Cortex XDR - Display Risky Assets

This playbooks displays risky users and risky hosts, as detected by Cortex XDR's ITDR module. The data is displayed in incident fields in Cortex XDR incidents.

Cortex XDR by Palo Alto Networks · 12 tasks · 2 inputs · 0 outputs

Inputs

  • XDRRiskyUsers — A list of risky usernames, their scores, risk levels, and the reasons for the risk, as outputted from the "xdr-list-risky-users" command.
  • XDRRiskyHosts — A list of risky hosts, their scores, risk levels, and the reasons for the risk, as outputted from the "xdr-list-risky-hosts" command.

Commands used

setIncident

Flowchart

yes yes Start Start Is a risky user involved in the incident? Is a risky user involved ... Save risky users - SetAndHandleEmpty Save risky users SetAndHandleEmpty Risky User Layout Display Risky User Layout Display Display risky users table - SetGridField Display risky users table SetGridField Display number of risky users - setIncident Display number of risky u... setIncident Is a risky host involved in the incident? Is a risky host involved ... Save risky hosts - SetAndHandleEmpty Save risky hosts SetAndHandleEmpty Risky Host Layout Display Risky Host Layout Display Display risky hosts table - SetGridField Display risky hosts table SetGridField Display number of risky hosts - setIncident Display number of risky h... setIncident Done Done