Xpanse Feed

Use this feed to retrieve the discovered IPs/domains/certificates from the Cortex Xpanse asset database.

Data Enrichment & Threat Intelligence · Cortex Xpanse · Feed

Details

IDXpanse Feed
ProviderPalo Alto Networks
CategoryData Enrichment & Threat Intelligence
From Version6.10.0
Docker Imagedemisto/python3:3.12.13.10116658

README

Use this feed to retrieve the discovered IPs/Domains/Certificates from Cortex Xpanse asset database.
This integration was integrated and tested with version 2.5 of Cortex Xpanse.

Configure Xpanse Feed in Cortex

Parameter Description Required
Server URL The web UI with `api-` appended to front (e.g., https://api-xsiam.paloaltonetworks.com). For more information, see https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis. True
API Key ID For more information, see https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis. Only standard API key type is supported. True
API Key   True
Fetch indicators   False
Indicator Reputation Indicators from this integration instance will be marked with this reputation. False
Source Reliability Reliability of the source providing the intelligence data. True
Traffic Light Protocol Color The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed. False
    False
Bypass exclusion list When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system. False
Use system proxy settings   False
Trust any certificate (not secure)   False
Tags Supports CSV values. False
    False
Feed Fetch Interval   False
Indicators types to fetch Indicator types to fetch. True

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

xpanse-get-indicators

Retrieves a limited number of indicators.

Base Command

xpanse-get-indicators

Input

Argument Name Description Required
limit The maximum number of indicators to return. Required
ip Retrieve discovered IPs. Default is yes. Optional
domain Retrieve discovered domains. Default is yes. Optional
certificate Retrieve discovered certificates. Default is yes. Optional

Context Output

Path Type Description
ASM.Indicators.Name String The name of the indicator.
ASM.Indicators.Description String The description of the indicator.
ASM.Indicators.Type String The type of the indicator.

Command example

!xpanse-get-indicators limit=1 ip=yes certificate=no domain=no

Context Example

{
    "ASM": {
        "Indicators": {
            "Description": "1.1.1.1 indicator of asset type IP from Cortex Xpanse",
            "Name": "1.1.1.1",
            "Type": "IP"
        }
    }
}

Human Readable Output

Xpanse indicators

Name Type Description
1.1.1.1 IP 1.1.1.1 indicator of asset type IP from Cortex Xpanse

Configuration parameters

  • url — Server URL (required)
  • credentials — API Key ID (required)
  • feed — Fetch indicators
  • feedReputation — Indicator Reputation
  • feedReliability — Source Reliability (required)
  • tlp_color — Traffic Light Protocol Color
  • feedExpirationInterval —
  • feedBypassExclusionList — Bypass exclusion list
  • proxy — Use system proxy settings
  • insecure — Trust any certificate (not secure)
  • feedTags — Tags
  • feedExpirationPolicy —
  • feedFetchInterval — Feed Fetch Interval
  • indicatorTypes — Indicator types to fetch

Commands (1)

  • xpanse-get-indicators

    Retrieves a limited number of indicators.

Source

FeedXpanse.py FeedXpanse_test.py FeedXpanse.yml FeedXpanse_description.md command_examples.txt
Download History Raw 
!xpanse-get-indicators limit=1 ip=yes certificate=no domain=no