Cortex XDR IOCs - Push new IOCs to XDR

This is a *sub-playbook* of "Cortex XDR IOCs - Push new IOCs to XDR - Main" and should not be run on its own. This sub-playbook retrieves IOCs according to the users query input (passed from the main playbook) and pushes them into Cortex XDR, and marks them as "xdr_pushed" or "xdr_not_processed" for further processing.

Cortex XDR by Palo Alto Networks · 24 tasks · 2 inputs · 0 outputs

Inputs

  • batch_size —
  • query —

Commands used

appendIndicatorField xdr-iocs-push

Flowchart

yes yes yes yes yes yes yes Start Start Set Done to True - Set Set Done to True Set xdr-iocs-push - xdr-iocs-push xdr-iocs-push xdr-iocs-push Add xdr_pushed tag - appendIndicatorField Add xdr_pushed tag appendIndicatorField Check results Check results DeleteContext - DeleteContext DeleteContext DeleteContext Hashes Hashes IPs and Domains IPs and Domains Has domains or IPs Has domains or IPs No Domains or IPs No Domains or IPs Iteration finished Iteration finished Done Done Domains and IPs done Domains and IPs done Set SHA256 in context - Set Set SHA256 in context Set Set MD5 in context - Set Set MD5 in context Set Has MD5 Has MD5 Add `xdr_not_processed` tag to irrelevant hashes - appendIndicatorField Add `xdr_not_processed` t... appendIndicatorField SearchIndicator - SearchIndicator SearchIndicator SearchIndicator set iocs to push to xdr - Set set iocs to push to xdr Set Save irrelevant hashes in context for marking - Set Save irrelevant hashes in... Set Has SHA256 Has SHA256 Are there indicators to push? Are there indicators to p... Hashes Done Hashes Done Are there any irrelevant hashes in the context for marking? Are there any irrelevant ...