XMCyberCEM

The XM Cyber integration connects XM Cyber’s Continuous Exposure Management (CEM) platform with XSOAR, enhancing your Security Information and Event Management (SIEM) and Security Orchestration, Automation, and Response processes with attack graph context and prioritization, while also feeding relevant entities back to CEM to be defined as breach points in CEM scenarios.

Configure XM Cyber CEM in Cortex

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for XM Cyber CEM.
3. Click Add instance to create and configure a new integration instance.

1. Click Test to validate the URL, API Key, and connection.

Commands

You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

xmcyber-enrich-incident

Enriches Hostname and User entities on the SOAR platform by using information available in the XM Cyber platform.

Base Command

xmcyber-enrich-incident

Input

Context Output

Command example

!xmcyber-enrich-incident entity_values="hostname_1,user_1"

Context Example

{
    "XMCyber": {
        "Entity": [
            {
                "id": "activeDirectoryUser-0000000000000000001",
                "affectedUniqueEntities": 0,
                "chokePointScore": 29,
                "collectedAt": "2025-12-04T00:00:00.630Z",
                "displayName": "test.com\\user_1",
                "domainName": "test.com",
                "isEnabled": true,
                "lastLogon": "2025-12-03T10:30:00.000Z",
                "name": "user_1",
                "pwdLastSet": "2024-06-15T08:20:00.000Z",
                "riskScore": 88,
                "sid": "S-1-5-21-1234567890-1234567890-1234567890-1001",
                "type": "activeDirectoryUser",
                "chokePointScoreLevel": "MEDIUM",
                "riskScoreLevel": "HIGH",
                "xmLabels": [
                    {
                        "id": "AD Admins And DCs"
                    },
                    {
                        "id": "AD Tier0"
                    }
                ]
            },
            {
                "id": "0000000000000000002",
                "affectedUniqueEntities": 5,
                "chokePointScore": 75,
                "collectedAt": "2025-12-04T00:00:00.630Z",
                "name": "hostname_1",
                "os": {
                    "name": "Windows Server 2019 (DC)"
                },
                "osType": "Windows",
                "riskScore": 92,
                "type": "agent",
                "chokePointScoreLevel": "HIGH",
                "riskScoreLevel": "CRITICAL",
                "xmLabels": [
                    {
                        "id": "Windows Server"
                    },
                    {
                        "id": "Domain Controller"
                    },
                    {
                        "id": "Public IP"
                    }
                ]
            }
        ]
    }
}

Human Readable Output

Entity Information

ID	Name	Type	Compromise Risk Score	Choke Point Score	Labels	Affected Unique Entities	Enabled	Display Name	Domain Name	Last Logon Date	Last Password Set Date	OS Type	OS Name	SID	Collected At
activeDirectoryUser-0000000000000000001	user_1	activeDirectoryUser	HIGH (88)	MEDIUM (29)	AD Admins And DCs, AD Tier0	0	true	test.com\user_1	test.com	2025-12-03T10:30:00.000Z	2025-11-15T08:20:00.000Z			S-1-5-21-1234567890-1234567890-1234567890-1001	2025-12-04T00:00:00.630Z
0000000000000000002	hostname_1	agent	CRITICAL (92)	HIGH (75)	Windows Server, Domain Controller, Public IP	5						Windows	Windows Server 2019 (DC)		2025-12-04T00:00:00.630Z

xmcyber-push-breach-point

Adds a breach point label to the specified entities based on defined criteria and pushes the label as an Imported Attribute to XM Cyber CEM’s platform.

Base Command

xmcyber-push-breach-point

Input

Context Output

Command example

!xmcyber-push-breach-point entity_values=”user1,hostname1,user2” attribute_name=”XSOAR_BP” parameter=”Compromise Risk Score” operator=”Greater than” value=”30”

Context Example

{
    "XMCyber": {
        "BreachPoint": {
            "attributeName": "XSOAR_BP",
            "matchedEntities": "hostname1,user1",
            "notMatchedEntities": "user2",
            "operator": "Greater than",
            "parameter": "Compromise Risk Score",
            "value": "30",
            "userSuppliedEntities": "user1,hostname1,user2"
        }
    }
}

Human Readable Output

Successfully pushed the attribute ‘XSOAR_BP’ for the following entities

user1, hostname1

xmcyber-remove-breach-point

Removes a breach point label from the specified entities in XM Cyber CEM’s platform.

Base Command

xmcyber-remove-breach-point

Input

Context Output

Command example

!xmcyber-remove-breach-point entity_values=”user1,hostname1” attribute_name=”XSOAR_BP”

Context Example

{
    "XMCyber": {
        "RemoveBreachPoint": {
            "attributeName": "XSOAR_BP",
            "removedLabelEntities": "hostname1,user1",
            "userSuppliedEntities": "user1,hostname1"
        }
    }
}

Human Readable Output

Successfully removed the attribute ‘XSOAR_BP’ from the following entities

user1, hostname1

xmcyber-calculate-risk-score

Calculates the overall risk score for entities based on their Compromise Risk Score and Choke Point Score from XM Cyber enrichment data.

Base Command

xmcyber-calculate-risk-score

Input

Context Output

Command example

!xmcyber-calculate-risk-score entity_values=”user1,hostname1”

Context Example

{
    "XMCyber": {
        "CalculateRiskScore": {
            "entities": "hostname_1, user_1, user_2",
            "compromisedRiskScore": 95,
            "compromisedRiskScoreLevel": "CRITICAL",
            "compromisedChokePointScore": 85,
            "compromisedChokePointScoreLevel": "CRITICAL",
            "calculatedRiskScore": 100
        }
    }
}

Human Readable Output

Risk Score Calculation Results

Calculated Risk Score	Compromised Risk Score Level	Compromised Risk Score	Compromised Choke Point Level	Compromised Choke Point Score
100	CRITICAL	95	CRITICAL	85