Xpanse Feed

Details

ID	`Xpanse Feed`
Provider	Palo Alto Networks
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

Use this feed to retrieve the discovered IPs/Domains/Certificates from Cortex Xpanse asset database.
This integration was integrated and tested with version 2.5 of Cortex Xpanse.

Configure Xpanse Feed in Cortex

Parameter	Description	Required
Server URL	The web UI with `api-` appended to front (e.g., https://api-xsiam.paloaltonetworks.com). For more information, see https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis.	True
API Key ID	For more information, see https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis. Only standard API key type is supported.	True
API Key		True
Fetch indicators		False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False
		False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Use system proxy settings		False
Trust any certificate (not secure)		False
Tags	Supports CSV values.	False
		False
Feed Fetch Interval		False
Indicators types to fetch	Indicator types to fetch.	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

xpanse-get-indicators

Retrieves a limited number of indicators.

Base Command

xpanse-get-indicators

Input

Argument Name	Description	Required
limit	The maximum number of indicators to return.	Required
ip	Retrieve discovered IPs. Default is yes.	Optional
domain	Retrieve discovered domains. Default is yes.	Optional
certificate	Retrieve discovered certificates. Default is yes.	Optional

Context Output

Path	Type	Description
ASM.Indicators.Name	String	The name of the indicator.
ASM.Indicators.Description	String	The description of the indicator.
ASM.Indicators.Type	String	The type of the indicator.

Command example

!xpanse-get-indicators limit=1 ip=yes certificate=no domain=no

Context Example

{
    "ASM": {
        "Indicators": {
            "Description": "1.1.1.1 indicator of asset type IP from Cortex Xpanse",
            "Name": "1.1.1.1",
            "Type": "IP"
        }
    }
}

Human Readable Output

Xpanse indicators

Name Type Description

1.1.1.1 IP 1.1.1.1 indicator of asset type IP from Cortex Xpanse

Name	Type	Description
1.1.1.1	IP	1.1.1.1 indicator of asset type IP from Cortex Xpanse

Configuration parameters

url — Server URL (required)
credentials — API Key ID (required)
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
feedExpirationInterval —
feedBypassExclusionList — Bypass exclusion list
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
feedTags — Tags
feedExpirationPolicy —
feedFetchInterval — Feed Fetch Interval
indicatorTypes — Indicator types to fetch

Commands (1)

xpanse-get-indicators
Retrieves a limited number of indicators.

Source

FeedXpanse.py FeedXpanse_test.py FeedXpanse.yml FeedXpanse_description.md command_examples.txt

Download History Raw

category: Data Enrichment & Threat Intelligence
provider: Palo Alto Networks
commonfields:
  id: Xpanse Feed
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- additionalinfo: The web UI with `api-` appended to front (e.g., https://api-xsiam.paloaltonetworks.com). For more information, see https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis.
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- additionalinfo: For more information, see https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis.  Only standard API key type is supported.
  display: API Key ID
  displaypassword: API Key
  name: credentials
  required: true
  type: 9
  section: Connect
- defaultvalue: 'true'
  display: Fetch indicators
  name: feed
  type: 8
  section: Collect
  required: false
- additionalinfo: Indicators from this integration instance will be marked with this reputation.
  section: Collect
  display: Indicator Reputation
  name: feedReputation
  defaultvalue: Good
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
- additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: A - Completely reliable
  display: Source Reliability
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  section: Collect
- additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.
  defaultvalue: CLEAR
  display: Traffic Light Protocol Color
  name: tlp_color
  options:
  - RED
  - AMBER+STRICT
  - AMBER
  - GREEN
  - CLEAR
  type: 15
  section: Collect
  required: false
- defaultvalue: '20160'
  display: ''
  name: feedExpirationInterval
  type: 1
  required: false
  section: Collect
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  defaultvalue: 'false'
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  section: Collect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- defaultvalue: 'false'
  display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- additionalinfo: Supports CSV values.
  display: Tags
  name: feedTags
  type: 0
  section: Collect
  advanced: true
  required: false
- name: feedExpirationPolicy
  defaultvalue: suddenDeath
  display: ''
  type: 17
  options:
  - never
  - interval
  - indicatorType
  - suddenDeath
  section: Collect
  required: false
- defaultvalue: '1440'
  name: feedFetchInterval
  display: Feed Fetch Interval
  type: 19
  section: Collect
  advanced: true
  required: false
- display: Indicator types to fetch
  name: indicatorTypes
  type: 16
  required: false
  options:
  - IP
  - Domain
  - Certificate
  additionalinfo: 'Indicator types to fetch.  Default is to fetch all.'
  section: Collect
description: Use this feed to retrieve the discovered IPs/domains/certificates from the Cortex Xpanse asset database.
display: 'Xpanse Feed'
name: Xpanse Feed
script:
  commands:
  - arguments:
    - description: The maximum number of indicators to return.
      name: limit
      required: true
    - defaultValue: yes
      description: Retrieve discovered IPs.
      name: ip
    - defaultValue: yes
      description: Retrieve discovered domains.
      name: domain
    - defaultValue: yes
      description: Retrieve discovered certificates.
      name: certificate
    description: Retrieves a limited number of indicators.
    name: xpanse-get-indicators
    outputs:
    - contextPath: ASM.Indicators.Name
      description: The name of the indicator.
      type: String
    - contextPath: ASM.Indicators.Description
      description: The description of the indicator.
      type: String
    - contextPath: ASM.Indicators.Type
      description: The type of the indicator.
      type: String
  feed: true
  script: '-'
  type: python
  subtype: python3
  dockerimage: demisto/python3:3.12.13.10116658
fromversion: 6.10.0
tests:
- No tests (auto formatted)