Calculate Severity - Cortex XDR Risky Assets

Calculates a severity for the incident based on the involvement of risky users or risky hosts in the incident, as determined by the Cortex XDR ITDR module.

Cortex XDR by Palo Alto Networks · 14 tasks · 2 inputs · 2 outputs

Inputs

  • XDRRiskyUsers — An object of risky users and their corresponding scores, as outputted by the "xdr-list-risky-users" command.
  • XDRRiskyHosts — An object of risky hosts and their corresponding scores, as outputted by the "xdr-list-risky-hosts" command.

Outputs

  • Severities.XDRUserSeverity — The severity evaluated by the highest risk level associated with the Cortex XDR user. Can be Low, Medium or High.
  • Severities.XDRHostSeverity — The severity evaluated by the highest risk level associated with the Cortex XDR host. Can be Low, Medium or High.

Flowchart

yes yes High Low Medium High Low Medium Start Start Done Done Is there a risky user? Is there a risky user? No Risky Hosts No Risky Hosts Set user severity to high - Set Set user severity to high Set Set user severity to medium - Set Set user severity to medium Set Set user severity to low - Set Set user severity to low Set Is there a risky host? Is there a risky host? What is the highest risk level associated with the users? What is the highest risk ... No Risky Users No Risky Users What is the highest risk level associated with the hosts? What is the highest risk ... Set host severity to low - Set Set host severity to low Set Set host severity to medium - Set Set host severity to medium Set Set host severity to high - Set Set host severity to high Set