IoT by Palo Alto Networks (v1.0.47)
Palo Alto Networks IoT
- Author
- Cortex XSOAR
- Support
- xsoar
- URL
- https://www.paloaltonetworks.com/cortex
- Categories
- Network Security
Incident fields (3)
- IoT Incident URL
- ServiceNow Record ID
- ServiceNow Table Name
Integrations (1)
- Palo Alto Networks IoT
Playbooks (2)
- PANW IoT Incident Handling with ServiceNow
- PANW IoT ServiceNow Tickets Check
Scripts (4)
- iot-security-alert-post-processing
- iot-security-check-servicenow
- iot-security-get-raci
- iot-security-vuln-post-processing
README
Palo Alto Networks IoT Content Pack
This content pack enables XSOAR to integrate with Palo Alto Networks IoT solution. It includes one integration and four automation scripts.
Palo Alto Networks IoT Integration
Wrap around the IoT Security Portal APIs for
- getting a device detail by an ID
- listing devices
- listing alerts and vulnerabilities
- resolving alert and vulnerability
This integration can be used for the incident response purpose.
RACI model calculation
Based on a mapping defined in the Settings > Advanced > Lists, the device attributes and the alert/vulnerability fields, this automation script can evalute the “R” and “I” in RACI (Responsible and Informed). This is useful when you have a requirement of assigning incidents to different departments in a large company.
ServiceNow ticket check
The way this pack works with ServiceNow is persisting the new ticket ID in a custom field “ServiceNow Record ID”. This automation script is to loop all the opened IoT alerts and vulnerabilities in XSOAR, and query ServiceNow for the ticket status. If the status is “CLOSED”, the corresponding XSOAR incident will be closed.
Alert and Vulnerability resolution post-processing script
For resolving the IoT security portal incidents in the post-processing XSOAR stage.