Cortex XDR device control violations

Queries Cortex XDR for device control violations for the specified hosts, IP address, or XDR endpoint ID. It then communicates via email with the involved users to understand the nature of the incident and if the user connected the device. All the collected data will be displayed in the XDR device control incident layout. This playbook can also be associated with Cortex XDR device control violation job to periodically query and investigate XDR device control violations. In this configuration, the playbook will only communicate with the involved users.

Cortex XDR by Palo Alto Networks · 13 tasks · 6 inputs · 0 outputs

Inputs

  • TimeStamp — Timestamp in relative date format for query device control events from Cortex XDR. For example "1 day", "3 weeks".
  • EndpointID — Comma-separated list of endpoint IDs to filter results for.
  • Hostname — Comma-separated list of hostnames to filter results for.
  • IPAddress — Comma-separated list of endpoints IP Addresses to filter results for.
  • MessageSubject — The subject of the message for communication with the involved users.
  • MessageBody — A body of the message for communication with the involved users.

Commands used

ad-get-user xdr-get-endpoint-device-control-violations

Flowchart

yes yes yes yes yes Start Start Get endpoint device control violations - xdr-get-endpoint-device-control-violations Get endpoint device contr... xdr-get-endpoint-device-contr... Were device control violations found? Were device control viola... Communicate with the end-user Communicate with the end-... Get user email address - ad-get-user Get user email address ad-get-user Did the involved user connect the device? Did the involved user con... Check if the device is approved for use Check if the device is ap... Done Done Set device control grid - SetGridField Set device control grid SetGridField Were current violations found? Were current violations f... Set Violations fields - Set Set Violations fields Set Is the user's email retrieved? Is the user's email retri... Is Active Directory enabled? - IsIntegrationAvailable Is Active Directory enabled? IsIntegrationAvailable