Xpanse Feed

Details

ID	`Xpanse Feed`
Provider	Palo Alto Networks
Category	Data Enrichment & Threat Intelligence
From Version	6.10.0
Docker Image	`demisto/python3:3.12.13.10116658`

README

Use this feed to retrieve the discovered IPs/Domains/Certificates from Cortex Xpanse asset database.
This integration was integrated and tested with version 2.5 of Cortex Xpanse.

Configure Xpanse Feed in Cortex

Parameter	Description	Required
Server URL	The web UI with `api-` appended to front (e.g., https://api-xsiam.paloaltonetworks.com). For more information, see https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis.	True
API Key ID	For more information, see https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis. Only standard API key type is supported.	True
API Key		True
Fetch indicators		False
Indicator Reputation	Indicators from this integration instance will be marked with this reputation.	False
Source Reliability	Reliability of the source providing the intelligence data.	True
Traffic Light Protocol Color	The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed.	False
		False
Bypass exclusion list	When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.	False
Use system proxy settings		False
Trust any certificate (not secure)		False
Tags	Supports CSV values.	False
		False
Feed Fetch Interval		False
Indicators types to fetch	Indicator types to fetch.	True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

xpanse-get-indicators

Retrieves a limited number of indicators.

Base Command

xpanse-get-indicators

Input

Argument Name	Description	Required
limit	The maximum number of indicators to return.	Required
ip	Retrieve discovered IPs. Default is yes.	Optional
domain	Retrieve discovered domains. Default is yes.	Optional
certificate	Retrieve discovered certificates. Default is yes.	Optional

Context Output

Path	Type	Description
ASM.Indicators.Name	String	The name of the indicator.
ASM.Indicators.Description	String	The description of the indicator.
ASM.Indicators.Type	String	The type of the indicator.

Command example

!xpanse-get-indicators limit=1 ip=yes certificate=no domain=no

Context Example

{
    "ASM": {
        "Indicators": {
            "Description": "1.1.1.1 indicator of asset type IP from Cortex Xpanse",
            "Name": "1.1.1.1",
            "Type": "IP"
        }
    }
}

Human Readable Output

Xpanse indicators

Name Type Description

1.1.1.1 IP 1.1.1.1 indicator of asset type IP from Cortex Xpanse

Name	Type	Description
1.1.1.1	IP	1.1.1.1 indicator of asset type IP from Cortex Xpanse

Configuration parameters

url — Server URL (required)
credentials — API Key ID (required)
feed — Fetch indicators
feedReputation — Indicator Reputation
feedReliability — Source Reliability (required)
tlp_color — Traffic Light Protocol Color
feedExpirationInterval —
feedBypassExclusionList — Bypass exclusion list
proxy — Use system proxy settings
insecure — Trust any certificate (not secure)
feedTags — Tags
feedExpirationPolicy —
feedFetchInterval — Feed Fetch Interval
indicatorTypes — Indicator types to fetch

Commands (1)

xpanse-get-indicators
Retrieves a limited number of indicators.

Source

FeedXpanse.py FeedXpanse_test.py FeedXpanse.yml FeedXpanse_description.md command_examples.txt

Download History Raw

## Configure Cortex Xpanse

1. Navigate to **Settings** > **Integrations** > **Servers & Services**.
2. Search for Xpanse Feed.
3. Click **Add instance** to create and configure a new integration instance.

    | **Parameter** | **Description** | **Required** |
    | --- | --- | --- |
     Server URL | The web UI with \`api-\` appended to front (e.g., https://api-xsiam.paloaltonetworks.com). For more information, see [get-started-with-cortex-xdr-apis](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis). | True 
     API Key ID | See [get-started-with-cortex-xdr-apis](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis). | True 
     API Key | See [get-started-with-cortex-xdr-apis](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis).  **Only standard API key type is supported**. | True 
    
4. Click **Test** to validate the URLs, token, and connection.