XSOAR EDL Checker
Checks an XSOAR hosted EDL to make sure it's returning a valid response. Supports PAN-OS (text), CSV, or JSON EDLs.
Utilities · XSOAR EDL Checker
Details
| ID | XSOAR EDL Checker |
|---|---|
| Provider | Palo Alto Networks |
| Category | Utilities |
| From Version | 6.5.0 |
| Docker Image | demisto/python3:3.12.8.3296088 |
README
Checks an XSOAR hosted EDL to make sure it’s returning a valid response. Supports PAN-OS (text), CSV, or JSON EDLs.
This integration was integrated and tested with version 6.12 and 8.4 of Cortex XSOAR, and version 3.2.12 of the Generic Export Indicator Service.
Configure XSOAR EDL Checker in Cortex
| Parameter | Description | Required |
|---|---|---|
| EDL Name | The name of the edl from the generic indicator export service | True |
| Username | False | |
| Password | False | |
| Trust any certificate (not secure) | False | |
| XSOAR Version | The version of XSOAR you are using 6.x or 8.x | False |
Commands
You can execute these commands from the CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.
xsoaredlchecker-get-edl
Checks the EDL and returns the response.
Base Command
xsoaredlchecker-get-edl
Input
| Argument Name | Description | Required |
| — | — | — |
Context Output
| Path | Type | Description |
|---|---|---|
| EDLChecker.Name | unknown | The Name of the EDL from the Generic Indicators Export Service instance |
| EDLChecker.Status | unknown | The HTTP Status Code returned by the EDL |
| EDLChecker.Response | unknown | The Response or Error from the check. |
| EDLChecker.ItemsOnList | unknown | The number of indicators on the list, assuming a successful response! |
Command example
#### Context Example
```json
{
"EDLChecker": [
{
"ItemsOnList": 2,
"Name": "domains",
"Response": "domains returned a 200 response, all should be well",
"Status": 200
},
{
"ItemsOnList": 0,
"Name": "ips",
"Response": "Instance 'ips' is disabled (922)",
"Status": 400
}
]
}
Human Readable Output
EDL Response for domains
Name Status Response ItemsOnList domains 200 domains returned a 200 response, all should be well 2
Configuration parameters
edl_name— EDL Name (required)credentials— Usernameinsecure— Trust any certificate (not secure)xsoarversion— XSOAR Version
Commands (1)
-
xsoaredlchecker-get-edlChecks the EDL and returns the response.
# XSOAR EDL Checker This integration checks an external dynamic list provided by the [XSOAR Generic Indicators Export Service](https://xsoar.pan.dev/docs/reference/integrations/edl), to validate it is responding as required. XSOAR 6.x: Only supports lists hosted off the XSOAR server, and requires the following server configuration be set from Settings -> About -> Troubleshooting instance.execute.external = true XSOAR 8.X: Make sure to configre the credentials for Long Running Integrations (Settings -> Settings & Info -> Instances -> Long Running Integrations) ## Setup Configure an instance and provide the name of the instance name from the XSOAR Generic Indicators Export Service. If you configured the integration instance to support basic auth, provide or select the credentials to be used. ## Using it Run the **xsoaredlchecker-get-edl** command from the command line or playbook to check the EDLs. This will check all instances, then you can do some magic in the playbook to see if anything isn't OK and notify!