Cortex XDR disconnected endpoints

A Job to periodically query disconnected Cortex XDR endpoints with a provided last seen time range playbook input. The Collected data, if found will be generated to a CSV report, including a detailed list of the disconnected endpoints. The report will be sent to the recipient's provided email addresses in the playbook input. The playbook includes an incident type with a dedicated layout to visualize the collected data. To set the job correctly, you will need to. 1. Create a new recurring job. 2. Set the recurring schedule. 3. Add a name. 4. Set type to Cortex XDR disconnected endpoints. 5. Set this playbook as the job playbook. https://xsoar.pan.dev/docs/incidents/incident-jobs The scheduled run time and the timestamp relative date should be identical, If the job is recurring every 7 days, the time range should be 7 days as well.

Cortex XDR by Palo Alto Networks · 11 tasks · 4 inputs · 0 outputs

Details

ID	`Cortex XDR disconnected endpoints`
From Version	5.5.0
Tasks	11

README

Create a new recurring job.
Set the recurring schedule.
Add a name.
Set type to Cortex XDR disconnected endpoints.
Set this playbook as the job playbook.

https://xsoar.pan.dev/docs/incidents/incident-jobs

The scheduled run time and the timestamp relative date should be identical,
If the job is recurring every 7 days, the time range should be 7 days as well.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

CortexXDRIR

Scripts

SetGridField
Set
ExportToCSV

Commands

setIncident
send-mail
xdr-get-endpoints
closeInvestigation

Playbook Inputs

Name	Description	Default Value	Required
LastSeenStartDate	Last seen start date, in relative timestamp - “1 Day” or “7 days”		Optional
LastSeenEndDate	Last seen end date, in relative timestamp - “1 Day” or “7 days” For the current day use “0 days”		Optional
Email	Email addresses to send the disconnected endpoints report.		Optional
MessageBody	Body for the report email message.	This message contains an automatically generated report by Cortex XSOAR, including a list of disconnected Cortex XDR endpoints. Please investigate and remediate according to the organization’s policy.	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

Cortex XDR disconnected endpoints

Inputs

LastSeenStartDate — Last seen start date, in relative timestamp - "1 Day" or "7 days"
LastSeenEndDate — Last seen end date, in relative timestamp - "1 Day" or "7 days" For the current day use "0 days"
Email — Email addresses to send the disconnected endpoints report.
MessageBody — Body for the report email message.

Commands used

closeInvestigation send-mail setIncident xdr-get-endpoints

Flowchart

Source

playbook-Cortex_XDR_disconnected_endpoints.yml

Download History Raw

id: Cortex XDR disconnected endpoints
version: -1
contentitemexportablefields:
  contentitemfields: {}
name: Cortex XDR disconnected endpoints
description: |
  A Job to periodically query disconnected Cortex XDR endpoints with a provided last seen time range playbook input.
  The Collected data, if found will be generated to a CSV report, including a detailed list of the disconnected endpoints.
  The report will be sent to the recipient's provided email addresses in the playbook input.
  The playbook includes an incident type with a dedicated layout to visualize the collected data.
  To set the job correctly, you will need to.
  1. Create a new recurring job.
  2. Set the recurring schedule.
  3. Add a name.
  4. Set type to Cortex XDR disconnected endpoints.
  5. Set this playbook as the job playbook.

  https://xsoar.pan.dev/docs/incidents/incident-jobs

  The scheduled run time and the timestamp relative date should be identical,
  If the job is recurring every 7 days, the time range should be 7 days as well.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: a7e4284c-c498-4306-8cfd-89a9072a8cd8
    type: start
    task:
      id: a7e4284c-c498-4306-8cfd-89a9072a8cd8
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "12"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 50
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "2":
    id: "2"
    taskid: 12957918-32bb-4c3b-8cdc-4b149812f2f7
    type: regular
    task:
      id: 12957918-32bb-4c3b-8cdc-4b149812f2f7
      version: -1
      name: Generate a CSV report for disconnected XDR endpoints
      description: Export the given array to a CSV file.
      tags:
      - Endpoint report
      type: regular
      iscommand: false
      brand: ""
      script: ExportToCSV
    nexttasks:
      '#none#':
      - "9"
    scriptarguments:
      csvArray:
        complex:
          root: PaloAltoNetworksXDR.Endpoint
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Endpoint.endpoint_status
                iscontext: true
              right:
                value:
                  simple: LOST
            - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Endpoint.endpoint_status
                iscontext: true
              right:
                value:
                  simple: DISCONNECTED
      fileName:
        simple: Disconnected XDR endpoints - ${incident.created}.csv
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 545
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "3":
    id: "3"
    taskid: 7b27a983-42e1-408d-8c6f-2c672b3f353f
    type: regular
    task:
      id: 7b27a983-42e1-408d-8c6f-2c672b3f353f
      version: -1
      name: Mail disconnected endpoints report
      description: Sends an mail using Gmail/EWS.
      script: '|||send-mail'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "6"
    scriptarguments:
      attachIDs:
        complex:
          root: File
          accessor: EntryID
      htmlBody:
        complex:
          root: inputs.MessageBody
      subject:
        simple: Cortex XDR Disconnected Endpoints
      to:
        complex:
          root: inputs.Email
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 895
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "4":
    id: "4"
    taskid: 6daa6400-3c03-4285-8c7a-672e14d9bf8c
    type: title
    task:
      id: 6daa6400-3c03-4285-8c7a-672e14d9bf8c
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1770
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "5":
    id: "5"
    taskid: fa23f54f-4e1c-44dd-8ad7-d5c1ae59b2ca
    type: condition
    task:
      id: fa23f54f-4e1c-44dd-8ad7-d5c1ae59b2ca
      version: -1
      name: Disconnected endpoints found?
      description: ''''''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "10"
      "yes":
      - "2"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              simple: PaloAltoNetworksXDR.Endpoint
            iscontext: true
      - - operator: isEqualString
          left:
            value:
              simple: PaloAltoNetworksXDR.Endpoint.endpoint_status
            iscontext: true
          right:
            value:
              simple: LOST
        - operator: isEqualString
          left:
            value:
              simple: PaloAltoNetworksXDR.Endpoint.endpoint_status
            iscontext: true
          right:
            value:
              simple: DISCONNECTED
    view: |-
      {
        "position": {
          "x": 50,
          "y": 370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "6":
    id: "6"
    taskid: 004b7e07-9e8a-4ec3-8c63-a02e05bab64e
    type: regular
    task:
      id: 004b7e07-9e8a-4ec3-8c63-a02e05bab64e
      version: -1
      name: Count involved users and hosts
      description: Count the users and hosts involved in the incidents and insert the amount in the incident field,
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      xdrhostcount:
        complex:
          root: PaloAltoNetworksXDR.Endpoint
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Endpoint.endpoint_status
                iscontext: true
              right:
                value:
                  simple: LOST
            - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Endpoint.endpoint_status
                iscontext: true
              right:
                value:
                  simple: DISCONNECTED
          accessor: host_name
          transformers:
          - operator: count
      xdrusercount:
        complex:
          root: PaloAltoNetworksXDR.Endpoint
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Endpoint.endpoint_status
                iscontext: true
              right:
                value:
                  simple: LOST
            - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Endpoint.endpoint_status
                iscontext: true
              right:
                value:
                  simple: DISCONNECTED
          accessor: users
          transformers:
          - operator: count
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1070
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "7":
    id: "7"
    taskid: db61aeaf-0ea6-4a74-88e1-67d2909483d2
    type: regular
    task:
      id: db61aeaf-0ea6-4a74-88e1-67d2909483d2
      version: -1
      name: Set endpoints grid
      description: Creates a grid table from items or key-value pairs.
      type: regular
      iscommand: false
      brand: ""
      script: SetGridField
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      columns:
        simple: Endpoint Name,Endpoint Status,Endpoint OS,Endpoint ID,Endpoint Last Seen
      context_path:
        simple: XDR.DisconnectedEndpoints
      grid_id:
        simple: xdrdisconnectedendpoints
      keys:
        simple: host_name,endpoint_status,agent_type,endpoint_id,last_seen
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1420
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "8":
    id: "8"
    taskid: 6efdd411-a1da-45eb-8e58-49fbe793acd3
    type: regular
    task:
      id: 6efdd411-a1da-45eb-8e58-49fbe793acd3
      version: -1
      name: Set disconnected endpoints
      description: |-
        Set a value in context under the key you entered. If no value is entered, the script doesn't do anything.

        This automation runs using the default Limited User role, unless you explicitly change the permissions.
        For more information, see the section about permissions here:
        https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Automations
      type: regular
      iscommand: false
      brand: ""
      script: SetAndHandleEmpty
    nexttasks:
      '#none#':
      - "7"
    scriptarguments:
      key:
        simple: XDR.DisconnectedEndpoints
      value:
        complex:
          root: PaloAltoNetworksXDR.Endpoint
          filters:
          - - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Endpoint.endpoint_status
                iscontext: true
              right:
                value:
                  simple: LOST
            - operator: isEqualString
              left:
                value:
                  simple: PaloAltoNetworksXDR.Endpoint.endpoint_status
                iscontext: true
              right:
                value:
                  simple: DISCONNECTED
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 1245
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "9":
    id: "9"
    taskid: 64c667fe-c0c9-45e5-8a98-36853b612485
    type: condition
    task:
      id: 64c667fe-c0c9-45e5-8a98-36853b612485
      version: -1
      name: Email report?
      description: ''''''
      type: condition
      iscommand: false
      brand: ""
    nexttasks:
      '#default#':
      - "6"
      "yes":
      - "3"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: inputs.Email
            iscontext: true
    view: |-
      {
        "position": {
          "x": 162.5,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "10":
    id: "10"
    taskid: 531e649f-d89d-4269-8cbd-e1e041e272f9
    type: regular
    task:
      id: 531e649f-d89d-4269-8cbd-e1e041e272f9
      version: -1
      name: Close job
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "4"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 50,
          "y": 1595
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
    isoversize: false
    isautoswitchedtoquietmode: false
    continueonerrortype: ""
  "12":
    continueonerrortype: ""
    id: "12"
    ignoreworker: false
    isautoswitchedtoquietmode: false
    isoversize: false
    nexttasks:
      '#none#':
      - "5"
    note: false
    quietmode: 0
    scriptarguments:
      all_results:
        simple: "false"
      last_seen_gte:
        complex:
          filters:
          - - left:
                iscontext: true
                value:
                  simple: inputs.LastSeenStartDate
              operator: isNotEmpty
          root: inputs.LastSeenStartDate
      last_seen_lte:
        complex:
          filters:
          - - left:
                iscontext: true
                value:
                  simple: inputs.LastSeenEndDate
              operator: isNotEmpty
          root: inputs.LastSeenEndDate
      status:
        simple: disconnected,lost
      use_hr_timestamps:
        simple: "true"
    separatecontext: false
    skipunavailable: false
    task:
      brand: ""
      description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoints from the start of the result set. (Start by counting from 0).
      id: 731a66f9-21d4-472a-8924-abf1fc7bf686
      iscommand: true
      name: Get XDR disconnected endpoints
      script: '|||xdr-get-endpoints'
      type: regular
      version: -1
    taskid: 731a66f9-21d4-472a-8924-abf1fc7bf686
    timertriggers: []
    type: regular
    view: |-
      {
        "position": {
          "x": 50,
          "y": 195
        }
      }
view: |-
  {
    "linkLabelsPosition": {
      "5_10_#default#": 0.1,
      "5_2_yes": 0.62,
      "9_6_#default#": 0.21
    },
    "paper": {
      "dimensions": {
        "height": 1785,
        "width": 492.5,
        "x": 50,
        "y": 50
      }
    }
  }
inputs:
- key: LastSeenStartDate
  value: {}
  required: false
  description: 'Last seen start date, in relative timestamp - "1 Day" or  "7 days" '
  playbookInputQuery:
- key: LastSeenEndDate
  value: {}
  required: false
  description: "Last seen end date, in relative timestamp - \"1 Day\" or  \"7 days\" \nFor the current day use \"0 days\""
  playbookInputQuery:
- key: Email
  value: {}
  required: false
  description: Email addresses to send the disconnected endpoints report.
  playbookInputQuery:
- key: MessageBody
  value:
    simple: |-
      This message contains an automatically generated report by Cortex XSOAR, including a list of  disconnected Cortex XDR endpoints.
      Please investigate and remediate according to the organization's policy.
  required: false
  description: 'Body for the report email message. '
  playbookInputQuery:
outputs: []
tests:
- Test XDR Playbook general commands
- Test XDR Playbook
fromversion: 5.5.0
inputSections:
- description: Generic group for inputs.
  inputs:
  - LastSeenStartDate
  - LastSeenEndDate
  - Email
  - MessageBody
  name: General (Inputs group)
outputSections:
- description: Generic group for outputs.
  name: General (Outputs group)
  outputs: []