JOB - Cortex XDR query endpoint device control violations
A job to periodically query Cortex XDR device control violations by a given timestamp in a relative date playbook input. The collected data, if found, will be generated for a new incident. You can configure the created new incident type in the playbook input and use the XDR Device Control Violations incident type to associate it with the response playbook. The job includes an incident type with a dedicated layout to visualize the collected data. To configure the job correctly: 1. Create a new recurring job. 2. Configure the recurring schedule. 3. Add a name. 4. Configure the type to XDR Device Control Violations. 5. Configure this playbook as the job playbook. The scheduled run time and the timestamp relative date should be identical. If the job recurs every 7 days, the timestamp should be 7 days as well.
- Pack
- CortexXDR
- Tasks
- 8
Inputs
- TimeStamp — Timestamp in relative date format for query device control events from Cortex XDR. For example "1 day", "3 weeks".
- Severity — The severity of the created incident when the device control events were found. Valid values are; 0 - Unknown 0.5 - Informational 1 - Low 2 - Medium 3 - High 4 - Critical
- IncidentType — The desired incident type for the created incident when the device control violations were found.
- EndpointID — The Endpoint ID to search for device control violations.
- Hostname — The hostname of the endpoint to query for device control violations.
- IPAddress — The IP address of the endpoint to query for device control violations.
Commands used
- closeInvestigation
- createNewIncident
- setIncident
- xdr-get-endpoint-device-control-violations