JOB - Cortex XDR query endpoint device control violations

A job to periodically query Cortex XDR device control violations by a given timestamp in a relative date playbook input. The collected data, if found, will be generated for a new incident. You can configure the created new incident type in the playbook input and use the XDR Device Control Violations incident type to associate it with the response playbook. The job includes an incident type with a dedicated layout to visualize the collected data. To configure the job correctly: 1. Create a new recurring job. 2. Configure the recurring schedule. 3. Add a name. 4. Configure the type to XDR Device Control Violations. 5. Configure this playbook as the job playbook. The scheduled run time and the timestamp relative date should be identical. If the job recurs every 7 days, the timestamp should be 7 days as well.

Cortex XDR by Palo Alto Networks · 8 tasks · 6 inputs · 0 outputs

Details

ID	`JOB - Cortex XDR query endpoint device control violations`
From Version	5.5.0
Tasks	8

README

Create a new recurring job.
Configure the recurring schedule.
Add a name.
Configure the type to XDR Device Control Violations.
Configure this playbook as the job playbook.
The scheduled run time and the timestamp relative date should be identical.
If the job recurs every 7 days, the timestamp should be 7 days as well.

Dependencies

This playbook uses the following sub-playbooks, integrations, and scripts.

Sub-playbooks

This playbook does not use any sub-playbooks.

Integrations

CortexXDRIR

Scripts

SetGridField

Commands

closeInvestigation
createNewIncident
setIncident
xdr-get-endpoint-device-control-violations

Playbook Inputs

Name	Description	Default Value	Required
TimeStamp	Timestamp in relative date format for query device control events from Cortex XDR. For example “1 day”, “3 weeks”.		Optional
Severity	The severity of the created incident when the device control events were found. Valid values are; 0 - Unknown 0.5 - Informational 1 - Low 2 - Medium 3 - High 4 - Critical	1	Optional
IncidentType	The desired incident type for the created incident when the device control violations were found.	Cortex XDR Device Control Violations	Optional

Playbook Outputs

There are no outputs for this playbook.

Playbook Image

JOB - Cortex XDR query endpoint device control violations

Inputs

TimeStamp — Timestamp in relative date format for query device control events from Cortex XDR. For example "1 day", "3 weeks".
Severity — The severity of the created incident when the device control events were found. Valid values are; 0 - Unknown 0.5 - Informational 1 - Low 2 - Medium 3 - High 4 - Critical
IncidentType — The desired incident type for the created incident when the device control violations were found.
EndpointID — The Endpoint ID to search for device control violations.
Hostname — The hostname of the endpoint to query for device control violations.
IPAddress — The IP address of the endpoint to query for device control violations.

Commands used

closeInvestigation createNewIncident setIncident xdr-get-endpoint-device-control-violations

Flowchart

Source

playbook-JOB_-_Cortex_XDR_query_endpoint_device_control_violations.yml

Download History Raw

id: JOB - Cortex XDR query endpoint device control violations
version: -1
name: JOB - Cortex XDR query endpoint device control violations
description: |2-
    A job to periodically query Cortex XDR device control violations by a given timestamp in a relative date playbook input.
    The collected data, if found, will be generated for a new incident.
    You can configure the created new incident type in the playbook input and use the XDR Device Control Violations incident type to associate it with the response playbook.
    The job includes an incident type with a dedicated layout to visualize the collected data.
    To configure the job correctly:
    1. Create a new recurring job.
    2. Configure the recurring schedule.
    3. Add a name.
    4. Configure the type to XDR Device Control Violations.
    5. Configure this playbook as the job playbook.
    The scheduled run time and the timestamp relative date should be identical.
    If the job recurs every 7 days, the timestamp should be 7 days as well.
starttaskid: "0"
tasks:
  "0":
    id: "0"
    taskid: ffe7dd30-7c4d-40c0-8734-468ae38cffe6
    type: start
    task:
      id: ffe7dd30-7c4d-40c0-8734-468ae38cffe6
      version: -1
      name: ""
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#none#':
      - "1"
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 110
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "1":
    id: "1"
    taskid: 759e4939-75e9-4c60-8cb0-40d94fd5f232
    type: regular
    task:
      id: 759e4939-75e9-4c60-8cb0-40d94fd5f232
      version: -1
      name: Get endpoint device control violations
      description: Gets a list of device control violations filtered by selected fields.
        You can retrieve up to 100 violations.
      script: '|||xdr-get-endpoint-device-control-violations'
      type: regular
      iscommand: true
      brand: ""
    nexttasks:
      '#none#':
      - "2"
    scriptarguments:
      endpoint_ids:
        complex:
          root: inputs.EndpointID
      hostname:
        complex:
          root: inputs.Hostname
      ip_list:
        complex:
          root: inputs.IPAddress
      product: {}
      product_id: {}
      serial: {}
      timestamp_gte:
        complex:
          root: inputs.TimeStamp
      timestamp_lte: {}
      type: {}
      username: {}
      vendor: {}
      vendor_id: {}
      violation_id_list: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 250
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "2":
    id: "2"
    taskid: 180ab59c-d7fe-460d-8612-083c0816afd6
    type: condition
    task:
      id: 180ab59c-d7fe-460d-8612-083c0816afd6
      version: -1
      name: Were device control violations found?
      type: condition
      iscommand: false
      brand: ""
      description: ''
    nexttasks:
      '#default#':
      - "11"
      "yes":
      - "9"
    separatecontext: false
    conditions:
    - label: "yes"
      condition:
      - - operator: isNotEmpty
          left:
            value:
              complex:
                root: PaloAltoNetworksXDR
                accessor: EndpointViolations
            iscontext: true
    view: |-
      {
        "position": {
          "x": 450,
          "y": 440
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "8":
    id: "8"
    taskid: 43feb7c2-573d-4f0c-8521-07955a671d29
    type: title
    task:
      id: 43feb7c2-573d-4f0c-8521-07955a671d29
      version: -1
      name: Done
      type: title
      iscommand: false
      brand: ""
      description: ''
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 240,
          "y": 1370
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "9":
    id: "9"
    taskid: d21ccce9-a4da-4018-8dd4-f0c5ec25a6a2
    type: regular
    task:
      id: d21ccce9-a4da-4018-8dd4-f0c5ec25a6a2
      version: -1
      name: Set device control grid
      description: Creates a grid table from items or key-value pairs.
      scriptName: SetGridField
      type: regular
      iscommand: false
      brand: ""
    nexttasks:
      '#none#':
      - "12"
    scriptarguments:
      columns:
        simple: Hostname,Username,IP,XDR endpoint ID,Violation type,Date,Product,Vendor
      context_path:
        simple: PaloAltoNetworksXDR.EndpointViolations
      grid_id:
        simple: xdrdevicecontrolviolations
      keys:
        simple: hostname,username,ip,endpoint_id,type,date,product,vendor
      overwrite: {}
      sort_by: {}
      unpack_nested_elements: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 720
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "10":
    id: "10"
    taskid: beef8861-2f9d-4a70-810f-ffae2e09eb80
    type: regular
    task:
      id: beef8861-2f9d-4a70-810f-ffae2e09eb80
      version: -1
      name: Create New Incident
      description: commands.local.cmd.create.inc
      script: Builtin|||createNewIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "11"
    scriptarguments:
      accountid: {}
      accountname: {}
      agentid: {}
      alertid: {}
      alertname: {}
      app: {}
      applicationid: {}
      applicationname: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      categorycount: {}
      city: {}
      closetime: {}
      closingreason: {}
      closinguser: {}
      cloudservice: {}
      commandline: {}
      compliancenotes: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      createddatefailedincidents: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cvssavailabilityrequirement: {}
      cvsscollateraldamagepotential: {}
      cvssconfidentialityrequirement: {}
      cvssintegrityrequirement: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationgeolocation: {}
      destinationhostname: {}
      destinationip: {}
      destinationips: {}
      destinationipv6: {}
      destinationmacaddress: {}
      destinationnetwork: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details:
        simple: |2
           An external device connected to the corporate network.
          Device Control violation fetched from Cortex XDR with the Fetch device control violation Job.
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      deviceid: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      devicetime: {}
      displayname: {}
      dnsname: {}
      dstports: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailhtmlimage: {}
      emailinreplyto: {}
      emailkeywords: {}
      emaillabels: {}
      emaillatestmessage: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      entryIDs: {}
      errorcode: {}
      errormessage: {}
      escalation: {}
      eventaction: {}
      eventdescriptions: {}
      eventid: {}
      eventnames: {}
      events: {}
      eventtype: {}
      externaladdresses: {}
      failedincidentscreateddate: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      followup: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      highlevelcategories: {}
      hostname: {}
      hosts: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      integrationscategories: {}
      integrationsfailedcategories: {}
      integrationstestgrid: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmirroredintime: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      lastupdatetime: {}
      leadership: {}
      listofrulesevent: {}
      location: {}
      locationregion: {}
      logsource: {}
      logsourcename: {}
      logsourcetype: {}
      lowlevelcategoriesevents: {}
      macaddress: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name:
        simple: Cortex XDR Device Control Violation
      numberofentriesiderrors: {}
      numberoffailedincidents: {}
      numberoflogsources: {}
      occurred: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      playbooknameswithfailedtasks: {}
      playbooksfailedcommands: {}
      playbookswithfailedtasks: {}
      playbooktaskserrors: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      postnatdestinationip: {}
      postnatdestinationport: {}
      postnatsourceip: {}
      postnatsourceport: {}
      prenatdestinationport: {}
      prenatsourceip: {}
      prenatsourceport: {}
      protocol: {}
      protocolevent: {}
      protocols: {}
      quarantined: {}
      ransomwareapproximatenumberofencryptedendpoints: {}
      ransomwarecryptocurrencyaddress: {}
      ransomwarecryptocurrencyaddresstype: {}
      ransomwaredataencryptionstatus: {}
      ransomwareemail: {}
      ransomwareencryptedfileowner: {}
      ransomwarenote: {}
      ransomwareonionaddress: {}
      ransomwarerecoverytool: {}
      ransomwarestrain: {}
      rating: {}
      rawevent: {}
      region: {}
      regionid: {}
      reporteremailaddress: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      samaccountname: {}
      severity:
        complex:
          root: inputs.Severity
      sha1: {}
      sha256: {}
      sha512: {}
      signature: {}
      similarincident: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcegeolocation: {}
      sourcehostname: {}
      sourceip: {}
      sourceips: {}
      sourceipv6: {}
      sourcemacaddress: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcports: {}
      srcuser: {}
      starttime: {}
      state: {}
      streetaddress: {}
      subcategory: {}
      subtype: {}
      surname: {}
      systems: {}
      targetfirewallversion: {}
      technicalowner: {}
      technicalownercontact: {}
      technicaluser: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      totalfailedinstances: {}
      totalgoodinstances: {}
      totalinstances: {}
      trafficdirection: {}
      triggeredsecurityprofile: {}
      type:
        complex:
          root: inputs.IncidentType
      unassignedincidents: {}
      unhealthyendpoints: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userid: {}
      username: {}
      usernames:
        complex:
          root: PaloAltoNetworksXDR.EndpointViolations.violations
          accessor: username
      users: {}
      vendorid: {}
      vendorproduct: {}
      vulnerabilitycategory: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrdevicecontrolviolations:
        complex:
          root: PaloAltoNetworksXDR
          accessor: EndpointViolations
      xdrdisconnectedendpoints: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount:
        complex:
          root: PaloAltoNetworksXDR.EndpointViolations
          accessor: hostname
          transformers:
          - operator: uniq
          - operator: count
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmanualseverity: {}
      xdrmediumseverityalertcount: {}
      xdrmodificationtime: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount:
        complex:
          root: PaloAltoNetworksXDR.EndpointViolations
          accessor: username
          transformers:
          - operator: uniq
          - operator: count
      zipcode: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1030
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "11":
    id: "11"
    taskid: 200c5756-b13d-48b9-8100-277a9fd35507
    type: regular
    task:
      id: 200c5756-b13d-48b9-8100-277a9fd35507
      version: -1
      name: Close job
      description: commands.local.cmd.close.inv
      script: Builtin|||closeInvestigation
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "8"
    scriptarguments:
      assetid: {}
      closeNotes: {}
      closeReason: {}
      emailclassification: {}
      id: {}
      incomingmirrorerror: {}
      outgoingmirrorerror: {}
      phishingsubtype: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 1200
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
  "12":
    id: "12"
    taskid: 9f84a3cd-4791-492b-899c-da8e19549b4b
    type: regular
    task:
      id: 9f84a3cd-4791-492b-899c-da8e19549b4b
      version: -1
      name: Count involved users and hosts
      description: commands.local.cmd.set.incident
      script: Builtin|||setIncident
      type: regular
      iscommand: true
      brand: Builtin
    nexttasks:
      '#none#':
      - "10"
    scriptarguments:
      accountid: {}
      accountname: {}
      addLabels: {}
      agentid: {}
      alertid: {}
      alertname: {}
      app: {}
      appendMultiSelect: {}
      applicationid: {}
      applicationname: {}
      assetid: {}
      assigneduser: {}
      assignmentgroup: {}
      attachmentcount: {}
      attachmentextension: {}
      attachmenthash: {}
      attachmentid: {}
      attachmentname: {}
      attachmentsize: {}
      attachmenttype: {}
      blockedaction: {}
      bugtraq: {}
      caller: {}
      categorycount: {}
      city: {}
      closeNotes: {}
      closeReason: {}
      closetime: {}
      closingreason: {}
      closinguser: {}
      cloudservice: {}
      commandline: {}
      compliancenotes: {}
      costcenter: {}
      costcentercode: {}
      country: {}
      countryname: {}
      createddatefailedincidents: {}
      criticalassets: {}
      customFields: {}
      cve: {}
      cvss: {}
      cvssavailabilityrequirement: {}
      cvsscollateraldamagepotential: {}
      cvssconfidentialityrequirement: {}
      cvssintegrityrequirement: {}
      dbotMirrorDirection: {}
      dbotMirrorId: {}
      dbotMirrorInstance: {}
      dbotMirrorTags: {}
      dbotprediction: {}
      dbotpredictionprobability: {}
      dbottextsuggestionhighlighted: {}
      deleteEmptyField: {}
      department: {}
      dest: {}
      desthostname: {}
      destinationgeolocation: {}
      destinationhostname: {}
      destinationip: {}
      destinationips: {}
      destinationipv6: {}
      destinationmacaddress: {}
      destinationnetwork: {}
      destinationport: {}
      destntdomain: {}
      destos: {}
      details: {}
      detectedexternalhosts: {}
      detectedexternalips: {}
      detectedinternalhosts: {}
      detectedinternalips: {}
      detectedusers: {}
      detectionendtime: {}
      detectionid: {}
      detectionupdatetime: {}
      detectionurl: {}
      deviceexternalip: {}
      devicehash: {}
      deviceid: {}
      devicelocalip: {}
      devicemodel: {}
      devicename: {}
      devicetime: {}
      displayname: {}
      dnsname: {}
      dstports: {}
      duration: {}
      email: {}
      emailauthenticitycheck: {}
      emailbcc: {}
      emailbody: {}
      emailbodyformat: {}
      emailbodyhtml: {}
      emailcc: {}
      emailclassification: {}
      emailclientname: {}
      emailfrom: {}
      emailheaders: {}
      emailhtml: {}
      emailhtmlimage: {}
      emailinreplyto: {}
      emailkeywords: {}
      emaillabels: {}
      emaillatestmessage: {}
      emailmessageid: {}
      emailreceived: {}
      emailreplyto: {}
      emailreturnpath: {}
      emailsenderip: {}
      emailsize: {}
      emailsource: {}
      emailsubject: {}
      emailto: {}
      emailtocount: {}
      emailurlclicked: {}
      employeedisplayname: {}
      employeeemail: {}
      employeemanageremail: {}
      errorcode: {}
      errormessage: {}
      escalation: {}
      eventaction: {}
      eventdescriptions: {}
      eventid: {}
      eventnames: {}
      events: {}
      eventtype: {}
      externaladdresses: {}
      failedincidentscreateddate: {}
      filehash: {}
      filename: {}
      filepath: {}
      filesize: {}
      firstname: {}
      firstseen: {}
      followup: {}
      givenname: {}
      helloworldid: {}
      helloworldstatus: {}
      helloworldtype: {}
      highlevelcategories: {}
      hostname: {}
      hosts: {}
      id: {}
      incomingmirrorerror: {}
      infectedhosts: {}
      integrationscategories: {}
      integrationsfailedcategories: {}
      integrationstestgrid: {}
      internaladdresses: {}
      investigationstage: {}
      isolated: {}
      jobcode: {}
      jobfamily: {}
      jobfunction: {}
      labels: {}
      lastmirroredintime: {}
      lastmodifiedby: {}
      lastmodifiedon: {}
      lastname: {}
      lastseen: {}
      lastupdatetime: {}
      leadership: {}
      listofrulesevent: {}
      location: {}
      locationregion: {}
      logsource: {}
      logsourcename: {}
      logsourcetype: {}
      lowlevelcategoriesevents: {}
      macaddress: {}
      maliciousbehavior: {}
      malwarefamily: {}
      malwarename: {}
      manageremailaddress: {}
      managername: {}
      md5: {}
      mobiledevicemodel: {}
      mobilephone: {}
      name: {}
      numberofentriesiderrors: {}
      numberoffailedincidents: {}
      numberoflogsources: {}
      occurred: {}
      os: {}
      osversion: {}
      outgoingmirrorerror: {}
      owner: {}
      parentprocessid: {}
      personalemail: {}
      phase: {}
      phishingsubtype: {}
      phonenumber: {}
      pid: {}
      playbooknameswithfailedtasks: {}
      playbooksfailedcommands: {}
      playbookswithfailedtasks: {}
      playbooktaskserrors: {}
      policydeleted: {}
      policydescription: {}
      policydetails: {}
      policyid: {}
      policyrecommendation: {}
      policyremediable: {}
      policyseverity: {}
      policytype: {}
      postnatdestinationip: {}
      postnatdestinationport: {}
      postnatsourceip: {}
      postnatsourceport: {}
      prenatdestinationport: {}
      prenatsourceip: {}
      prenatsourceport: {}
      protocol: {}
      protocolevent: {}
      protocols: {}
      quarantined: {}
      ransomwareapproximatenumberofencryptedendpoints: {}
      ransomwarecryptocurrencyaddress: {}
      ransomwarecryptocurrencyaddresstype: {}
      ransomwaredataencryptionstatus: {}
      ransomwareemail: {}
      ransomwareencryptedfileowner: {}
      ransomwarenote: {}
      ransomwareonionaddress: {}
      ransomwarerecoverytool: {}
      ransomwarestrain: {}
      rating: {}
      rawevent: {}
      region: {}
      regionid: {}
      replacePlaybook: {}
      reporteremailaddress: {}
      resourceid: {}
      resourcename: {}
      resourcetype: {}
      riskrating: {}
      riskscore: {}
      roles: {}
      samaccountname: {}
      severity: {}
      sha1: {}
      sha256: {}
      sha512: {}
      signature: {}
      similarincident: {}
      skuname: {}
      skutier: {}
      sla: {}
      slaField: {}
      sourcegeolocation: {}
      sourcehostname: {}
      sourceip: {}
      sourceips: {}
      sourceipv6: {}
      sourcemacaddress: {}
      sourcenetwork: {}
      sourceport: {}
      sourceusername: {}
      src: {}
      srchostname: {}
      srcntdomain: {}
      srcos: {}
      srcports: {}
      srcuser: {}
      starttime: {}
      state: {}
      streetaddress: {}
      subcategory: {}
      subtype: {}
      surname: {}
      systems: {}
      targetfirewallversion: {}
      technicalowner: {}
      technicalownercontact: {}
      technicaluser: {}
      tenantname: {}
      terminatedaction: {}
      threatactor: {}
      ticketcloseddate: {}
      ticketnumber: {}
      ticketopeneddate: {}
      title: {}
      totalfailedinstances: {}
      totalgoodinstances: {}
      totalinstances: {}
      trafficdirection: {}
      triggeredsecurityprofile: {}
      type: {}
      unassignedincidents: {}
      unhealthyendpoints: {}
      uniqueports: {}
      urlsslverification: {}
      user: {}
      useraccountcontrol: {}
      userid: {}
      username: {}
      usernames: {}
      users: {}
      vendorid: {}
      vendorproduct: {}
      vulnerabilitycategory: {}
      workphone: {}
      xdralertcount: {}
      xdralerts: {}
      xdrassigneduseremail: {}
      xdrassigneduserprettyname: {}
      xdrdescription: {}
      xdrdetectiontime: {}
      xdrdevicecontrolviolations: {}
      xdrdisconnectedendpoints: {}
      xdrfileartifacts: {}
      xdrhighseverityalertcount: {}
      xdrhostcount:
        complex:
          root: PaloAltoNetworksXDR.EndpointViolations
          accessor: hostname
          transformers:
          - operator: uniq
          - operator: count
      xdrincidentid: {}
      xdrlowseverityalertcount: {}
      xdrmanualseverity: {}
      xdrmediumseverityalertcount: {}
      xdrmodificationtime: {}
      xdrnetworkartifacts: {}
      xdrnotes: {}
      xdrresolvecomment: {}
      xdrstatus: {}
      xdrstatusv2: {}
      xdrurl: {}
      xdrusercount:
        complex:
          root: PaloAltoNetworksXDR.EndpointViolations
          accessor: username
          transformers:
          - operator: uniq
          - operator: count
      zipcode: {}
    separatecontext: false
    view: |-
      {
        "position": {
          "x": 450,
          "y": 870
        }
      }
    note: false
    timertriggers: []
    ignoreworker: false
    skipunavailable: false
    quietmode: 0
view: |-
  {
    "linkLabelsPosition": {
      "2_11_#default#": 0.19
    },
    "paper": {
      "dimensions": {
        "height": 1325,
        "width": 590,
        "x": 240,
        "y": 110
      }
    }
  }
inputs:
- key: TimeStamp
  value: {}
  required: false
  description: |-
    Timestamp in relative date format for query device control events
    from Cortex XDR.
    For example "1 day", "3 weeks".
  playbookInputQuery:
- key: Severity
  value:
    simple: "1"
  required: false
  description: "The severity of the created incident when the device control events\
    \ were found.\nValid values are; \n   0 - Unknown\n   0.5 - Informational\n  \
    \ 1 - Low\n   2 - Medium\n   3 - High\n   4 - Critical"
  playbookInputQuery:
- key: IncidentType
  value:
    simple: Cortex XDR Device Control Violations
  required: false
  description: The desired incident type for the created incident when the device
    control violations were found.
  playbookInputQuery:
- key: EndpointID
  value: {}
  required: false
  description: |-
    The Endpoint ID to search for device control violations.
  playbookInputQuery:
- key: Hostname
  value: {}
  required: false
  description: |-
    The hostname of the endpoint to query for device control violations.
  playbookInputQuery:
- key: IPAddress
  value: {}
  required: false
  description: |-
    The IP address of the endpoint to query for device control violations.
  playbookInputQuery:
outputs: []
tests:
- No tests (auto formatted)
fromversion: 5.5.0
marketplaces:
  - xsoar