XDRSyncScript Deprecated
Deprecated. No available replacement. Syncs a single incident between Demisto and XDR. This script always uses the xdr-get-incident-extra-data command and outputs to the context the entire incident JSON. When the incident is updated in XDR, the Demisto incident will be updated accordingly and the default playbook will rerun. When an incident is updated in Demisto, the script will execute the xdr-update-incident command and update the incident in XDR.
python · Cortex XDR by Palo Alto Networks
Details
| ID | XDRSyncScript |
|---|---|
| Language | python |
| From Version | 6.0.0 |
| Docker Image | demisto/python3:3.9.7.24076 |
| Tags | xdr |
args: - description: How often the script will sync incidents between Demisto and XDR (in minutes). name: interval required: true - defaultValue: xdrincidentid description: The ID of incident in XDR. name: incident_id required: true - description: When an incident is the latest incident in XDR it will be updated in Demisto and the playbook will rerun. name: playbook_to_run - defaultValue: xdrassigneduseremail description: The assigned_user_mail field name in Demisto. name: assigned_user_mail - defaultValue: xdrassigneduserprettyname description: The assigned_user_pretty_name field name in Demisto. name: assigned_user_pretty_name - defaultValue: xdrstatusv2 description: The status field name in Demisto. name: status - defaultValue: severity description: The severity field name in Demisto. name: severity - defaultValue: xdrresolvecomment description: 'The resolve_comment field name in Demisto. ' name: resolve_comment - defaultValue: xdralertcount description: The alert_count field name in Demisto. name: alert_count - defaultValue: xdrhostcount description: The host_count field name in Demisto. name: host_count - defaultValue: xdrdescription description: The description field name in Demisto. name: description - defaultValue: xdrurl description: The xdr_url field name in Demisto. name: xdr_url - defaultValue: xdrnotes description: The notes field name in Demisto. name: notes - defaultValue: xdrlowseverityalertcount description: The low_severity_alert_count field name in Demisto. name: low_severity_alert_count - defaultValue: xdrmediumseverityalertcount description: The med_severity_alert_count field name in Demisto. name: med_severity_alert_count - defaultValue: xdrhighseverityalertcount description: The high_severity_alert_count field name in Demisto. name: high_severity_alert_count - defaultValue: xdrusercount description: The user_count field name in Demisto. name: user_count - description: DEPRECATED name: xdr_incident_markdown_field deprecated: true - auto: PREDEFINED defaultValue: 'true' description: Whether this is the first time this script is running or is scheduled. Can be "true" or "false". The default value is "true". There is no need to change the value. name: first predefined: - 'true' - 'false' - description: The user should not modify this argument. This argument should be passed from the parent task to the next scheduled task. It should contain the incident's JSON from XDR. name: xdr_incident_from_previous_run - auto: PREDEFINED defaultValue: 'true' description: Whether to print messages to the War Room. Can be "true" or "false". The default value is "true". name: verbose predefined: - 'true' - 'false' - defaultValue: xdralerts description: The XDR alerts field; must be of type "grid". name: xdr_alerts - defaultValue: xdrfileartifacts description: 'The XDR file artifacts field; must be of type "grid". ' name: xdr_file_artifacts - defaultValue: xdrnetworkartifacts description: The XDR network artifacts field. name: xdr_network_artifacts - defaultValue: xdrmodificationtime description: The modification_time field name in Demisto. name: modification_time - defaultValue: xdrmanualseverity description: The manual_severity field name in Demisto. name: manual_severity comment: Deprecated. No available replacement. Syncs a single incident between Demisto and XDR. This script always uses the xdr-get-incident-extra-data command and outputs to the context the entire incident JSON. When the incident is updated in XDR, the Demisto incident will be updated accordingly and the default playbook will rerun. When an incident is updated in Demisto, the script will execute the xdr-update-incident command and update the incident in XDR. commonfields: id: XDRSyncScript version: -1 name: XDRSyncScript outputs: - contextPath: PaloAltoNetworksXDR.Incident.incident_id description: Unique ID assigned to each returned incident. type: String - contextPath: PaloAltoNetworksXDR.Incident.creation_time description: Date and time that the incident was created in XDR. type: Date - contextPath: PaloAltoNetworksXDR.Incident.modification_time description: Date and time that the incident was last modified. type: Date - contextPath: PaloAltoNetworksXDR.Incident.detection_time description: Date and time that the first alert occurred in the incident. type: Date - contextPath: PaloAltoNetworksXDR.Incident.status description: |- Current status of the incident: "new","under_investigation","resolved_threat_handled","resolved_true_positive", "resolved_security_testing","resolved_known_issue","resolved_duplicate","resolved_false_positive","resolved_other" type: String - contextPath: PaloAltoNetworksXDR.Incident.severity description: Calculated severity of the incident. Can be "low","medium",or "high". type: String - contextPath: PaloAltoNetworksXDR.Incident.description description: Dynamic calculated description of the incident. type: String - contextPath: PaloAltoNetworksXDR.Incident.assigned_user_mail description: Email address of the user assigned to the incident. type: String - contextPath: PaloAltoNetworksXDR.Incident.assigned_user_pretty_name description: Full name of the user assigned to the incident. type: String - contextPath: PaloAltoNetworksXDR.Incident.alert_count description: Total number of alerts in the incident. type: Number - contextPath: PaloAltoNetworksXDR.Incident.low_severity_alert_count description: Number of alerts with the severity LOW. type: Number - contextPath: PaloAltoNetworksXDR.Incident.med_severity_alert_count description: Number of alerts with the severity MEDIUM. type: Number - contextPath: PaloAltoNetworksXDR.Incident.high_severity_alert_count description: Number of alerts with the severity HIGH. type: Number - contextPath: PaloAltoNetworksXDR.Incident.user_count description: Number of users involved in the incident. type: Number - contextPath: PaloAltoNetworksXDR.Incident.host_count description: Number of hosts involved in the incident. type: Number - contextPath: PaloAltoNetworksXDR.Incident.notes description: Comments entered by the user regarding the incident. type: Unknown - contextPath: PaloAltoNetworksXDR.Incident.resolve_comment description: Comments entered by the user when the incident was resolved. type: String - contextPath: PaloAltoNetworksXDR.Incident.manual_severity description: Incident severity assigned by the user. This does not affect the calculated severity. type: String - contextPath: PaloAltoNetworksXDR.Incident.manual_description description: Incident description provided by the user. type: String - contextPath: PaloAltoNetworksXDR.Incident.xdr_url description: A link to the incident view in XDR. type: String - contextPath: PaloAltoNetworksXDR.Incident.starred description: Whether the incident was starred. type: Boolean - contextPath: PaloAltoNetworksXDR.Incident.alerts.alert_id description: Unique ID for each alert. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.detection_timestamp description: Date and time that the alert occurred. type: Date - contextPath: PaloAltoNetworksXDR.Incident.alerts.source description: Source of the alert. The product/vendor from which this alert came originated. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.severity description: Severity of the alert. Can be"low","medium", or "high". type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.name description: Calculated name of the alert. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.category description: Category of the alert, for example, Spyware Detected via Anti-Spyware profile. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.description description: Textual description of the alert. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.host_ip description: Host IP address involved in the alert. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.host_name description: Host name involved in the alert. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.user_name description: User name involved with the alert. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.event_type description: The event type. Can be "Process Execution","Network Event","File Event","Registry Event","Injection Event","Load Image Event", or "Windows Event Log". type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.action description: The action that triggered the alert. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_pretty description: The action that triggered the alert. Can be "Detected (Reported)", "Prevented (Blocked)", "Detected (Post Detected)", "Detected (Scanned)", "Detected (Download)", "Detected (Prompt Allow)", "Prevented (Prompt Block)", "Detected", "Prevented (Denied The Session)", "Prevented (Dropped The Session)", "Prevented (Dropped The Session And Sent a TCP Reset)", "Prevented (Blocked The URL)", "Prevented (Blocked The IP)", "Prevented (Dropped The Packet)", "Prevented (Dropped All Packets)", "Prevented (Terminated The Session And Sent a TCP Reset To Both Sides Of The Connection)", "Prevented (Terminated The Session And Sent a TCP Reset To The Client)", "Prevented (Terminated The Session And Sent a TCP Reset To The Server)", "Prevented (Continue)", "Prevented (Block-Override)", "Prevented (Override-Lockout)", "Prevented (Override)", "Prevented (Random-Drop)", "Prevented (Silently Dropped The Session With An ICMP Unreachable Message To The Host Or Application)", "Prevented (Block)", "Detected (Allowed The Session)", "Detected (Raised An Alert)", "Detected (Syncookie Sent)", "Detected (Forward)", "Detected (Wildfire Upload Success)", "Detected (Wildfire Upload Failure)", "Detected (Wildfire Upload Skip)", or "Detected (Sinkhole)". type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_name description: The image name. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_command_line description: The command line. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_status description: The signature status. Can be "Signed", "Invalid Signature", "Unsigned", "Revoked", "Signature Fail", "N/A", or "Weak Hash". type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_vendor description: Singature vendor name. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_image_name description: The image name. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_line description: The command line. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_status description: The signature status. Can be "Signed", "Invalid Signature", "Unsigned", "Revoked", "Signature Fail", "N/A", or "Weak Hash". type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_vendor description: Signature vendor. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_causality_id description: The causality ID. type: Unknown - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_name description: The image name. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_command_line description: The command line. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_sha256 description: The SHA256 hash of the image. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_signature_status description: The signature status. Can be "Signed", "Invalid Signature", "Unsigned", "Revoked", "Signature Fail", "N/A", or "Weak Hash". type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_signature_vendor description: Signature vendor name. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_path description: The file path. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_md5 description: The MD5 hash of the file. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_sha256 description: The SHA256 hash of the file. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_registry_data description: Registry data. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_registry_full_key description: Registry full key. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_local_ip description: Local IP address. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_local_port description: Local port. type: Number - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_remote_ip description: Remote IP address. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_remote_port description: Remote port. type: Number - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_external_hostname description: External hostname. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.fw_app_id description: Firewall app ID. type: Unknown - contextPath: PaloAltoNetworksXDR.Incident.alerts.is_whitelisted description: Whether the alert is whitelisted. type: String - contextPath: PaloAltoNetworksXDR.Incident.alerts.starred description: Whether the alert is starred. type: Boolean - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.type description: The network artifact type, for example, IP. type: String - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_port description: The remote port related to the artifact. type: number - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.alert_count description: Number of alerts related to the artifact. type: number - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_ip description: The remote IP address related to the artifact. type: String - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.is_manual description: Whether the artifact was created by the user (manually). type: boolean - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_domain description: The domain related to the artifact. type: String - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.type description: The artifact type, for example, IP. type: String - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_country description: The country related to the artifact. type: String - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_status description: Digital signature status of the file. Can be "SIGNATURE_UNAVAILABLE", "SIGNATURE_SIGNED", "SIGNATURE_INVALID", "SIGNATURE_UNSIGNED", or "SIGNATURE_WEAK_HASH". type: String - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_process description: Whether the file artifact is related to a process execution. type: boolean - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_name description: Name of the file. type: String - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_wildfire_verdict description: The file verdict calculated by Wildfire. Can be "BENIGN", "MALWARE", "GRAYWARE", "PHISING", or "UNKNOWN". type: String - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.alert_count description: Number of alerts related to the artifact. type: number - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_malicious description: Whether the artifact is malicious (according to the Wildfire verdict). type: boolean - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_manual description: Whether the artifact was created by the user (manually). type: boolean - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.type description: The artifact type. Can be "META", "GID", "CID", "HASH", "IP", "DOMAIN", "REGISTRY", or "HOSTNAME". type: String - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256 description: The SHA256 hash of the file. type: String - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_vendor_name description: File signature vendor name. type: String script: '-' tags: - xdr timeout: '0' type: python subtype: python3 dockerimage: demisto/python3:3.9.7.24076 fromversion: 6.0.0 deprecated: true tests: - No test - there are unit tests instead