Cortex XDR IOCs - Push new IOCs to XDR (Main)

This is the *main* playbook for Cortex XDR IOCs sync. The playbook will "sync" IOCs into Cortex XDR by pushing new IOCs in and disabling expired IOCs. The playbook utilizes Cortex XSOAR tags and loops in order to find IOCs using a query provided by the user. The playbook will iterate over the IOCs pushing them in batches into Cortex XDR. In the second phase, the playbook will disable expired IOCs that were previously pushed into Cortex XDR. We recommend running this playbook as a job a twice a day after disabling the integration sync function.

Cortex XDR by Palo Alto Networks · 7 tasks · 2 inputs · 0 outputs

Inputs

  • batch_size — This parameter will set the batch size to be pushed into Cortex XDR with every iteration of the loop.
  • query — The query used to search for IOCs from Cortex XSOAR to be pushed into Cortex XDR. This query must include `-tags:xdr_pushed and -tags:xdr_not_processed` in order to work properly.

Commands used

closeInvestigation

Flowchart

Start Start Set Done Flag - Set Set Done Flag Set Done Done Reset Done Flag - Set Reset Done Flag Set Cortex XDR IOCs - Push new IOCs to XDR - Cortex XDR IOCs - Push new IOCs to XDR Cortex XDR IOCs - Push ne... Cortex XDR IOCs - Push new IO... Cortex XDR IOCs - Disable expired IOCs in XDR - Cortex XDR IOCs - Disable expired IOCs in XDR Cortex XDR IOCs - Disable... Cortex XDR IOCs - Disable exp... Close Incident - closeInvestigation Close Incident closeInvestigation