Cortex Xpanse v1.2.17
Content for working with Attack Surface Management (ASM).
- Author:
- Cortex XSOAR
- Support:
- xsoar
Classifiers (2)
Dashboards (1)
- Cortex Xpanse Overview Dashboard
Incident fields (24)
- Xpanse Alert ID
- Xpanse Asset IDs
- Xpanse Attack Surface Rule Name
- Xpanse Business Units
- Xpanse Category
- Xpanse Certificate Asset
- Xpanse Cloud Asset
- Xpanse Country Code
- Xpanse Description
- Xpanse Domain Asset
- Xpanse External ID
- Xpanse Host Name
- Xpanse IP
- Xpanse Port
- Xpanse Progress Status
- Xpanse Protocol
- Xpanse Provider
- Xpanse Remediation Guidance
- Xpanse Responsive IP Asset
- Xpanse Service Classifications
- Xpanse Service Details
- Xpanse Service ID
- Xpanse Service Validation
- Xpanse Tags
Incident types (2)
Integrations (2)
Layouts (1)
Widgets (8)
- Assigned Active Xpanse Incidents
- Exposed Ports in Xpanse Incidents
- New Xpanse High & Critical Incidents
- Unassigned Active Xpanse Incidents
- Xpanse Incident Count by Business Unit
- Xpanse Incidents by Protocol
- Xpanse Incidents by Provider
- Xpanse Problematic IPs
Wizards (1)
- Xpanse Attack Surface Management
README
The Cortex Xpanse pack is supported by Cortex Xpanse Active ASM.
Cortex Xpanse Active ASM is the best in class External Attack Surface Management solutions that strive to proactively reduce the frequency and severity of security incidents caused by internet-exposed risks. These solutions deliver comprehensive attack surface visibility by combining thorough, ML enhanced asset attribution with continuous attack surface assessment. Discovered risks are prioritized using contextual information and exploitability data, and findings are actioned on through curated automated playbooks to investigate, remediate, and summarize every new alert.
Note: This pack supports Cortex Xpanse Active ASM which may also be referred to as Expander v2 or using it’s
major.minorversion, i.e. Expander 2.X.
What does this pack do?
This pack contains an integration for fetching ASM alerts from Cortex Xpanse Active ASM.
Playbooks
Expanse - Alert Handler
This playbook is the default handler for Cortex Xpanse alerts that focuses primarily on enrichment.
Expanse - Alert Enrichment
This playbook handles ASM alerts by enriching asset information via integrations with Cloud Service Providers and other IT and Security tools.
Expanse - Alert Self-Enrichment
This playbook handles ASM alerts by enriching alert information with Xpanse service and asset details.
Expanse - NMap - Detect Service
This playbook confirms the observability of a risk by running a quick port scan using NMap.
