RetrievedFiles.endpoint_id string Endpoint ID. Added only when the operation is successful.
PaloAltoNetworksXDR.RetrievedFiles.file_link string Link to the file. Added only when the operation is successful.
PaloAltoNetworksXDR.RetrievedFiles.status string The action status. Added only when the operation is unsuccessful.

xdr-get-alerts-ctf

Returns a list of alerts and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object.
Multiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value.

Base Command

xdr-get-alerts-ctf

Input

Argument Name Description Required
alert_id The unique ID of the alert. Optional
severity The severity of the alert. Possible values are: low, medium, high. Optional
custom_filter a custom filter, when using this argument, other filter arguments are not relevant. example:
{<br/> "OR": [<br/> {<br/> "SEARCH_FIELD": "actor_process_command_line",<br/> "SEARCH_TYPE": "EQ",<br/> "SEARCH_VALUE": "path_to_file"<br/> }<br/> ]<br/> }.		 Optional
Identity_type Account type. Possible values are: ANONYMOUS, APPLICATION, COMPUTE, FEDERATED_IDENTITY, SERVICE, SERVICE_ACCOUNT, TEMPORARY_CREDENTIALS, TOKEN, UNKNOWN, USER. Optional
agent_id A unique identifier per agent. Optional
action_external_hostname The host name to connect to. In case of a proxy connection, this value will differ from action_remote_ip. Optional
rule_id A string identifying the user rule. Optional
rule_name The name of the user rule. Optional
alert_name The alert name. Optional
alert_source The alert source. Optional
time_frame Supports relative times or “custom” time option. If you choose the “custom” option, you should use start_time and end_time arguments. Possible values are: 60 minutes, 3 hours, 12 hours, 24 hours, 2 days, 7 days, 14 days, 30 days, custom. Optional
user_name The name assigned to the user_id during agent runtime. Optional
actor_process_image_name The file name of the binary file. Optional
causality_actor_process_image_command_line CGO CMD. Optional
actor_process_image_command_line Trimmed to 128 unicode chars during event serialization.
Full value reported as part of the original process event.		 Optional
action_process_image_command_line The command line of the process created. Optional
actor_process_image_sha256 SHA256 of the binary file. Optional
causality_actor_process_image_sha256 SHA256 of the binary file. Optional
action_process_image_sha256 SHA256 of the binary file. Optional
action_file_image_sha256 SHA256 of the file related to the event. Optional
action_registry_name The name of the registry. Optional
action_registry_key_data The key data of the registry. Optional
host_ip The host IP. Optional
action_local_ip The local IP address for the connection. Optional
action_remote_ip Remote IP address for the connection. Optional
alert_action_status Alert action status. Possible values are: detected, detected (allowed the session), detected (download), detected (forward), detected (post detected), detected (prompt allow), detected (raised an alert), detected (reported), detected (on write), detected (scanned), detected (sinkhole), detected (syncookie sent), detected (wildfire upload failure), detected (wildfire upload success), detected (wildfire upload skip), detected (xdr managed threat hunting), prevented (block), prevented (blocked), prevented (block-override), prevented (blocked the url), prevented (blocked the ip), prevented (continue), prevented (denied the session), prevented (dropped all packets), prevented (dropped the session), prevented (dropped the session and sent a tcp reset), prevented (dropped the packet), prevented (override), prevented (override-lockout), prevented (post detected), prevented (prompt block), prevented (random-drop), prevented (silently dropped the session with an icmp unreachable message to the host or application), prevented (terminated the session and sent a tcp reset to both sides of the connection), prevented (terminated the session and sent a tcp reset to the client), prevented (terminated the session and sent a tcp reset to the server), prevented (on write). Optional
action_local_port The local IP address for the connection. Optional
action_remote_port The remote port for the connection. Optional
dst_action_external_hostname The hostname we connect to. In case of a proxy connection, this value will differ from action_remote_ip. Optional
sort_field The field by which we sort the results. Default is source_insert_ts. Optional
sort_order The order in which we sort the results. Possible values are: DESC, ASC. Optional
offset The first page from which we bring the alerts. Default is 0. Optional
limit The last page from which we bring the alerts. Default is 50. Optional
start_time Relevant when “time_frame” argument is “custom”. Supports Epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss.000Z). Optional
end_time Relevant when “time_frame” argument is “custom”. Supports Epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss.000Z). Optional
starred Whether the alert is starred or not. Possible values are: true, false. Optional
mitre_technique_id_and_name The MITRE attack technique. Optional

Context Output

Path Type Description
PaloAltoNetworksXDR.Alert.internal_id String The unique ID of the alert.
PaloAltoNetworksXDR.Alert.source_insert_ts Number The detection timestamp.
PaloAltoNetworksXDR.Alert.alert_name String The name of the alert.
PaloAltoNetworksXDR.Alert.severity String The severity of the alert.
PaloAltoNetworksXDR.Alert.alert_category String The category of the alert.
PaloAltoNetworksXDR.Alert.alert_action_status String The alert action. Possible values.

DETECTED: detected
DETECTED_0: detected (allowed the session)
DOWNLOAD: detected (download)
DETECTED_19: detected (forward)
POST_DETECTED: detected (post detected)
PROMPT_ALLOW: detected (prompt allow)
DETECTED_4: detected (raised an alert)
REPORTED: detected (reported)
REPORTED_TRIGGER_4: detected (on write)
SCANNED: detected (scanned)
DETECTED_23: detected (sinkhole)
DETECTED_18: detected (syncookie sent)
DETECTED_21: detected (wildfire upload failure)
DETECTED_20: detected (wildfire upload success)
DETECTED_22: detected (wildfire upload skip)
DETECTED_MTH: detected (xdr managed threat hunting)
BLOCKED_25: prevented (block)
BLOCKED: prevented (blocked)
BLOCKED_14: prevented (block-override)
BLOCKED_5: prevented (blocked the url)
BLOCKED_6: prevented (blocked the ip)
BLOCKED_13: prevented (continue)
BLOCKED_1: prevented (denied the session)
BLOCKED_8: prevented (dropped all packets)
BLOCKED_2: prevented (dropped the session)
BLOCKED_3: prevented (dropped the session and sent a tcp reset)
BLOCKED_7: prevented (dropped the packet)
BLOCKED_16: prevented (override)
BLOCKED_15: prevented (override-lockout)
BLOCKED_26: prevented (post detected)
PROMPT_BLOCK: prevented (prompt block)
BLOCKED_17: prevented (random-drop)
BLOCKED_24: prevented (silently dropped the session with an icmp unreachable message to the host or application)
BLOCKED_9: prevented (terminated the session and sent a tcp reset to both sides of the connection)
BLOCKED_10: prevented (terminated the session and sent a tcp reset to the client)
BLOCKED_11: prevented (terminated the session and sent a tcp reset to the server)
BLOCKED_TRIGGER_4: prevented (on write). |
| PaloAltoNetworksXDR.Alert.alert_action_status_readable | String | The alert action. |
| PaloAltoNetworksXDR.Alert.alert_name | String | The alert name. |
| PaloAltoNetworksXDR.Alert.alert_description | String | The alert description. |
| PaloAltoNetworksXDR.Alert.agent_ip_addresses | String | The host IP. |
| PaloAltoNetworksXDR.Alert.agent_hostname | String | The host name. |
| PaloAltoNetworksXDR.Alert.mitre_tactic_id_and_name | String | The MITRE attack tactic. |
| PaloAltoNetworksXDR.Alert.mitre_technique_id_and_name | String | The MITRE attack technique. |
| PaloAltoNetworksXDR.Alert.starred | Boolean | Whether the alert is starred or not. |

Configuration parameters

  • isFetch — Fetch incidents
  • incidentType — Incident type
  • mirror_direction — Incident Mirroring Direction
  • timeout — HTTP Timeout
  • max_fetch — Maximum number of incidents per fetch
  • starred — Only fetch starred incidents
  • starred_incidents_fetch_window — Starred incidents fetch window
  • fetch_time — First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  • sync_owners — Sync Incident Owners
  • insecure — Trust any certificate (not secure)
  • proxy — Use system proxy settings
  • prevent_only — Prevent Only Mode
  • status — Incident Statuses to Fetch
  • incidentFetchInterval — Incidents Fetch Interval

Commands (5)

  • get-mapping-fields

    Gets mapping fields from remote incident. Note: This method will not update the current incident, it's here for debugging purposes.

  • xdr-endpoint-isolate-ctf

    Isolates the specified endpoint.

  • xdr-file-retrieve-ctf

    Retrieves files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. At least one endpoint ID and one file path are necessary in order to run the command. After running this command, you can use the xdr-action-status-get command with returned action_id, to check the action status.

  • xdr-get-alerts-ctf

    Returns a list of alerts and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. Multiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value.

  • xdr-get-incident-extra-data-ctf

    Returns additional data for the specified incident, for example, related alerts, file artifacts, network artifacts, and so on.

Source

CortexXDRIRCTF.py CortexXDRIRCTF_test.py CortexXDRIRCTF.yml CortexXDRIRCTF_description.md
Download History Raw 
commonfields:
  id: Cortex XDR - IR CTF
  version: -1
name: Cortex XDR - IR CTF
display: Cortex XDR - IR CTF
category: Endpoint
provider: Palo Alto Networks
description: Cortex XDR is the world's first detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks.
sectionorder:
- Collect
configuration:
- display: Fetch incidents
  name: isFetch
  defaultvalue: "true"
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incident Mirroring Direction
  name: mirror_direction
  defaultvalue: None
  type: 15
  required: false
  options:
  - None
  - Incoming
  - Outgoing
  - Both
  section: Collect
- display: HTTP Timeout
  name: timeout
  defaultvalue: "120"
  type: 0
  required: false
  additionalinfo: The timeout of the HTTP requests sent to Cortex XDR API (in seconds).
  section: Collect
- display: Maximum number of incidents per fetch
  name: max_fetch
  defaultvalue: "201"
  type: 0
  required: false
  additionalinfo: The maximum number of incidents per fetch. Cannot exceed 100.
  section: Collect
- display: Only fetch starred incidents
  name: starred
  type: 8
  required: false
  section: Collect
- display: Starred incidents fetch window
  name: starred_incidents_fetch_window
  defaultvalue: 3 days
  type: 0
  required: false
  additionalinfo: Starred fetch window timestamp (<number> <time unit>, e.g., 12 hours, 7 days). Fetches only starred incidents within the specified time range.
  section: Collect
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  defaultvalue: 3 days
  type: 0
  required: false
  section: Collect
- display: Sync Incident Owners
  name: sync_owners
  type: 8
  required: false
  additionalinfo: For Cortex XSOAR version 6.0.0 and above. If selected, for every incident fetched from Cortex XDR to Cortex XSOAR, the incident owners will be synced. Note that once this value is changed and synchronized between the systems, additional changes will not be reflected. For example, if you change the owner in Cortex XSOAR, the new owner will also be changed in Cortex XDR. However, if you now change the owner back in Cortex XDR, this additional change will not be reflected in Cortex XSOAR. In addition, for this change to be reflected, the owners must exist in both Cortex XSOAR and Cortex XDR.
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Collect
- display: Prevent Only Mode
  name: prevent_only
  type: 8
  required: false
  additionalinfo: Whether the XDR tenant Mode is prevent only
  section: Collect
- display: Incident Statuses to Fetch
  name: status
  type: 16
  required: false
  options:
  - new
  - under_investigation
  - resolved_known_issue
  - resolved_false_positive
  - resolved_true_positive
  - resolved_security_testing
  - resolved_other
  - resolved_auto
  additionalinfo: 'The statuses of the incidents that will be fetched. If no status is provided then incidents of all the statuses will be fetched. Note: An incident whose status was changed to a filtered status after its creation time will not be fetched.'
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "500000000000"
  type: 19
  required: false
  section: Collect
script:
  script: ''
  type: python
  commands:
  - description: "Gets mapping fields from remote incident. Note: This method will not update the current incident, it's here for debugging purposes."
    name: get-mapping-fields
    arguments: []
  - name: xdr-get-incident-extra-data-ctf
    arguments:
    - name: incident_id
      required: true
      description: The ID of the incident for which to get additional data.
    - name: alerts_limit
      description: Maximum number of alerts to return.
      defaultValue: "1000"
    - name: return_only_updated_incident
      description: Return data only if the incident was changed since the last time it was mirrored into Cortex XSOAR.  This flag should be used only from within a Cortex XDR incident.
      defaultValue: "False"
    outputs:
    - contextPath: PaloAltoNetworksXDR.Incident.incident_id
      description: Unique ID assigned to each returned incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.creation_time
      description: Date and time the incident was created on Cortex XDR.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.modification_time
      description: Date and time that the incident was last modified.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.detection_time
      description: Date and time that the first alert occurred in the incident.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.status
      description: |-
        Current status of the incident. Valid values are:
        "new","under_investigation","resolved_known_issue","resolved_duplicate","resolved_false_positive","resolved_true_positive","resolved_security_testing","resolved_other".
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.severity
      description: 'Calculated severity of the incident. Valid values are: "low","medium","high".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.description
      description: Dynamic calculated description of the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.assigned_user_mail
      description: Email address of the assigned user.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.assigned_user_pretty_name
      description: Full name of the user assigned to the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alert_count
      description: Total number of alerts in the incident.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.low_severity_alert_count
      description: Number of alerts with the severity LOW.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.med_severity_alert_count
      description: Number of alerts with the severity MEDIUM.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.high_severity_alert_count
      description: Number of alerts with the severity HIGH.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.user_count
      description: Number of users involved in the incident.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.host_count
      description: Number of hosts involved in the incident.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.notes
      description: Comments entered by the user regarding the incident.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.resolve_comment
      description: Comments entered by the user when the incident was resolved.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.manual_severity
      description: Incident severity assigned by the user. This does not affect the calculated severity of low, medium, or high.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.manual_description
      description: Incident description provided by the user.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.xdr_url
      description: A link to the incident view on Cortex XDR.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.starred
      description: Incident starred.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_techniques_ids_and_names
      description: Incident Mitre techniques IDs and names.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_tactics_ids_and_names
      description: Incident Mitre tactics ids and names.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.alert_id
      description: Unique ID for each alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.detection_timestamp
      description: Date and time that the alert occurred.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.source
      description: Source of the alert. The product/vendor this alert came from.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.severity
      description: 'Severity of the alert.Valid values are: "low","medium","high""".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.name
      description: Calculated name of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.category
      description: Category of the alert, for example, Spyware Detected via Anti-Spyware profile.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.description
      description: Textual description of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.host_ip_list
      description: Host IP involved in the alert.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.host_name
      description: Host name involved in the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.user_name
      description: User name involved with the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.event_type
      description: 'Event type. Valid values are: "Process Execution","Network Event","File Event","Registry Event","Injection Event","Load Image Event","Windows Event Log".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action
      description: 'The action that triggered the alert. Valid values are: "REPORTED", "BLOCKED", "POST_DETECTED", "SCANNED", "DOWNLOAD", "PROMPT_ALLOW", "PROMPT_BLOCK", "DETECTED", "BLOCKED_1", "BLOCKED_2", "BLOCKED_3", "BLOCKED_5", "BLOCKED_6", "BLOCKED_7", "BLOCKED_8", "BLOCKED_9", "BLOCKED_10", "BLOCKED_11", "BLOCKED_13", "BLOCKED_14", "BLOCKED_15", "BLOCKED_16", "BLOCKED_17", "BLOCKED_24", "BLOCKED_25", "DETECTED_0", "DETECTED_4", "DETECTED_18", "DETECTED_19", "DETECTED_20", "DETECTED_21", "DETECTED_22", "DETECTED_23".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_pretty
      description: 'The action that triggered the alert. Valid values are: "Detected (Reported)" "Prevented (Blocked)" "Detected (Post Detected)" "Detected (Scanned)" "Detected (Download)" "Detected (Prompt Allow)" "Prevented (Prompt Block)" "Detected" "Prevented (Denied The Session)" "Prevented (Dropped The Session)" "Prevented (Dropped The Session And Sent a TCP Reset)" "Prevented (Blocked The URL)" "Prevented (Blocked The IP)" "Prevented (Dropped The Packet)" "Prevented (Dropped All Packets)" "Prevented (Terminated The Session And Sent a TCP Reset To Both Sides Of The Connection)" "Prevented (Terminated The Session And Sent a TCP Reset To The Client)" "Prevented (Terminated The Session And Sent a TCP Reset To The Server)" "Prevented (Continue)" "Prevented (Block-Override)" "Prevented (Override-Lockout)" "Prevented (Override)" "Prevented (Random-Drop)" "Prevented (Silently Dropped The Session With An ICMP Unreachable Message To The Host Or Application)" "Prevented (Block)" "Detected (Allowed The Session)" "Detected (Raised An Alert)" "Detected (Syncookie Sent)" "Detected (Forward)" "Detected (Wildfire Upload Success)" "Detected (Wildfire Upload Failure)" "Detected (Wildfire Upload Skip)" "Detected (Sinkhole)".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_name
      description: Image name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_command_line
      description: Command line.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_status
      description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_vendor
      description: Signature vendor name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_image_name
      description: Image name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_line
      description: Command line.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_status
      description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_vendor
      description: Signature vendor.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_causality_id
      description: Causality ID.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_name
      description: Image name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_command_line
      description: Command line.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_sha256
      description: Image SHA256.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_signature_status
      description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_signature_vendor
      description: Signature vendor name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_path
      description: File path.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_md5
      description: File MD5.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_sha256
      description: File SHA256.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_registry_data
      description: Registry data.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_registry_full_key
      description: Registry full key.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_local_ip
      description: Local IP.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_local_port
      description: Local port.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_remote_ip
      description: Remote IP.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_remote_port
      description: Remote port.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_external_hostname
      description: External hostname.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.fw_app_id
      description: Firewall app id.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.is_whitelisted
      description: 'Is the alert on allow list. Valid values are: "Yes" "No".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.starred
      description: Alert starred.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.type
      description: Network artifact type.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_port
      description: The remote port related to the artifact.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.alert_count
      description: Number of alerts related to the artifact.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_ip
      description: The remote IP related to the artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.is_manual
      description: Whether the artifact was created by the user (manually).
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_domain
      description: The domain related to the artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.type
      description: 'The artifact type. Valid values are: "META", "GID", "CID", "HASH", "IP", "DOMAIN", "REGISTRY", "HOSTNAME".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_country
      description: The country related to the artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_status
      description: 'Digital signature status of the file. Valid values are: "SIGNATURE_UNAVAILABLE" "SIGNATURE_SIGNED" "SIGNATURE_INVALID" "SIGNATURE_UNSIGNED" "SIGNATURE_WEAK_HASH".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_process
      description: Whether the file artifact is related to a process execution.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_name
      description: Name of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_wildfire_verdict
      description: 'The file verdict, calculated by Wildfire. Valid values are: "BENIGN" "MALWARE" "GRAYWARE" "PHISHING" "UNKNOWN".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.alert_count
      description: Number of alerts related to the artifact.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_malicious
      description: Whether the artifact is malicious, as decided by the Wildfire verdict.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_manual
      description: Whether the artifact was created by the user (manually).
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.type
      description: 'The artifact type. Valid values are: "META" "GID" "CID" "HASH" "IP" "DOMAIN" "REGISTRY" "HOSTNAME".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256
      description: SHA256 hash of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_vendor_name
      description: File signature vendor name.
      type: String
    - contextPath: Account.Username
      description: The username in the relevant system.
      type: String
    - contextPath: Endpoint.Hostname
      description: The hostname that is mapped to this endpoint.
      type: String
    - contextPath: File.Path
      description: The path where the file is located.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Name
      description: The full file name (including file extension).
      type: String
    - contextPath: Process.Name
      description: The name of the process.
      type: String
    - contextPath: Process.MD5
      description: The MD5 hash of the process.
      type: String
    - contextPath: Process.SHA256
      description: The SHA256 hash of the process.
      type: String
    - contextPath: Process.PID
      description: The PID of the process.
      type: String
    - contextPath: Process.Path
      description: The file system path to the binary file.
      type: String
    - contextPath: Process.Start Time
      description: The timestamp of the process start time.
      type: String
    - contextPath: Process.CommandLine
      description: The full command line (including arguments).
      type: String
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    description: Returns additional data for the specified incident, for example, related alerts, file artifacts, network artifacts, and so on.
  - name: xdr-endpoint-isolate-ctf
    arguments:
    - name: incident_id
      description: Allows linking the response action to the incident that triggered it.
    - name: endpoint_id
      required: true
      description: The endpoint ID (string) to isolate. You can retrieve the string from the xdr-get-endpoints command.
    - name: suppress_disconnected_endpoint_error
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to suppress an error when trying to isolate a disconnected endpoint. When sets to false, an error will be returned.
      defaultValue: "false"
    - name: interval_in_seconds
      description: Interval in seconds between each poll.
    - name: timeout_in_seconds
      description: Polling timeout in seconds.
    - name: action_id
      deprecated: true
      description: For polling use.
      isArray: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.Isolation.endpoint_id
      description: The endpoint ID.
      type: String
    description: Isolates the specified endpoint.
    execution: true
    polling: true
  - name: xdr-file-retrieve-ctf
    arguments:
    - name: endpoint_ids
      required: true
      description: A comma-separated list of endpoint IDs.
      isArray: true
    - name: generic_file_path
      required: true
      description: A comma-separated list of file paths in any platform. Can be used instead of the mac/windows/linux file paths. The order of the files path list must be parallel to the endpoints list order, so the first file path in the list is related to the first endpoint and so on.
      isArray: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.action_id
      description: ID of the action to retrieve files from selected endpoints.
      type: string
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.endpoint_id
      description: Endpoint ID. Added only when the operation is successful.
      type: string
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.file_link
      description: Link to the file. Added only when the operation is successful.
      type: string
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.status
      description: The action status. Added only when the operation is unsuccessful.
      type: string
    description: Retrieves files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. At least one endpoint ID and one file path are necessary in order to run the command. After running this command, you can use the xdr-action-status-get command with returned action_id, to check the action status.
    polling: true
  - name: xdr-get-alerts-ctf
    arguments:
    - name: alert_id
      description: The unique ID of the alert.
      isArray: true
    - name: severity
      auto: PREDEFINED
      predefined:
      - low
      - medium
      - high
      description: The severity of the alert.
      isArray: true
    - name: custom_filter
      description: "a custom filter, when using this argument, other filter arguments are not relevant. example: \n`{\n                \"OR\": [\n                    {\n                        \"SEARCH_FIELD\": \"actor_process_command_line\",\n                        \"SEARCH_TYPE\": \"EQ\",\n                        \"SEARCH_VALUE\": \"path_to_file\"\n                    }\n                ]\n            }`."
    - name: Identity_type
      auto: PREDEFINED
      predefined:
      - ANONYMOUS
      - APPLICATION
      - COMPUTE
      - FEDERATED_IDENTITY
      - SERVICE
      - SERVICE_ACCOUNT
      - TEMPORARY_CREDENTIALS
      - TOKEN
      - UNKNOWN
      - USER
      description: Account type.
      isArray: true
    - name: agent_id
      description: A unique identifier per agent.
      isArray: true
    - name: action_external_hostname
      description: The host name to connect to. In case of a proxy connection, this value will differ from action_remote_ip.
      isArray: true
    - name: rule_id
      description: A string identifying the user rule.
      isArray: true
    - name: rule_name
      description: The name of the user rule.
      isArray: true
    - name: alert_name
      description: The alert name.
      isArray: true
    - name: alert_source
      description: The alert source.
      isArray: true
    - name: time_frame
      auto: PREDEFINED
      predefined:
      - 60 minutes
      - 3 hours
      - 12 hours
      - 24 hours
      - 2 days
      - 7 days
      - 14 days
      - 30 days
      - custom
      description: Supports relative times or “custom” time option. If you choose the "custom" option, you should use start_time and end_time arguments.
    - name: user_name
      description: The name assigned to the user_id during agent runtime.
      isArray: true
    - name: actor_process_image_name
      description: The file name of the binary file.
      isArray: true
    - name: causality_actor_process_image_command_line
      description: CGO CMD.
      isArray: true
    - name: actor_process_image_command_line
      description: |-
        Trimmed to 128 unicode chars during event serialization.
        Full value reported as part of the original process event.
      isArray: true
    - name: action_process_image_command_line
      description: The command line of the process created.
      isArray: true
    - name: actor_process_image_sha256
      description: SHA256 of the binary file.
      isArray: true
    - name: causality_actor_process_image_sha256
      description: SHA256 of the binary file.
      isArray: true
    - name: action_process_image_sha256
      description: SHA256 of the binary file.
      isArray: true
    - name: action_file_image_sha256
      description: SHA256 of the file related to the event.
      isArray: true
    - name: action_registry_name
      description: The name of the registry.
      isArray: true
    - name: action_registry_key_data
      description: The key data of the registry.
      isArray: true
    - name: host_ip
      description: The host IP.
      isArray: true
    - name: action_local_ip
      description: The local IP address for the connection.
      isArray: true
    - name: action_remote_ip
      description: Remote IP address for the connection.
      isArray: true
    - name: alert_action_status
      auto: PREDEFINED
      predefined:
      - detected
      - detected (allowed the session)
      - detected (download)
      - detected (forward)
      - detected (post detected)
      - detected (prompt allow)
      - detected (raised an alert)
      - detected (reported)
      - detected (on write)
      - detected (scanned)
      - detected (sinkhole)
      - detected (syncookie sent)
      - detected (wildfire upload failure)
      - detected (wildfire upload success)
      - detected (wildfire upload skip)
      - detected (xdr managed threat hunting)
      - prevented (block)
      - prevented (blocked)
      - prevented (block-override)
      - prevented (blocked the url)
      - prevented (blocked the ip)
      - prevented (continue)
      - prevented (denied the session)
      - prevented (dropped all packets)
      - prevented (dropped the session)
      - prevented (dropped the session and sent a tcp reset)
      - prevented (dropped the packet)
      - prevented (override)
      - prevented (override-lockout)
      - prevented (post detected)
      - prevented (prompt block)
      - prevented (random-drop)
      - prevented (silently dropped the session with an icmp unreachable message to the host or application)
      - prevented (terminated the session and sent a tcp reset to both sides of the connection)
      - prevented (terminated the session and sent a tcp reset to the client)
      - prevented (terminated the session and sent a tcp reset to the server)
      - prevented (on write)
      description: Alert action status.
    - name: action_local_port
      description: The local IP address for the connection.
      isArray: true
    - name: action_remote_port
      description: The remote port for the connection.
      isArray: true
    - name: dst_action_external_hostname
      description: The hostname we connect to. In case of a proxy connection, this value will differ from action_remote_ip.
      isArray: true
    - name: sort_field
      description: The field by which we sort the results.
      isArray: true
      defaultValue: source_insert_ts
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - DESC
      - ASC
      description: The order in which we sort the results.
    - name: offset
      description: The first page from which we bring the alerts.
      isArray: true
      defaultValue: "0"
    - name: limit
      description: The last page from which we bring the alerts.
      isArray: true
      defaultValue: "50"
    - name: start_time
      description: Relevant when "time_frame" argument is "custom". Supports Epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss.000Z).
    - name: end_time
      description: Relevant when "time_frame" argument is "custom". Supports Epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss.000Z).
    - name: starred
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether the alert is starred or not.
    - name: mitre_technique_id_and_name
      description: The MITRE attack technique.
      isArray: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.Alert.internal_id
      description: The unique ID of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.source_insert_ts
      description: The detection timestamp.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Alert.alert_name
      description: The name of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.severity
      description: The severity of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_category
      description: The category of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_action_status
      description: |-
        The alert action. Possible values.

        DETECTED: detected
        DETECTED_0: detected (allowed the session)
        DOWNLOAD: detected (download)
        DETECTED_19: detected (forward)
        POST_DETECTED: detected (post detected)
        PROMPT_ALLOW: detected (prompt allow)
        DETECTED_4: detected (raised an alert)
        REPORTED: detected (reported)
        REPORTED_TRIGGER_4: detected (on write)
        SCANNED: detected (scanned)
        DETECTED_23: detected (sinkhole)
        DETECTED_18: detected (syncookie sent)
        DETECTED_21: detected (wildfire upload failure)
        DETECTED_20: detected (wildfire upload success)
        DETECTED_22: detected (wildfire upload skip)
        DETECTED_MTH: detected (xdr managed threat hunting)
        BLOCKED_25: prevented (block)
        BLOCKED: prevented (blocked)
        BLOCKED_14: prevented (block-override)
        BLOCKED_5: prevented (blocked the url)
        BLOCKED_6: prevented (blocked the ip)
        BLOCKED_13: prevented (continue)
        BLOCKED_1: prevented (denied the session)
        BLOCKED_8: prevented (dropped all packets)
        BLOCKED_2: prevented (dropped the session)
        BLOCKED_3: prevented (dropped the session and sent a tcp reset)
        BLOCKED_7: prevented (dropped the packet)
        BLOCKED_16: prevented (override)
        BLOCKED_15: prevented (override-lockout)
        BLOCKED_26: prevented (post detected)
        PROMPT_BLOCK: prevented (prompt block)
        BLOCKED_17: prevented (random-drop)
        BLOCKED_24: prevented (silently dropped the session with an icmp unreachable message to the host or application)
        BLOCKED_9: prevented (terminated the session and sent a tcp reset to both sides of the connection)
        BLOCKED_10: prevented (terminated the session and sent a tcp reset to the client)
        BLOCKED_11: prevented (terminated the session and sent a tcp reset to the server)
        BLOCKED_TRIGGER_4: prevented (on write).
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_action_status_readable
      description: The alert action.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_name
      description: The alert name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_description
      description: The alert description.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.agent_ip_addresses
      description: The host IP.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.agent_hostname
      description: The host name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.mitre_tactic_id_and_name
      description: The MITRE attack tactic.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.mitre_technique_id_and_name
      description: The MITRE attack technique.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.starred
      description: Whether the alert is starred or not.
      type: Boolean
    description: "Returns a list of alerts and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. \nMultiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value."
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  subtype: python3
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
fromversion: 8.2.0
defaultmapperin: XDR - Incoming Mapper CTF
defaultclassifier: Cortex XDR Incident Handler - Classifier CTF
tests:
- No tests (auto formatted)