Expanse Enrich Cloud Assets Deprecated

Deprecated. No available replacement. Subplaybook for Handle Expanse Incident playbooks. This Playbook is meant to be used as a subplaybook to enrich Public Cloud Assets (i.e. IP addresses and FQDNs) by: - Searching the corresponding Region and Service by correlating the provided IPs with IP range feeds retrieved from Public Cloud Providers (require TIM and Public Cloud feeds such as AWS Feed integrations to be enabled). - Searching IPs and FQDNs in Prisma Cloud inventory (requires Prisma Cloud).

Cortex Xpanse by Palo Alto Networks (Deprecated) · 13 tasks · 7 inputs · 1 output

Inputs

  • IP — IP to enrich
  • FQDN — FQDN to enrich
  • Provider — Cloud Provider
  • AWSIndicatorTags — Tags to identify AWS IP Ranges
  • GCPIndicatorTags — Tags to identify GCP IP Ranges
  • AzureIndicatorTags — Tags to identify Azure IP Ranges
  • Update Incident — Flag to check whether to update incident Update means: - Set Expanse Region and Expanse Service to the values found from indicators - Link found indicators to the incident

Outputs

  • PrismaCloud.Attribution — Prisma Cloud Asset Attribution

Commands used

associateIndicatorToIncident setIncident

Flowchart

yes yes yes yes yes Start Start Prisma Cloud - Find Public Cloud Resource by Public IP - Prisma Cloud - Find Public Cloud Resource by Public IP Prisma Cloud - Find Publi... Prisma Cloud - Find Public Cl... Prisma Cloud - Find Public Cloud Resource by FQDN - Prisma Cloud - Find Public Cloud Resource by FQDN Prisma Cloud - Find Publi... Prisma Cloud - Find Public Cl... Is there a FQDN? Is there a FQDN? Find Cloud IP Address Region and Service - Expanse Find Cloud IP Address Region and Service Find Cloud IP Address Reg... Expanse Find Cloud IP Address... Found Indicator? Found Indicator? Set Incident Region and Service - setIncident Set Incident Region and S... setIncident Link Indicator - associateIndicatorToIncident Link Indicator associateIndicatorToIncident Public Cloud Enrichment Public Cloud Enrichment Done Public Cloud Enrichment Done Public Cloud Enrichment Create formatted string for Set Incident - Set Create formatted string f... Set Is there an IP? Is there an IP? Update incident? Update incident?