Cortex XDR - IOC

category: Data Enrichment & Threat Intelligence
provider: Palo Alto Networks
sectionorder:
  - Connect
  - Collect
commonfields:
  id: Cortex XDR - IOC
  version: -1
configuration:
- display: Server URL (e.g. https://example.net)
  name: url
  required: true
  type: 0
  section: Connect
- display: ''
  name: apikey_id_creds
  type: 9
  displaypassword: API Key ID
  hiddenusername: true
  required: false
  section: Connect
- display: ''
  name: apikey_creds
  type: 9
  displaypassword: API Key
  hiddenusername: true
  required: false
  section: Connect
- display: API Key ID
  name: apikey_id
  type: 4
  hidden: true
  required: false
  section: Connect
- display: API Key
  name: apikey
  type: 4
  hidden: true
  required: false
  section: Connect
- display: Fetch indicators
  name: feed
  type: 8
  defaultvalue: 'true'
  required: false
  section: Collect
- additionalinfo: When enabled, indicators will be synced from Cortex XSOAR to Cortex XDR. Disable if you prefer to use a playbook to sync indicators.
  defaultvalue: 'true'
  display: Auto Sync
  name: autoSync
  type: 8
  required: false
  section: Collect
- additionalinfo: When the `override severity` parameter is set to True, the severity level chosen here will be used for all indicators. Otherwise, the severity level of the indicator will be used.
  display: Overriding severity value
  name: severity
  required: true
  type: 15
  options:
  - info
  - low
  - medium
  - high
  - critical
  section: Collect
- display: Tags
  name: feedTags
  type: 0
  additionalinfo: Supports CSV values.
  defaultvalue: Cortex XDR
  required: false
  section: Collect
- display: Sync Query
  name: query
  required: true
  type: 0
  additionalinfo: The query used to collect indicators to sync from Cortex XSOAR to Cortex XDR.
  defaultvalue: reputation:Bad and (type:File or type:Domain or type:IP)
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- additionalinfo: Indicators from this integration instance will be marked with this reputation
  display: Indicator Reputation
  name: feedReputation
  options:
  - None
  - Good
  - Suspicious
  - Bad
  type: 18
  required: false
  section: Collect
- display: 'Source Reliability'
  name: feedReliability
  options:
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: true
  type: 15
  additionalinfo: Reliability of the source providing the intelligence data
  defaultvalue: A - Completely reliable
  section: Collect
- display: 'Traffic Light Protocol Color'
  name: tlp_color
  type: 15
  options:
  - RED
  - AMBER
  - GREEN
  - WHITE
  additionalinfo: The Traffic Light Protocol (TLP) designation to apply to indicators fetched from the feed
  required: false
  section: Collect
- display: ''
  name: feedExpirationPolicy
  type: 17
  options:
  - never
  - interval
  - indicatorType
  required: false
  section: Collect
- display: ''
  name: feedExpirationInterval
  type: 1
  required: false
  section: Collect
- display: Incremental Feed
  name: feedIncremental
  type: 8
  defaultvalue: 'true'
  hidden: true
  required: false
  section: Collect
- defaultvalue: '15'
  display: Feed Fetch Interval
  name: feedFetchInterval
  type: 19
  required: false
  section: Collect
- additionalinfo: The XSOAR indicator field used as severity.
  display: XSOAR Severity Field
  name: xsoar_severity_field
  type: 0
  defaultvalue: 'sourceoriginalseverity'
  required: false
  section: Collect
- defaultvalue: 'comments'
  additionalinfo: 'The Cortex XSOAR field where comments are stored and being export to XDR. Default is `comments`. Expecting a Cortex XSOAR IOC format of a comment (nested dictionary).'
  display: XSOAR Comment Field Exporting To XDR
  name: xsoar_comments_field
  options:
  - indicator_link
  - comments
  type: 16
  advanced: true
  required: false
  section: Collect
- defaultvalue: 'false'
  additionalinfo: Whether to consider the value at `xsoar_comments_field` as CSV. Requires specifying a xsoar_comments_field value different than the default `comments`.
  display: Comments as tags (CSV)
  name: comments_as_tags
  type: 8
  required: false
  section: Collect
- additionalinfo: When enabled, the severity value will be taken from the `severity` parameter, regardless of the IOC severity value. Otherwise, the severity value will be taken according to the `xsoar_severity_field` parameter.
  display: Override severity
  name: override_severity
  type: 8
  defaultvalue: 'true'
  required: false
  section: Collect
- additionalinfo: When selected, the exclusion list is ignored for indicators from this feed. This means that if an indicator from this feed is on the exclusion list, the indicator might still be added to the system.
  display: Bypass exclusion list
  name: feedBypassExclusionList
  type: 8
  required: false
  section: Collect
- display: Extensive logging (for debugging purposes)
  additionalinfo: Do not use this option unless advised otherwise. Using this parameter may result in increased processing time.
  name: extensive_logs
  type: 8
  advanced: true
  required: false
  section: Connect
description: Use the Cortex XDR - IOCs feed integration to sync indicators from Cortex XSOAR to Cortex XDR and back to Cortex XSOAR. Cortex XDR is the world's first detection and response app that natively integrates network, endpoint and cloud data to stop sophisticated attacks.
display: Cortex XDR - IOC
name: Cortex XDR - IOC
script:
  commands:
  - description: Create a file with all the IOCs that are going to sync to Cortex XDR.
    name: xdr-iocs-to-keep-file
  - arguments:
    - description: |-
        For first sync, set to true.
        (do NOT run this twice!).
      name: firstTime
      auto: PREDEFINED
      default: true
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    description: Sync your IOC with Cortex XDR.
    name: xdr-iocs-sync
  - arguments:
    - description: The indicators to be pushed. Leave empty to push all recently modified IOCs.
      name: indicator
      isArray: true
    description: Push modified IOCs to Cortex XDR.
    name: xdr-iocs-push
  - description: Set sync time manually. (Do not use this command unless you understand the consequences.)
    name: xdr-iocs-set-sync-time
    arguments:
    - description: The time of the file creation (use UTC time zone).
      name: time
      required: true
    deprecated: true
  - description: Creates the sync file for the manual process. Run this command when instructed by the XDR support team.
    name: xdr-iocs-create-sync-file
    arguments:
    - name: zip
      description: Whether to zip the output file.
      defaultValue: false
      required: true
    - name: set_time
      description: Whether to modify the sync time locally.
      defaultValue: false
      required: true
  - arguments:
    - description: The indicator to enable.
      isArray: true
      name: indicator
      required: true
    description: Enables IOCs in the XDR server.
    name: xdr-iocs-enable
  - arguments:
    - description: The indicator to disable.
      isArray: true
      name: indicator
      required: true
    description: Disables IOCs in the XDR server.
    name: xdr-iocs-disable
  dockerimage: demisto/python3:3.12.13.10116658
  feed: true
  runonce: false
  script: '-'
  subtype: python3
  type: python
tests:
- Cortex XDR - IOC - Test
fromversion: 5.5.0