Cortex XDR by Palo Alto Networks v6.3.30

Automates Cortex XDR incident response, and includes custom Cortex XDR incident views and layouts to aid analyst investigations.

Author:
Cortex XSOAR
Support:
xsoar
URL:
https://www.paloaltonetworks.com/cortex
agentix
Endpoint

Classifiers (4)

Dashboards (2)

  • Cortex XDR
  • Cortex XDR Events Grouping

Incident fields (39)

Incident types (7)

Indicator fields (1)

  • XDR status

Integrations (3)

Layouts (6)

Playbooks (37)

Scripts (16)

Widgets (20)

  • Cortex XDR Disconnected Endpoints
  • Cortex XDR Active Device Control Violations Incidents
  • Cortex XDR Active High Severity Incidents
  • Cortex XDR Active Low Severity Incidents
  • Cortex XDR Active Medium Severity Incidents
  • Cortex XDR Closed Device Control Violations
  • Cortex XDR Closed Incidents
  • Cortex XDR Connected Endpoints
  • Cortex XDR Grouping - Incidents
  • Cortex XDR Grouping - Summary
  • Cortex XDR Groups - Scatter
  • Cortex XDR Top 10 Alerts
  • Cortex XDR Top 10 Categories
  • Cortex XDR Top 10 File SHA256
  • Cortex XDR Top 10 Hosts
  • Cortex XDR Top 10 MITRE Tactics
  • Cortex XDR Top 10 MITRE Techniques
  • Cortex XDR Top 10 Users
  • Cortex XDR Top 10 files
  • Cortex XDR Unassigned Incidents

README

Cortex XDR is a detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks. Responding and managing these attacks requires security teams to reconcile data from multiple sources. Valuable time is lost shuttling between screens and executing repeatable tasks while an attack continues to manifest.

This Cortex XDR content pack contains the Palo Alto Networks Cortex XDR - Investigation and Response integration that enables direct execution of Cortex XDR actions within Cortex XSOAR. The Cortex XDR Incident Handling v3 playbook enables bidirectional incident updates between Cortex XDR and Cortex XSOAR.

Note: This pack is also compatible with Cortex XSIAM when connecting to Cortex XSIAM from Cortex XSOAR.

What does this pack do?

The playbooks included in this pack help you save time and keep your incidents in sync. They also help automate repetitive tasks associated with Cortex XDR incidents:

  • Syncs and updates Cortex XDR incidents.
  • Triggers a sub-playbook to handle each alert by type.
  • Extracts and enriches all relevant indicators from the source alert.
  • Hunts for related IOCs.
  • Calculates the severity of the incident.
  • Interacts with the analyst to choose a remediation path or close the incident as a false positive based on the gathered information and incident severity.
  • Remediates the incident by blocking malicious indicators and isolating infected endpoints.

As part of this pack, you will also get out-of-the-box Cortex XDR incident type views, with incident fields and a full layout to facilitate analyst investigation. All of these are easily customizable to suit the needs of your organization.

For more information, visit our Cortex XSOAR Developer Docs

Cortex XDR Lite - Incident Handling