Cortex XDR by Palo Alto Networks (v6.3.36)
Automates Cortex XDR incident response, and includes custom Cortex XDR incident views and layouts to aid analyst investigations.
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Categories
- Endpoint
Incident fields (39)
- LastMirroredInTime
- XDR Alert Category
- XDR Alert Count
- XDR Alert Name
- XDR Alert Search Results
- XDR Alerts
- XDR Assigned User Email
- XDR Assigned User Pretty Name
- XDR Description
- XDR Detection Time
- XDR Disconnected endpoints
- XDR File Artifacts
- XDR File Name
- XDR File SHA256
- XDR High Severity Alert Count
- XDR Host Count
- XDR Incident ID
- XDR Investigation results
- XDR Low Severity Alert Count
- XDR MITRE Tactics
- XDR MITRE Techniques
- XDR Medium Severity Alert Count
- XDR Modification Time
- XDR Network Artifacts
- XDR Notes
- XDR Resolve Comment
- XDR Risky Host Count
- XDR Risky Hosts
- XDR Risky User Count
- XDR Risky Users
- XDR Similar Incidents
- XDR Starred
- XDR Status
- XDR Status v2
- XDR URL
- XDR User Count
- XDR Users
- XDR device control violations
- XDR manual severity
Indicator fields (1)
- XDR status
Integrations (3)
- Cortex XDR - IOC
- Palo Alto Networks Cortex XDR - Investigation and Response
- Cortex XDR - XQL Query Engine
Layouts (6)
- Cortex XDR - Lite
- Cortex XDR - XCLOUD
- Cortex XDR Device Control Violations
- Cortex XDR Disconnected endpoints
- Cortex XDR Incident
- Cortex XDR Port Scan
Playbooks (37)
- Calculate Severity - Cortex XDR Risky Assets
- Cortex XDR - AWS IAM user access investigation
- Cortex XDR - Block File
- Cortex XDR - Display Risky Assets
- Cortex XDR - Endpoint Investigation
- Cortex XDR - Execute commands
- Cortex XDR - Execute snippet code script
- Cortex XDR - False Positive Incident Handling
- Cortex XDR - First SSO Access
- Cortex XDR - First SSO Access - Set Verdict
- Cortex XDR - Get File Path from alerts by hash
- Cortex XDR - Get entity alerts by MITRE tactics
- Cortex XDR - Identity Analytics
- Cortex XDR - Isolate Endpoint
- Cortex XDR - Possible External RDP Brute-Force
- Cortex XDR - Possible External RDP Brute-Force - Set Verdict
- Cortex XDR - PrintNightmare Detection and Response
- Cortex XDR - Retrieve File by sha256
- Cortex XDR - Run script
- Cortex XDR - Search And Block Software - XQL Engine
- Cortex XDR - Search and Compare Process Executions - XDR Alerts
- Cortex XDR - Search and Compare Process Executions - XQL Engine
- Cortex XDR - True Positive Incident Handling
- Cortex XDR - Unisolate Endpoint
- Cortex XDR - check file existence
- Cortex XDR - delete file
- Cortex XDR - kill process
- Cortex XDR IOCs - Disable expired IOCs in XDR
- Cortex XDR IOCs - Push new IOCs to XDR
- Cortex XDR IOCs - Push new IOCs to XDR (Main)
- Cortex XDR Lite - Incident Handling
- Cortex XDR Malware - Incident Enrichment
- Cortex XDR Malware - Investigation And Response
- Cortex XDR Remote PsExec with LOLBIN command execution alert
- Cortex XDR device control violations
- Cortex XDR disconnected endpoints
- JOB - Cortex XDR query endpoint device control violations
Scripts (16)
- CortexXDRAdditionalAlertInformationWidget
- CortexXDRCloudProviderWidget
- CortexXDRIdentityInformationWidget
- CortexXDRInvestigationVerdict
- CortexXDRRemediationActionsWidget
- DBotGroupXDRIncidents
- EntryWidgetNumberHostsXDR
- EntryWidgetNumberRegionsXCLOUD
- EntryWidgetNumberResourcesXCLOUD
- EntryWidgetNumberUsersXDR
- EntryWidgetPieAlertsXDR
- XCloudRegionsPieWidget
- XCloudResourcesPieWidget
- XDRConnectedEndpoints
- XDRDisconnectedEndpoints
- XDRSyncScript
README
Cortex XDR is a detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks. Responding and managing these attacks requires security teams to reconcile data from multiple sources. Valuable time is lost shuttling between screens and executing repeatable tasks while an attack continues to manifest.
This Cortex XDR content pack contains the Palo Alto Networks Cortex XDR - Investigation and Response integration that enables direct execution of Cortex XDR actions within Cortex XSOAR. The Cortex XDR Incident Handling v3 playbook enables bidirectional incident updates between Cortex XDR and Cortex XSOAR.
Note: This pack is also compatible with Cortex XSIAM when connecting to Cortex XSIAM from Cortex XSOAR.
What does this pack do?
The playbooks included in this pack help you save time and keep your incidents in sync. They also help automate repetitive tasks associated with Cortex XDR incidents:
- Syncs and updates Cortex XDR incidents.
- Triggers a sub-playbook to handle each alert by type.
- Extracts and enriches all relevant indicators from the source alert.
- Hunts for related IOCs.
- Calculates the severity of the incident.
- Interacts with the analyst to choose a remediation path or close the incident as a false positive based on the gathered information and incident severity.
- Remediates the incident by blocking malicious indicators and isolating infected endpoints.
As part of this pack, you will also get out-of-the-box Cortex XDR incident type views, with incident fields and a full layout to facilitate analyst investigation. All of these are easily customizable to suit the needs of your organization.
For more information, visit our Cortex XSOAR Developer Docs
