category: Endpoint
provider: Palo Alto Networks
sectionorder:
- Connect
- Collect
commonfields:
  id: Cortex XDR - IR
  version: -1
configuration:
- display: Fetch incidents
  name: isFetch
  defaultvalue: 'true'
  type: 8
  section: Collect
  required: false
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: '1'
  type: 19
  section: Collect
  required: false
- display: Incident type
  name: incidentType
  type: 13
  section: Collect
  required: false
  defaultvalue: 'Cortex XDR - Lite'
- name: url
  type: 0
  display: 'Server URL (copy URL from XDR)'
  section: Connect
  required: true
- displaypassword: API Key ID
  name: apikey_id_creds
  type: 9
  hiddenusername: true
  display: ''
  section: Connect
  required: false
- display: ''
  name: apikey_creds
  type: 9
  section: Connect
  required: false
  displaypassword: API Key
  hiddenusername: true
- defaultvalue: 'false'
  display: Remove legacy incident fields
  name: dont_format_sublists
  type: 8
  section: Collect
  required: false
  additionalinfo: Not selected for backwards compatibility. Recommended to select. This will remove duplicated incident fields under file_artifacts, network_artifacts, and alerts (like client_id, clientid.)
- display: Incident Mirroring Direction
  name: mirror_direction
  required: false
  type: 15
  section: Collect
  defaultvalue: None
  options:
  - None
  - Incoming
  - Outgoing
  - Both
  hidden:
  - marketplacev2
  - platform
  additionalinfo: Not supported on Cortex platform.
- additionalinfo: When selected, closing the Cortex XDR incident is mirrored in Cortex XSOAR.
  defaultvalue: 'true'
  display: Close Mirrored XSOAR Incident
  name: close_xsoar_incident
  type: 8
  section: Collect
  advanced: true
  required: false
- additionalinfo: "When selected, closing the Cortex XSOAR incident is mirrored in Cortex XDR. Notice: If not selected, but 'Close all related alerts in XDR' is selected, the incident will automatically be closed in Cortex XDR."
  defaultvalue: 'true'
  display: Close Mirrored Cortex XDR Incident
  name: close_xdr_incident
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: '1'
  display: XDR mirroring delay in minutes
  name: xdr_delay
  type: 0
  section: Collect
  required: false
  advanced: true
  additionalinfo: "In the event of a delay in mirroring incoming changes from XDR, use the xdr_delay parameter to extend the look-back period. However, be aware that this may result in increased latency when updating incidents."
- display: Custom close-reason mapping (XSOAR -> XDR mirrored incident. Overwrites default close-reason mapping defined by Cortex XSOAR)
  section: Collect
  advanced: true
  additionalinfo: 'Define how to close the mirrored incidents from Cortex XSOAR into Cortex XDR with a custom close reason mapping. Enter a comma-separated list of close reasons (acceptable format {Cortex XSOAR close reason}={Cortex XDR close reason}) to override the default close reason mapping defined by Cortex XSOAR. Note that the mapping must be configured accordingly with the existing close reasons in Cortex XSOAR and Cortex XDR. Not following this format will result in closing the incident with a default close reason. Example: "Resolved=Other,Duplicate=Other". Refer to ../README.md for possible close-reasons - `XDR Incident Mirroring`.'
  name: custom_xsoar_to_xdr_close_reason_mapping
  defaultvalue: ''
  type: 0
  required: false
- display: Custom close-reason mapping (XDR -> XSOAR mirrored incident. Overwrites default close-reason mapping defined by Cortex XSOAR)
  section: Collect
  advanced: true
  additionalinfo: 'Define how to close the mirrored incidents from Cortex XDR into Cortex XSOAR with a custom close reason mapping. Enter a comma-separated list of close reasons (acceptable format {Cortex XDR close reason}={Cortex XSOAR close reason}) to override the default close reason mapping defined by Cortex XSOAR. Note that the mapping must be configured accordingly with the existing close reasons in Cortex XSOAR and Cortex XDR. Not following this format will result in closing the incident with a default close reason. Example: “Known Issue=Resolved, Duplicate Incident=Other". Refer to ../README.md for possible close-reasons - `XDR Incident Mirroring`.'
  name: custom_xdr_to_xsoar_close_reason_mapping
  defaultvalue: ''
  type: 0
  required: false
- display: API Key ID
  name: apikey_id
  type: 4
  hidden: true
  section: Connect
  required: false
- display: API Key
  name: apikey
  type: 4
  section: Connect
  required: false
  hidden: true
- additionalinfo: The timeout of the HTTP requests sent to Cortex XDR API (in seconds).
  defaultvalue: '120'
  display: HTTP Timeout
  name: timeout
  type: 0
  section: Connect
  required: false
  advanced: true
- display: Maximum number of incidents per fetch
  name: max_fetch
  type: 0
  section: Collect
  required: false
  additionalinfo: The maximum number of incidents per fetch. Cannot exceed 100.
  defaultvalue: '10'
- display: Only fetch starred incidents
  name: starred
  type: 8
  section: Collect
  advanced: true
  required: false
- defaultvalue: 3 days
  display: Starred incidents fetch window
  name: starred_incidents_fetch_window
  type: 0
  section: Collect
  required: false
  additionalinfo: Starred fetch window timestamp (<number> <time unit>, e.g., 12 hours, 7 days). Fetches only starred incidents within the specified time range.
  advanced: true
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  type: 0
  section: Collect
  required: false
  defaultvalue: 3 days
- display: Sync Incident Owners
  name: sync_owners
  type: 8
  section: Collect
  advanced: true
  required: false
  additionalinfo: For Cortex XSOAR version 6.0.0 and above. If selected, for every incident fetched from Cortex XDR to Cortex XSOAR, the incident owners will be synced. Note that once this value is changed and synchronized between the systems, additional changes will not be reflected. For example, if you change the owner in Cortex XSOAR, the new owner will also be changed in Cortex XDR. However, if you now change the owner back in Cortex XDR, this additional change will not be reflected in Cortex XSOAR. In addition, for this change to be reflected, the owners must exist in both Cortex XSOAR and Cortex XDR.
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  section: Connect
  advanced: true
  required: false
- display: Use system proxy settings
  name: proxy
  type: 8
  section: Connect
  advanced: true
  required: false
- additionalinfo: 'Whether the XDR tenant mode is prevent only'
  display: Prevent Only Mode
  name: prevent_only
  type: 8
  section: Connect
  advanced: true
  required: false
- additionalinfo: 'The statuses of the incidents that will be fetched. If no status is provided then incidents of all the statuses will be fetched. Note: An incident whose status was changed to a filtered status after its creation time will not be fetched.'
  display: Incident Statuses to Fetch
  name: status
  options:
  - new
  - under_investigation
  - resolved_known_issue
  - resolved_false_positive
  - resolved_true_positive
  - resolved_security_testing
  - resolved_other
  - resolved_auto
  type: 16
  section: Collect
  advanced: true
  required: false
- additionalinfo: "Whether to fetch only the essential incident's fields - without Network Artifacts and File Artifacts to minimize the incident's information."
  display: Minimize Incident Information
  name: exclude_fields
  required: false
  type: 8
  section: Collect
  defaultvalue: 'true'
  advanced: true
- additionalinfo: "Whether to fetch only the essential alert fields in order to minimize the incident's information. Possible values: null_values to remove all null values from alerts data, or any other field of an alert."
  display: Minimize Alert Information
  name: excluded_alert_fields
  required: false
  type: 16
  section: Collect
  advanced: true
  defaultvalue: 'null_values'
- display: Close all related alerts in XDR
  name: close_alerts_in_xdr
  required: false
  additionalinfo: "Close all related alerts in Cortex XDR once an incident has been closed in Cortex XSOAR."
  advanced: true
  type: 8
  section: Collect
description: Cortex XDR is the world's first detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks.
display: Palo Alto Networks Cortex XDR - Investigation and Response
name: Cortex XDR - IR
script:
  commands:
  - arguments:
    - description: A date in the format 2019-12-31T23:59:00 in UTC. Only incidents that were created on or before the specified date/time will be retrieved.
      name: lte_creation_time
    - description: A date in the format 2019-12-31T23:59:00 in UTC. Only incidents that were created on or after the specified date/time will be retrieved.
      name: gte_creation_time
    - description: Filters returned incidents that were modified on or before the specified date/time, in the format 2019-12-31T23:59:00.
      name: lte_modification_time
    - description: Filters returned incidents that were modified on or after the specified date/time, in the format 2019-12-31T23:59:00.
      name: gte_modification_time
    - description: An array or CSV string of incident IDs.
      isArray: true
      name: incident_id_list
    - description: Filters returned incidents that were created on or after the specified date/time range, for example, 1 month, 2 days, 1 hour, and so on.
      name: since_creation_time
    - description: Filters returned incidents that were modified on or after the specified date/time range, for example, 1 month, 2 days, 1 hour, and so on.
      name: since_modification_time
    - auto: PREDEFINED
      description: Sorts returned incidents by the date/time that the incident was last modified ("asc" - ascending, "desc" - descending).
      name: sort_by_modification_time
      predefined:
      - asc
      - desc
    - auto: PREDEFINED
      description: Sorts returned incidents by the date/time that the incident was created ("asc" - ascending, "desc" - descending).
      name: sort_by_creation_time
      predefined:
      - asc
      - desc
    - defaultValue: '0'
      description: Page number (for pagination). 0 is the first page.
      name: page
    - defaultValue: '100'
      description: Maximum number of incidents to return per page. The default and maximum is 100.
      name: limit
    - description: 'Filters only incidents in the specified status. The options are: new, under_investigation, resolved_known_issue, resolved_false_positive, resolved_true_positive resolved_security_testing, resolved_other, resolved_auto.'
      name: status
    - auto: PREDEFINED
      description: 'Whether the incident is starred.'
      name: starred
      predefined:
      - 'true'
      - 'false'
    - description: Deprecated. Use gte_creation_time instead.
      defaultValue: 3 days
      name: starred_incidents_fetch_window
      deprecated: true
    description: |-
      This command is deprecated please use xdr-case-list instead. Returns a list of incidents, which you can filter by a list of incident IDs (max. 100), the time the incident was last modified, and the time the incident was created.
      If you pass multiple filtering arguments, they will be concatenated using the AND condition. The OR condition is not supported.
    name: xdr-get-incidents
    deprecated: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.Incident.incident_id
      description: Unique ID assigned to each returned incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.manual_severity
      description: Incident severity assigned by the user. This does not affect the calculated severity. Can be "low", "medium", "high".
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.manual_description
      description: Incident description provided by the user.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.assigned_user_mail
      description: Email address of the assigned user.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.high_severity_alert_count
      description: Number of alerts with the severity HIGH.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.host_count
      description: Number of hosts involved in the incident.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.xdr_url
      description: A link to the incident view on Cortex XDR.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.assigned_user_pretty_name
      description: Full name of the user assigned to the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alert_count
      description: Total number of alerts in the incident.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.med_severity_alert_count
      description: Number of alerts with the severity MEDIUM.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.user_count
      description: Number of users involved in the incident.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.severity
      description: |
        Calculated severity of the incident. Valid values are: "low","medium","high".
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.low_severity_alert_count
      description: Number of alerts with the severity LOW.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.status
      description: |
        Current status of the incident. Valid values are: "new","under_investigation","resolved_known_issue","resolved_duplicate_incident","resolved_false_positive","resolved_true_positive","resolved_security_testing" or "resolved_other".
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.description
      description: Description of the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.resolve_comment
      description: Comments entered by the user when the incident was resolved.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.notes
      description: Comments entered by the user regarding the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.creation_time
      description: Date and time the incident was created on Cortex XDR.
      type: date
    - contextPath: PaloAltoNetworksXDR.Incident.detection_time
      description: Date and time that the first alert occurred in the incident.
      type: date
    - contextPath: PaloAltoNetworksXDR.Incident.modification_time
      description: Date and time that the incident was last modified.
      type: date
  - arguments:
    - description: The ID of the incident for which to get additional data.
      name: incident_id
      required: true
    - defaultValue: '1000'
      description: Maximum number of alerts to return.
      name: alerts_limit
    - defaultValue: 'False'
      description: Return data only if the incident was changed since the last time it was mirrored into Cortex XSOAR.  This flag should be used only from within a Cortex XDR incident.
      name: return_only_updated_incident
    - defaultValue: 'False'
      description: "Whether to exclude Network Artifacts and File Artifacts from incident data."
      name: excluding_artifacts
    description: This command is deprecated. Use "xdr-case-list extra_data=true" instead. Returns additional data for the specified incident, for example, related alerts, file artifacts, network artifacts, and so on.
    name: xdr-get-incident-extra-data
    deprecated: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.Incident.incident_id
      description: Unique ID assigned to each returned incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.creation_time
      description: Date and time the incident was created on Cortex XDR.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.modification_time
      description: Date and time that the incident was last modified.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.detection_time
      description: Date and time that the first alert occurred in the incident.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.status
      description: |-
        Current status of the incident. Valid values are:
        "new","under_investigation","resolved_known_issue","resolved_duplicate","resolved_false_positive","resolved_true_positive","resolved_security_testing","resolved_other".
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.severity
      description: 'Calculated severity of the incident. Valid values are: "low","medium","high".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.description
      description: Description of the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.assigned_user_mail
      description: Email address of the assigned user.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.assigned_user_pretty_name
      description: Full name of the user assigned to the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alert_count
      description: Total number of alerts in the incident.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.low_severity_alert_count
      description: Number of alerts with the severity LOW.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.med_severity_alert_count
      description: Number of alerts with the severity MEDIUM.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.high_severity_alert_count
      description: Number of alerts with the severity HIGH.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.user_count
      description: Number of users involved in the incident.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.host_count
      description: Number of hosts involved in the incident.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.notes
      description: Comments entered by the user regarding the incident.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.resolve_comment
      description: Comments entered by the user when the incident was resolved.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.manual_severity
      description: 'Incident severity assigned by the user. This does not affect the calculated severity. Can be "low", "medium", "high".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.manual_description
      description: Incident description provided by the user.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.xdr_url
      description: A link to the incident view on Cortex XDR.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.starred
      description: Whether the incident is starred.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_techniques_ids_and_names
      description: Incident MITRE techniques IDs and names.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_tactics_ids_and_names
      description: Incident MITRE tactics IDs and names.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.alert_id
      description: Unique ID for each alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.detection_timestamp
      description: Date and time the alert occurred.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.source
      description: The product/vendor from which this alert came.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.severity
      description: 'Severity of the alert. Valid values are: "low","medium","high".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.name
      description: Calculated name of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.category
      description: Category of the alert, for example, Spyware Detected via Anti-Spyware profile.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.description
      description: Description of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.host_ip_list
      description: Host IP address involved in the alert.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.host_name
      description: Hostname involved in the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.user_name
      description: User name involved with the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.event_type
      description: 'Event type. Valid values are: "Process Execution","Network Event","File Event","Registry Event","Injection Event","Load Image Event","Windows Event Log".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action
      description: 'The action that triggered the alert. Valid values are: "REPORTED", "BLOCKED", "POST_DETECTED", "SCANNED", "DOWNLOAD", "PROMPT_ALLOW", "PROMPT_BLOCK", "DETECTED", "BLOCKED_1", "BLOCKED_2", "BLOCKED_3", "BLOCKED_5", "BLOCKED_6", "BLOCKED_7", "BLOCKED_8", "BLOCKED_9", "BLOCKED_10", "BLOCKED_11", "BLOCKED_13", "BLOCKED_14", "BLOCKED_15", "BLOCKED_16", "BLOCKED_17", "BLOCKED_24", "BLOCKED_25", "DETECTED_0", "DETECTED_4", "DETECTED_18", "DETECTED_19", "DETECTED_20", "DETECTED_21", "DETECTED_22", "DETECTED_23".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_pretty
      description: 'The action that triggered the alert. Valid values are: "Detected (Reported)" "Prevented (Blocked)" "Detected (Post Detected)" "Detected (Scanned)" "Detected (Download)" "Detected (Prompt Allow)" "Prevented (Prompt Block)" "Detected" "Prevented (Denied The Session)" "Prevented (Dropped The Session)" "Prevented (Dropped The Session And Sent a TCP Reset)" "Prevented (Blocked The URL)" "Prevented (Blocked The IP)" "Prevented (Dropped The Packet)" "Prevented (Dropped All Packets)" "Prevented (Terminated The Session And Sent a TCP Reset To Both Sides Of The Connection)" "Prevented (Terminated The Session And Sent a TCP Reset To The Client)" "Prevented (Terminated The Session And Sent a TCP Reset To The Server)" "Prevented (Continue)" "Prevented (Block-Override)" "Prevented (Override-Lockout)" "Prevented (Override)" "Prevented (Random-Drop)" "Prevented (Silently Dropped The Session With An ICMP Unreachable Message To The Host Or Application)" "Prevented (Block)" "Detected (Allowed The Session)" "Detected (Raised An Alert)" "Detected (Syncookie Sent)" "Detected (Forward)" "Detected (Wildfire Upload Success)" "Detected (Wildfire Upload Failure)" "Detected (Wildfire Upload Skip)" "Detected (Sinkhole)".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_name
      description: Image name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_command_line
      description: Command line.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_status
      description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_vendor
      description: Signature vendor name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_image_name
      description: Image name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_line
      description: Command line.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_status
      description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_vendor
      description: Signature vendor.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_causality_id
      description: Causality ID.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_name
      description: Image name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_command_line
      description: Command line.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_sha256
      description: Image SHA256 hash.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_signature_status
      description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_signature_vendor
      description: Signature vendor name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_path
      description: File path.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_md5
      description: MD5 hash of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_sha256
      description: SHA256 hash of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_registry_data
      description: Registry data.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_registry_full_key
      description: Registry full key.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_local_ip
      description: Local IP address.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_local_port
      description: Local port.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_remote_ip
      description: Remote IP address.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_remote_port
      description: Remote port.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_external_hostname
      description: External hostname.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.fw_app_id
      description: Firewall app ID.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.is_whitelisted
      description: 'Whether the alert is on the allow list. Valid values are: "Yes" "No".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.starred
      description: Whether the alert is starred.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.type
      description: Network artifact type.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_port
      description: The remote port related to the artifact.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.alert_count
      description: Number of alerts related to the artifact.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_ip
      description: The remote IP address related to the artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.is_manual
      description: Whether the artifact was created by the user (manually).
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_domain
      description: The domain related to the artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.type
      description: 'The artifact type. Valid values are: "META", "GID", "CID", "HASH", "IP", "DOMAIN", "REGISTRY", "HOSTNAME".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_country
      description: The country related to the artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_status
      description: 'Digital signature status of the file. Valid values are: "SIGNATURE_UNAVAILABLE" "SIGNATURE_SIGNED" "SIGNATURE_INVALID" "SIGNATURE_UNSIGNED" "SIGNATURE_WEAK_HASH".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_process
      description: Whether the file artifact is related to a process execution.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_name
      description: Name of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_wildfire_verdict
      description: 'The file verdict, calculated by Wildfire. Valid values are: "BENIGN" "MALWARE" "GRAYWARE" "PHISHING" "UNKNOWN".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.alert_count
      description: Number of alerts related to the artifact.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_malicious
      description: Whether the artifact is malicious, as decided by the Wildfire verdict.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_manual
      description: Whether the artifact was created by the user (manually).
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.type
      description: 'The artifact type. Valid values are: "META" "GID" "CID" "HASH" "IP" "DOMAIN" "REGISTRY" "HOSTNAME".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256
      description: SHA256 hash of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_vendor_name
      description: File signature vendor name.
      type: String
    - contextPath: Account.Username
      description: The username in the relevant system.
      type: String
    - contextPath: Endpoint.Hostname
      description: The hostname that is mapped to this endpoint.
      type: String
    - contextPath: Endpoint.ID
      description: The agent ID of the endpoint.
      type: String
    - contextPath: File.Path
      description: The path where the file is located.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Name
      description: The full file name (including the file extension).
      type: String
    - contextPath: Process.Name
      description: The name of the process.
      type: String
    - contextPath: Process.MD5
      description: The MD5 hash of the process.
      type: String
    - contextPath: Process.SHA256
      description: The SHA256 hash of the process.
      type: String
    - contextPath: Process.PID
      description: The PID of the process.
      type: String
    - contextPath: Process.Path
      description: The file system path to the binary file.
      type: String
    - contextPath: Process.Start Time
      description: The timestamp of the process start time.
      type: String
    - contextPath: Process.CommandLine
      description: The full command line (including arguments).
      type: String
    - contextPath: Process.is_malicious
      description: Whether the artifact is malicious, as decided by the Wildfire verdict.
      type: boolean
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.Geo.Country
      description: 'The country in which the IP address is located.'
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
  - arguments:
    - description: XDR incident ID. You can get the incident ID from the output of the 'xdr-get-incidents' command or the 'xdr-get-incident-extra-details' command.
      name: incident_id
      required: true
    - auto: PREDEFINED
      description: Severity to assign to the incident.
      name: manual_severity
      predefined:
      - HIGH
      - MEDIUM
      - LOW
    - description: Email address of the user to assign to the incident.
      name: assigned_user_mail
    - auto: PREDEFINED
      description: 'Status of the incident.'
      name: status
      predefined:
      - NEW
      - UNDER_INVESTIGATION
      - RESOLVED_KNOWN_ISSUE
      - RESOLVED_DUPLICATE
      - RESOLVED_FALSE_POSITIVE
      - RESOLVED_TRUE_POSITIVE
      - RESOLVED_SECURITY_TESTING
      - RESOLVED_OTHER
    - description: Comment explaining why the incident was resolved. This should be set when the incident is resolved.
      name: resolve_comment
    - auto: PREDEFINED
      description: If true, will remove all assigned users from the incident.
      name: unassign_user
      predefined:
      - 'true'
      - 'false'
    - description: Add a comment to the incident.
      name: add_comment
    - auto: PREDEFINED
      description: Whether to resolve alerts related to a resolved incident. The incident is considered resolved when the status argument includes the "RESOLVED" or "resolve_comment" value.
      name: resolve_alerts
      predefined:
      - 'true'
      - 'false'
      defaultValue: 'false'
    description: This command is deprecated please use xdr-case-update instead. Updates one or more fields of a specified incident. Missing fields will be ignored. To remove the assignment for an incident, pass a null value in the assignee email argument.
    name: xdr-update-incident
    deprecated: true
  - arguments:
    - description: Product name.
      name: product
      required: true
    - description: Vendor name.
      name: vendor
      required: true
    - description: Source IP address.
      name: local_ip
    - description: Source port.
      name: local_port
      required: true
    - description: |-
        Destination IP address.
      name: remote_ip
      required: true
    - description: |-
        Destination port.
      name: remote_port
      required: true
    - description: The time the alert occurred in milliseconds, or a date in the format 2019-10-23T10:00:00. If not set, the event time will be defined as now.
      name: event_timestamp
    - auto: PREDEFINED
      defaultValue: Medium
      description: |-
        The alert severity.
      name: severity
      predefined:
      - Informational
      - Low
      - Medium
      - High
    - description: The alert name.
      name: alert_name
      required: true
    - description: The alert description.
      name: alert_description
    description: |-
      This command is deprecated. Uploads an alert from external alert sources in Cortex XDR format. Cortex XDR displays alerts that are parsed
      successfully in related incidents and views. You can send 600 alerts per minute. Each request can contain a
      maximum of 60 alerts.
    name: xdr-insert-parsed-alert
    deprecated: true
  - arguments:
    - description: List of alerts in CEF format.
      isArray: true
      name: cef_alerts
      required: true
    description: This command is deprecated. Upload alerts in CEF format from external alert sources. After you map CEF alert fields to Cortex XDR fields, Cortex XDR displays the alerts in related incidents and views. You can send 600 requests per minute. Each request can contain a maximum of 60 alerts.
    name: xdr-insert-cef-alerts
    deprecated: true
  - arguments:
    - description: The incident ID. Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: The endpoint ID to isolate. You can retrieve the string from the xdr-get-endpoints command.
      name: endpoint_id
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to suppress an error when trying to isolate a disconnected endpoint. When set to false, an error will be returned.
      name: suppress_disconnected_endpoint_error
      predefined:
      - 'true'
      - 'false'
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Isolates the specified endpoint.
    execution: true
    name: xdr-endpoint-isolate
    outputs:
    - contextPath: PaloAltoNetworksXDR.Isolation.endpoint_id
      description: The endpoint ID.
      type: String
    polling: true
    compliantpolicies:
    - EndPoint Isolation
  - arguments:
    - description: The incident ID. Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: The endpoint ID to isolate. You can retrieve the string from the xdr-get-endpoints command.
      name: endpoint_id
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to suppress an error when trying to isolate a disconnected endpoint. When set to false, an error will be returned.
      name: suppress_disconnected_endpoint_error
      predefined:
      - 'true'
      - 'false'
    deprecated: true
    description: Deprecated. Use `xdr-endpoint-isolate` instead.
    execution: true
    name: xdr-isolate-endpoint
    outputs:
    - contextPath: PaloAltoNetworksXDR.Isolation.endpoint_id
      description: The endpoint ID.
      type: String
  - arguments:
    - description: The incident ID. Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: The endpoint ID for which to reverse the isolation. You can retrieve it from the xdr-get-endpoints command.
      name: endpoint_id
      required: true
    - description: |-
        Whether to suppress an error when trying to unisolate a disconnected endpoint. When set to false, an error will be returned.
      name: suppress_disconnected_endpoint_error
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    - description: |-
        Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: |-
        The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Reverses the isolation of an endpoint.
    execution: true
    name: xdr-endpoint-unisolate
    outputs:
    - contextPath: PaloAltoNetworksXDR.UnIsolation.endpoint_id
      description: Isolates the specified endpoint.
      type: String
    polling: true
  - deprecated: true
    description: Deprecated. Use `xdr-endpoint-unisolate` instead.
    execution: true
    name: xdr-unisolate-endpoint
    outputs:
    - contextPath: PaloAltoNetworksXDR.UnIsolation.endpoint_id
      description: Isolates the specified endpoint.
      type: String
    arguments:
    - description: The incident ID. Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: The endpoint ID for which to reverse the isolation. You can retrieve it from the xdr-get-endpoints command.
      name: endpoint_id
      required: true
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to suppress an error when trying to unisolate a disconnected endpoint. When set to false, an error will be returned.
      name: suppress_disconnected_endpoint_error
      predefined:
      - 'true'
      - 'false'
  - arguments:
    - description: 'A comma-separated list of endpoints statuses to filter. Valid values are: connected, disconnected, lost, uninstalled, windows, linux, macos, android, isolated, unisolated.'
      name: status
      isArray: true
    - description: A comma-separated list of endpoint IDs.
      isArray: true
      name: endpoint_id_list
    - description: |-
        A comma-separated list of distribution package names or installation package names.
        Example: dist_name1,dist_name2.
      isArray: true
      name: dist_name
    - description: |-
        A comma-separated list of private IP addresses.
        Example: 10.1.1.1,192.168.1.1.
      isArray: true
      name: ip_list
    - description: |-
        A comma-separated list of public IP addresses that correlate to the last IPv4 address from which the Cortex XDR agent connected (know as `Last Origin IP`).
        Example: 8.8.8.8,1.1.1.1.
      isArray: true
      name: public_ip_list
    - description: |-
        The group name to which the agent belongs.
        Example: group_name1,group_name2.
      isArray: true
      name: group_name
    - description: 'The endpoint platform.'
      isArray: true
      name: platform
      auto: PREDEFINED
      predefined:
      - windows
      - linux
      - macos
      - android
    - description: |-
        A comma-separated list of alias names.
        Examples: alias_name1,alias_name2.
      name: alias_name
      isArray: true
    - description: |-
        Specifies whether the endpoint was isolated or unisolated.
      name: isolate
      auto: PREDEFINED
      predefined:
      - isolated
      - unisolated
    - description: |-
        Hostname
        Example: hostname1,hostname2.
      name: hostname
      isArray: true
    - description: |-
        Include agents that were first seen on and after this date.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: first_seen_gte
    - description: |-
        Include agents that were first seen on and before this date.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: first_seen_lte
    - description: |-
        Include agents that were last seen on and after this date.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: last_seen_gte
    - description: |-
        All the agents that were last seen before {last_seen_lte}.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: last_seen_lte
    - defaultValue: '0'
      description: Page number (for pagination). 0 is the first page.
      name: page
    - description: Maximum number of endpoints to return per page. The default and maximum is 30.
      name: limit
      defaultValue: '30'
    - auto: PREDEFINED
      description: Specifies whether to sort endpoints by the first time or last time they were seen.
      name: sort_by
      predefined:
      - first_seen
      - last_seen
    - name: sort_order
      description: The order by which to sort results. Can be "asc" (ascending) or "desc" (descending).
      auto: PREDEFINED
      defaultValue: asc
      predefined:
      - asc
      - desc
    - name: username
      description: The usernames to query for. Accepts a single user, or comma-separated list of usernames.
      isArray: true
    - auto: PREDEFINED
      defaultValue: "false"
      description: Whether to return all endpoints. If true, will override the 'limit' and 'page' arguments.
      name: all_results
      predefined:
      - "false"
      - "true"
    - auto: PREDEFINED
      defaultValue: "false"
      description: Whether to return timestamp or date string values.
      name: convert_timestamp_to_datestring
      predefined:
      - "false"
      - "true"
    description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set. (Start by counting from 0).
    name: xdr-get-endpoints
    outputs:
    - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_id
      description: The endpoint ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_name
      description: The endpoint name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_type
      description: The endpoint type.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_status
      description: The status of the endpoint.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.os_type
      description: The endpoint operating type.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.ip
      description: A list of IP addresses.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Endpoint.users
      description: A list of users.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Endpoint.domain
      description: The endpoint domain.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.alias
      description: The endpoint aliases.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.first_seen
      description: First seen date/time in epoch (milliseconds).
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Endpoint.last_seen
      description: Last seen date/time in epoch (milliseconds).
      type: Date
    - contextPath: PaloAltoNetworksXDR.Endpoint.content_version
      description: Content version.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.installation_package
      description: Installation package.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.active_directory
      description: Active directory.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.install_date
      description: Install date in epoch (milliseconds).
      type: Date
    - contextPath: PaloAltoNetworksXDR.Endpoint.endpoint_version
      description: Endpoint version.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.is_isolated
      description: Whether the endpoint is isolated.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.group_name
      description: The name of the group to which the endpoint belongs.
      type: String
    - contextPath: PaloAltoNetworksXDR.Endpoint.count
      description: Number of endpoints returned.
      type: String
    - contextPath: Endpoint.Hostname
      description: The hostname that is mapped to this endpoint.
      type: String
    - contextPath: Endpoint.ID
      description: The unique ID within the tool retrieving the endpoint.
      type: String
    - contextPath: Endpoint.IPAddress
      description: The IP address of the endpoint.
      type: String
    - contextPath: Endpoint.Domain
      description: The domain of the endpoint.
      type: String
    - contextPath: Endpoint.OS
      description: The endpoint's operating system.
      type: String
    - contextPath: Account.Username
      description: The username in the relevant system.
      type: String
    - contextPath: Account.Domain
      description: The domain of the account.
      type: String
    - contextPath: Endpoint.Status
      description: The endpoint's status.
      type: String
    - contextPath: Endpoint.IsIsolated
      description: The endpoint's isolation status.
      type: String
    - contextPath: Endpoint.MACAddress
      description: The endpoint's MAC address.
      type: String
    - contextPath: Endpoint.Vendor
      description: The integration name of the endpoint vendor.
      type: String
  - arguments:
    - description: The status of the endpoint to use as a filter.
      name: status
      auto: PREDEFINED
      predefined:
      - connected
      - disconnected
    - description: A comma-separated list of endpoint IDs to use as a filter.
      isArray: true
      name: endpoint_id_list
    - description: |-
        A comma-separated list of distribution package names or installation package names to use as a filter.
        Example: dist_name1,dist_name2.
      isArray: true
      name: dist_name
    - description: |-
        A comma-separated list of IP addresses to use as a filter.
        Example: 8.8.8.8,1.1.1.1.
      isArray: true
      name: ip_list
    - description: A comma-separated list of group names to which the agent belongs to use as a filter.
      isArray: true
      name: group_name
    - description: The endpoint platform to use as a filter.
      isArray: true
      name: platform
      auto: PREDEFINED
      predefined:
      - windows
      - linux
      - macos
      - android
    - description: |-
        A comma-separated list of alias names to use as a filter.
        Examples: alias_name1,alias_name2.
      isArray: true
      name: alias_name
    - auto: PREDEFINED
      description: Specifies whether the endpoint was isolated or unisolated to use as a filter.
      name: isolate
      predefined:
      - isolated
      - unisolated
    - description: A comma-separated list of hostnames to use as a filter.
      isArray: true
      name: hostname
    - description: |-
        Include agents that were first seen on and after this date.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: first_seen_gte
    - description: |-
        Include agents that were first seen on and before this date.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: first_seen_lte
    - description: |-
        Include agents that were last seen on and after this date.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: last_seen_gte
    - description: |-
        Include agents that were last seen on and before this date.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: last_seen_lte
    - name: username
      description: The usernames to use as a filter. Accepts a single user, or comma-separated list of usernames.
      isArray: true
    - name: new_alias_name
      required: true
      description: |-
        The alias name to change to.
        Note: If you send an empty field, (e.g., new_alias_name=\"\") the current alias name is deleted.
    - name: scan_status
      description: The scan status of the endpoint to use as a filter.
      auto: PREDEFINED
      predefined:
      - none
      - pending
      - in_progress
      - canceled
      - aborted
      - pending_cancellation
      - success
      - error
    description: Gets a list of endpoints according to the passed filters, and changes their alias name. Filtering by multiple fields will be concatenated using the AND condition (OR is not supported).
    name: xdr-endpoint-alias-change
  - description: Gets a list of all the agent versions to use for creating a distribution list.
    name: xdr-get-distribution-versions
    outputs:
    - contextPath: PaloAltoNetworksXDR.DistributionVersions.windows
      description: A list of Windows agent versions.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.DistributionVersions.linux
      description: A list of Linux agent versions.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.DistributionVersions.macos
      description: A list of Mac agent versions.
      type: Unknown
    arguments: []
  - arguments:
    - description: The name of the installation package.
      name: name
      required: true
    - auto: PREDEFINED
      description: "The platform type."
      name: platform
      predefined:
      - windows
      - linux
      - macos
      - android
      required: true
    - auto: PREDEFINED
      description: |-
        The type of package to create.
        standalone - An installation for a new agent.
        upgrade - An upgrade of an agent from ESM.
      name: package_type
      predefined:
      - standalone
      - upgrade
      required: true
    - description: Agent version returned from xdr-get-distribution-versions. Not required for an Android platform.
      name: agent_version
      required: true
    - description: Information about the package.
      name: description
    description: Creates an installation package. This is an asynchronous call that returns the distribution ID. This does not mean that the creation succeeded. To confirm that the package has been created, check the status of the distribution by running the Get Distribution Status API.
    name: xdr-create-distribution
    outputs:
    - contextPath: PaloAltoNetworksXDR.Distribution.id
      description: The installation package ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.Distribution.name
      description: The name of the installation package.
      type: String
    - contextPath: PaloAltoNetworksXDR.Distribution.platform
      description: The installation operating system.
      type: String
    - contextPath: PaloAltoNetworksXDR.Distribution.agent_version
      description: Agent version.
      type: String
    - contextPath: PaloAltoNetworksXDR.Distribution.description
      description: Description of the package.
      type: String
  - arguments:
    - description: |-
        The ID of the installation package.
        Copy the distribution ID from the "id" field on the Endpoints > Agent Installation page.
      name: distribution_id
      required: true
    - auto: PREDEFINED
      description: |-
        The installation package type. Valid
        values are:
        • upgrade
        • sh - For Linux
        • rpm - For Linux
        • deb - For Linux
        • pkg - For Mac
        • x86 - For Windows
        • x64 - For Windows.
      name: package_type
      predefined:
      - upgrade
      - sh
      - rpm
      - deb
      - pkg
      - x86
      - x64
      required: true
    - name: download_package
      auto: PREDEFINED
      predefined:
      - "false"
      - "true"
      description: Supported only for package_type x64 or x86. Whether to actually download the installation package file.
      defaultValue: "false"
    description: Gets the distribution URL for downloading the installation package.
    name: xdr-get-distribution-url
    outputs:
    - contextPath: PaloAltoNetworksXDR.Distribution.id
      description: Distribution ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.Distribution.url
      description: URL for downloading the installation package.
      type: String
  - arguments:
    - description: A comma-separated list of distribution IDs to get the status for.
      isArray: true
      name: distribution_ids
      required: true
    description: Gets the status of the installation package.
    name: xdr-get-create-distribution-status
    outputs:
    - contextPath: PaloAltoNetworksXDR.Distribution.id
      description: Distribution ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.Distribution.status
      description: The status of the installation package.
      type: String
  - arguments:
    - description: "User's email address."
      name: email
    - description: The audit log type.
      name: type
      auto: PREDEFINED
      predefined:
      - LIVE_TERMINAL
      - RULES
      - AUTH
      - RESPONSE
      - INCIDENT_MANAGEMENT
      - ENDPOINT_MANAGEMENT
      - ALERT_WHITELIST
      - PUBLIC_API
      - DISTRIBUTIONS
      - STARRED_INCIDENTS
      - POLICY_PROFILES
      - DEVICE_CONTROL_PROFILE
      - HOST_FIREWALL_PROFILE
      - POLICY_RULES
      - PROTECTION_POLICY
      - DEVICE_CONTROL_TEMP_EXCEPTIONS
      - DEVICE_CONTROL_GLOBAL_EXCEPTIONS
      - GLOBAL_EXCEPTIONS
      - MSSP
      - REPORTING
      - DASHBOARD
      - BROKER_VM
    - description: The audit log subtype.
      name: sub_type
    - auto: PREDEFINED
      description: Result type.
      name: result
      predefined:
      - SUCCESS
      - FAIL
      - PARTIAL
    - description: |-
        Return logs for which the timestamp is after 'log_time_after'.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: timestamp_gte
    - description: |-
        Return logs for which the timestamp is before the 'log_time_after'.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: timestamp_lte
    - defaultValue: '0'
      description: Page number (for pagination). 0 is the first page.
      name: page
    - defaultValue: '30'
      description: Maximum number of audit logs to return per page. The default and maximum is 30.
      name: limit
    - auto: PREDEFINED
      description: Specifies the field by which to sort the results. By default the sort is defined as creation-time and DESC.
      name: sort_by
      predefined:
      - type
      - sub_type
      - result
      - timestamp
    - auto: PREDEFINED
      defaultValue: desc
      description: The sort order. Can be "asc" (ascending) or "desc" (descending).
      name: sort_order
      predefined:
      - asc
      - desc
    description: Gets management logs. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of management logs from the start of the result set (start by counting from 0).
    name: xdr-get-audit-management-logs
    outputs:
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ID
      description: Audit log ID.
      type: Number
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_OWNER_NAME
      description: Audit owner name.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_OWNER_EMAIL
      description: Audit owner email address.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ASSET_JSON
      description: Asset JSON.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ASSET_NAMES
      description: Audit asset names.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_HOSTNAME
      description: Hostname.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_RESULT
      description: Audit result.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_REASON
      description: Audit reason.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_DESCRIPTION
      description: Description of the audit.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ENTITY
      description: Audit entity (e.g., AUTH, DISTRIBUTIONS).
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_ENTITY_SUBTYPE
      description: Entity subtype (e.g., Login, Create).
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_CASE_ID
      description: Audit case ID.
      type: Number
    - contextPath: PaloAltoNetworksXDR.AuditManagementLogs.AUDIT_INSERT_TIME
      description: Log's insert time.
      type: Date
  - arguments:
    - description: A comma-separated list of endpoint IDs.
      isArray: true
      name: endpoint_ids
    - description: A comma-separated list of endpoint names.
      isArray: true
      name: endpoint_names
    - description: The report type.
      isArray: true
      name: type
      auto: PREDEFINED
      predefined:
      - Installation
      - Policy
      - Action
      - Agent Service
      - Agent Modules
      - Agent Status
    - auto: PREDEFINED
      description: The report subtype.
      isArray: true
      name: sub_type
      predefined:
      - Install
      - Uninstall
      - Upgrade
      - Local Configuration
      - Content Update
      - Policy Update
      - Process Exception
      - Hash Exception
      - Scan
      - File Retrieval
      - File Scan
      - Terminate Process
      - Isolate
      - Cancel Isolation
      - Payload Execution
      - Quarantine
      - Restore
      - Stop
      - Start
      - Module Initialization
      - Local Analysis Model
      - Local Analysis Feature Extraction
      - Fully Protected
      - OS Incompatible
      - Software Incompatible
      - Kernel Driver Initialization
      - Kernel Extension Initialization
      - Proxy Communication
      - Quota Exceeded
      - Minimal Content
      - Reboot Required
      - Missing Disc Access
    - auto: PREDEFINED
      description: The result type. Can be "Success" or "Fail". If not passed, returns all event reports.
      isArray: true
      name: result
      predefined:
      - Success
      - Fail
    - description: |-
        Return logs for which the timestamp is greater than 'log_time_after'.
        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: timestamp_gte
    - description: |-
        Return logs for which the timestamp is before the 'timestamp_lte'.

        Supported values:
        1579039377301 (time in milliseconds)
        "3 days" (relative date)
        "2019-10-21T23:45:00" (date).
      name: timestamp_lte
    - defaultValue: '0'
      description: Page number (for pagination). 0 is the first page.
      name: page
    - defaultValue: '30'
      description: The maximum number of reports to return. Default and maximum is 30.
      name: limit
    - auto: PREDEFINED
      description: The field by which to sort results.
      name: sort_by
      predefined:
      - type
      - category
      - trapsversion
      - timestamp
      - domain
    - auto: PREDEFINED
      defaultValue: asc
      description: The sort order. Can be "asc" (ascending) or "desc" (descending).
      name: sort_order
      predefined:
      - asc
      - desc
    description: Gets agent event reports. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of reports from the start of the result set (start by counting from 0).
    name: xdr-get-audit-agent-reports
    outputs:
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.ENDPOINTID
      description: Endpoint ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.ENDPOINTNAME
      description: Endpoint name.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.DOMAIN
      description: Agent domain.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.TRAPSVERSION
      description: Traps version.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.RECEIVEDTIME
      description: Received time in epoch time.
      type: Date
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.TIMESTAMP
      description: Timestamp in epoch time.
      type: Date
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.CATEGORY
      description: Report category (e.g., Audit).
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.TYPE
      description: Report type (e.g., Action, Policy).
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.SUBTYPE
      description: Report subtype (e.g., Fully Protected,Policy Update,Cancel Isolation).
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.RESULT
      description: Report result.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.REASON
      description: Report reason.
      type: String
    - contextPath: PaloAltoNetworksXDR.AuditAgentReports.DESCRIPTION
      description: Description of the agent report.
      type: String
    - contextPath: Endpoint.ID
      description: The unique ID within the tool retrieving the endpoint.
      type: String
    - contextPath: Endpoint.Hostname
      description: The hostname that is mapped to this endpoint.
      type: String
    - contextPath: Endpoint.Domain
      description: The domain of the endpoint.
      type: String
  - arguments:
    - description: Links the response action to the triggered incident.
      name: incident_id
    - description: String that represents a list of hashed files you want to add to the block list. Must be a valid SHA256 hash.
      isArray: true
      name: hash_list
      required: true
    - description: String that represents additional information regarding the action.
      name: comment
    - description: Whether to retrieve a regular response or detailed response. False = regular response. True = detailed response.
      name: detailed_response
      auto: PREDEFINED
      defaultValue: 'false'
      predefined:
      - 'true'
      - 'false'
    description: Block lists requested files which have not already been block listed or added to allow lists.
    name: xdr-blocklist-files
    outputs:
    - contextPath: PaloAltoNetworksXDR.blocklist.added_hashes
      description: Number of file hashes added to the block list.
      type: Number
    - contextPath: PaloAltoNetworksXDR.blocklist.excluded_hashes
      description: Number of file hashes excluded from the block list.
      type: Number
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: String that represents a list of hashed files you want to add to the block list. Must be a valid SHA256 hash.
      isArray: true
      name: hash_list
      required: true
    - description: String that represents additional information regarding the action.
      name: comment
    deprecated: true
    description: Deprecated. Use `xdr-blocklist-files` instead.
    name: xdr-blacklist-files
  - arguments:
    - description: Links the response action to the triggered incident.
      name: incident_id
    - description: String that represents a list of hashed files you want to add to allow lists. Must be a valid SHA256 hash.
      isArray: true
      name: hash_list
      required: true
    - description: String that represents additional information regarding the action.
      name: comment
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to retrieve a regular response or detailed response. False = regular response. True = detailed response.
      name: detailed_response
      predefined:
      - 'true'
      - 'false'
    description: Adds requested files to the allow list if they are not already on the block list or allow list.
    name: xdr-allowlist-files
    outputs:
    - contextPath: PaloAltoNetworksXDR.allowlist.added_hashes
      description: Number of added file hashes to allow list.
      type: Number
    - contextPath: PaloAltoNetworksXDR.allowlist.excluded_hashes
      description: Number of excluded file hashes from allow list.
      type: Number
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: String that represents a list of hashed files you want to add to the allow list. Must be a valid SHA256 hash.
      isArray: true
      name: hash_list
      required: true
    - description: String that represents additional information regarding the action.
      name: comment
    deprecated: true
    description: Deprecated. Use `xdr-allowlist-files` instead.
    name: xdr-whitelist-files
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: List of endpoint IDs.
      isArray: true
      name: endpoint_id_list
      required: true
    - description: String that represents the path of the file you want to quarantine.
      name: file_path
      required: true
    - description: String that represents the file's hash. Must be a valid SHA256 hash.
      name: file_hash
      required: true
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Quarantines a file on selected endpoints. You can select up to 1000 endpoints.
    name: xdr-file-quarantine
    polling: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
  - deprecated: true
    description: Deprecated. Use `xdr-file-quarantine` instead.
    name: xdr-quarantine-files
    arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: List of endpoint IDs.
      isArray: true
      name: endpoint_id_list
      required: true
    - description: String that represents the path of the file you want to quarantine.
      name: file_path
      required: true
    - description: String that represents the file's hash. Must be a valid SHA256 hash.
      name: file_hash
      required: true
  - arguments:
    - description: String that represents the endpoint ID.
      name: endpoint_id
      required: true
    - description: String that represents the file hash. Must be a valid SHA256 hash.
      name: file_hash
      required: true
    - description: String that represents the file path.
      name: file_path
      required: true
    description: Retrieves the quarantine status for a selected file.
    name: xdr-get-quarantine-status
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: The hash code of the file. Must be a valid SHA256 hash.
      name: file_hash
      required: true
    - description: String that represents the endpoint ID. If you do not enter a specific endpoint ID, the request will run restore on all endpoints that relate to the quarantined file you defined.
      name: endpoint_id
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Restores a quarantined file on requested endpoints.
    name: xdr-file-restore
    polling: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
  - arguments:
    - description: Allows to link the response action to the incident that triggered it.
      name: incident_id
    - description: The hash code of the file. Must be a valid SHA256 hash.
      name: file_hash
      required: true
    - description: The endpoint ID. If you do not enter a specific endpoint ID, the request will run restore on all endpoints that relate to the quarantined file you defined.
      name: endpoint_id
    deprecated: true
    description: Deprecated. Use `xdr-file-restore` instead.
    name: xdr-restore-file
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: List of endpoint IDs.
      isArray: true
      name: endpoint_id_list
    - description: Name of the distribution list.
      isArray: true
      name: dist_name
    - description: Greater than or equal to first seen timestamp in milliseconds.
      name: gte_first_seen
    - description: Greater than or equal to last seen timestamp in milliseconds.
      name: gte_last_seen
    - description: Less than or equal to first seen timestamp in milliseconds.
      name: lte_first_seen
    - description: Less than or equal to last seen timestamp in milliseconds.
      name: lte_last_seen
    - description: List of IP addresses.
      isArray: true
      name: ip_list
    - description: Name of the endpoint group.
      isArray: true
      name: group_name
    - auto: PREDEFINED
      description: Type of operating system.
      isArray: true
      name: platform
      predefined:
      - windows
      - linux
      - macos
      - android
    - description: Endpoint alias name.
      isArray: true
      name: alias
    - auto: PREDEFINED
      description: Whether an endpoint has been isolated.
      name: isolate
      predefined:
      - isolated
      - unisolated
    - description: Name of the host.
      isArray: true
      name: hostname
    - auto: PREDEFINED
      defaultValue: 'false'
      description: Whether to scan all of the endpoints. Scanning all of the endpoints may cause performance issues and latency.
      name: all
      predefined:
      - 'true'
      - 'false'
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    description: 'Runs a scan on a selected endpoint. To scan all endpoints, run this command with argument all=true. Note: Scanning all the endpoints may cause performance issues and latency.'
    execution: true
    name: xdr-endpoint-scan-execute
    outputs:
    - contextPath: PaloAltoNetworksXDR.endpointScan.actionId
      description: The action ID of the scan request.
      type: Number
    - contextPath: PaloAltoNetworksXDR.endpointScan.aborted
      description: Was the scan aborted?
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
    polling: true
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: List of endpoint IDs.
      isArray: true
      name: endpoint_id_list
    - description: Name of the distribution list.
      isArray: true
      name: dist_name
    - description: Greater than or equal to first seen timestamp in milliseconds.
      name: gte_first_seen
    - description: Greater than or equal to last seen timestamp in milliseconds.
      name: gte_last_seen
    - description: Less than or equal to first seen timestamp in milliseconds.
      name: lte_first_seen
    - description: Less than or equal to last seen timestamp in milliseconds.
      name: lte_last_seen
    - description: List of IP addresses.
      isArray: true
      name: ip_list
    - description: Name of the endpoint group.
      isArray: true
      name: group_name
    - auto: PREDEFINED
      description: Type of operating system.
      isArray: true
      name: platform
      predefined:
      - windows
      - linux
      - macos
      - android
    - description: Endpoint alias name.
      isArray: true
      name: alias
    - auto: PREDEFINED
      description: Whether an endpoint has been isolated.
      name: isolate
      predefined:
      - isolated
      - unisolated
    - description: Name of the host.
      isArray: true
      name: hostname
    - auto: PREDEFINED
      defaultValue: 'false'
      description: 'Whether to scan all of the endpoints. Note: Scanning all of the endpoints may cause performance issues and latency.'
      name: all
      predefined:
      - 'true'
      - 'false'
    deprecated: true
    description: Deprecated. Use `xdr-endpoint-scan-execute` instead.
    execution: true
    name: xdr-endpoint-scan
    outputs:
    - contextPath: PaloAltoNetworksXDR.endpointScan.actionId
      description: The action ID of the scan request.
      type: Number
    - contextPath: PaloAltoNetworksXDR.endpointScan.aborted
      description: Was the scan aborted?
      type: Boolean
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: List of endpoint IDs.
      isArray: true
      name: endpoint_id_list
    - description: Name of the distribution list.
      isArray: true
      name: dist_name
    - description: Greater than or equal to first seen timestamp in milliseconds.
      name: gte_first_seen
    - description: Greater than or equal to last seen timestamp in milliseconds.
      name: gte_last_seen
    - description: Less than or equal to first seen timestamp in milliseconds.
      name: lte_first_seen
    - description: Less than or equal to last seen timestamp in milliseconds.
      name: lte_last_seen
    - description: List of IP addresses.
      isArray: true
      name: ip_list
    - description: Name of the endpoint group.
      isArray: true
      name: group_name
    - description: Type of operating system.
      isArray: true
      name: platform
      auto: PREDEFINED
      predefined:
      - windows
      - linux
      - macos
      - android
    - description: Endpoint alias name.
      isArray: true
      name: alias
    - description: Whether an endpoint has been isolated.
      name: isolate
      auto: PREDEFINED
      predefined:
      - isolated
      - unisolated
    - description: Name of the host.
      isArray: true
      name: hostname
    - auto: PREDEFINED
      defaultValue: 'false'
      description: 'Whether to scan all of the endpoints. Note: Scanning all of the endpoints may cause performance issues and latency.'
      name: all
      predefined:
      - 'true'
      - 'false'
    description: Cancels the scan of selected endpoints. A scan can only be aborted if the selected endpoints are Pending or In Progress. To scan all endpoints, run the command with the argument all=true. Note that scanning all of the endpoints may cause performance issues and latency.
    execution: true
    name: xdr-endpoint-scan-abort
    outputs:
    - contextPath: PaloAltoNetworksXDR.endpointScan.actionId
      description: The action ID of the abort scan request.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.endpointScan.aborted
      description: Was the scan aborted?
      type: Boolean
  - description: "Gets mapping fields from remote incident. Note: This method will not update the current incident. It's here for debugging purposes."
    name: get-mapping-fields
    arguments: []
  - arguments:
    - description: The remote incident ID.
      name: id
      required: true
    - defaultValue: '0'
      description: UTC timestamp in seconds. The incident is only updated if it was modified after the last update time.
      name: lastUpdate
    description: "Gets remote data from a remote incident. Note: This method will not update the current incident. It's here for debugging purposes."
    name: get-remote-data
  - arguments:
    - description: "Date string representing the local date time in the ISO 8601 format (for example: 2019-10-23T10:00:00). The incident is only returned if it was modified after the last update time."
      name: lastUpdate
    description: 'Gets the list of incidents that were modified since the last update. Note: This method is here for debugging purposes. get-modified-remote-data is used as part of a Mirroring feature, which is available since version 6.1.'
    name: get-modified-remote-data
  - arguments:
    - description: The endpoint ID. Can be retrieved by running the xdr-get-endpoints command.
      name: endpoint_id
      required: true
    description: Gets the policy name for a specific endpoint.
    name: xdr-get-policy
    outputs:
    - contextPath: PaloAltoNetworksXDR.Policy
      description: The policy allocated with the endpoint.
      type: string
    - contextPath: PaloAltoNetworksXDR.Policy.policy_name
      description: Name of the policy allocated with the endpoint.
      type: string
    - contextPath: PaloAltoNetworksXDR.Policy.endpoint_id
      description: Endpoint ID.
      type: string
  - arguments:
    - description: A comma-separated list of the script names.
      isArray: true
      name: script_name
    - description: A comma-separated list of the script descriptions.
      isArray: true
      name: description
    - description: A comma-separated list of the users who created the script.
      isArray: true
      name: created_by
    - description: The maximum number of scripts returned to the War Room.
      name: limit
    - description: (Int) Offset in the data set.
      name: offset
    - auto: PREDEFINED
      description: Whether the script can be executed on a Windows operating system.
      name: windows_supported
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Whether the script can be executed on a Linux operating system.
      name: linux_supported
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Whether the script can be executed on a Mac operating system.
      name: macos_supported
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: Whether the script has a high-risk outcome.
      name: is_high_risk
      predefined:
      - 'true'
      - 'false'
    description: Gets a list of scripts available in the scripts library.
    name: xdr-get-scripts
    outputs:
    - contextPath: PaloAltoNetworksXDR.Scripts
      description: The scripts command results.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Scripts.script_id
      description: Script ID.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Scripts.name
      description: Name of the script.
      type: string
    - contextPath: PaloAltoNetworksXDR.Scripts.description
      description: Description of the script.
      type: string
    - contextPath: PaloAltoNetworksXDR.Scripts.modification_date
      description: Timestamp of when the script was last modified.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Scripts.created_by
      description: Name of the user who created the script.
      type: string
    - contextPath: PaloAltoNetworksXDR.Scripts.windows_supported
      description: Whether the script can be executed on a Windows operating system.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Scripts.linux_supported
      description: Whether the script can be executed on a Linux operating system.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Scripts.macos_supported
      description: Whether the script can be executed on Mac operating system.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Scripts.is_high_risk
      description: Whether the script has a high-risk outcome.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Scripts.script_uid
      description: Globally Unique Identifier of the script, used to identify the script when executing.
      type: string
  - arguments:
    - description: A comma-separated list of endpoint IDs. You can retrieve the endpoint IDs from the xdr-get-endpoints command.
      name: endpoint_ids
      required: true
    description: Deletes selected endpoints in the Cortex XDR app. You can delete up to 1000 endpoints.
    name: xdr-delete-endpoints
  - arguments:
    - description: A comma-separated list of endpoint IDs. You can retrieve the endpoint IDs from the xdr-get-endpoints command.
      isArray: true
      name: endpoint_ids
    - description: 'Type of violation.'
      name: type
      auto: PREDEFINED
      predefined:
      - cd-rom
      - disk drive
      - floppy disk
      - portable device
    - description: 'Timestamp of the violation. Violations that are greater than or equal to this timestamp will be returned. Values can be in either ISO date format, relative time, or epoch timestamp. For example:  "2019-10-21T23:45:00" (ISO date format), "3 days ago" (relative time) 1579039377301 (epoch time).'
      name: timestamp_gte
    - description: 'Timestamp of the violation. Violations that are less than or equal to this timestamp will be returned. Values can be in either ISO date format, relative time, or epoch timestamp. For example:  "2019-10-21T23:45:00" (ISO date format), "3 days ago" (relative time) 1579039377301 (epoch time).'
      name: timestamp_lte
    - description: A comma-separated list of IP addresses.
      isArray: true
      name: ip_list
    - description: Name of the vendor.
      isArray: true
      name: vendor
    - description: Vendor ID.
      isArray: true
      name: vendor_id
    - description: Name of the product.
      isArray: true
      name: product
    - description: Product ID.
      isArray: true
      name: product_id
    - description: Serial number.
      isArray: true
      name: serial
    - description: Hostname.
      isArray: true
      name: hostname
    - description: A comma-separated list of violation IDs.
      isArray: true
      name: violation_id_list
    - description: Username.
      isArray: true
      name: username
    description: Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.
    name: xdr-get-endpoint-device-control-violations
    outputs:
    - contextPath: PaloAltoNetworksXDR.EndpointViolations
      description: Endpoint violations command results.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations
      description: A list of violations.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.os_type
      description: Type of the operating system.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.hostname
      description: Hostname of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.username
      description: Username of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.ip
      description: IP address of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.timestamp
      description: Timestamp of the violation.
      type: number
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.violation_id
      description: Violation ID.
      type: number
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.type
      description: Type of violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.vendor_id
      description: Vendor ID of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.vendor
      description: Name of the vendor of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.product_id
      description: Product ID of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.product
      description: Name of the product of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.serial
      description: Serial number of the violation.
      type: string
    - contextPath: PaloAltoNetworksXDR.EndpointViolations.violations.endpoint_id
      description: Endpoint ID of the violation.
      type: string
  - arguments:
    - description: Allows to link the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs.
      isArray: true
      name: endpoint_ids
      required: true
    - description: A comma-separated list of file paths on the Windows platform.
      isArray: true
      name: windows_file_paths
    - description: A comma-separated list of file paths on the Linux platform.
      isArray: true
      name: linux_file_paths
    - description: A comma-separated list of file paths on the Mac platform.
      isArray: true
      name: mac_file_paths
    - description: A comma-separated list of file paths in any platform. Can be used instead of the mac/windows/linux file paths. The order of the files path list must be parallel to the endpoints list order, so the first file path in the list is related to the first endpoint and so on.
      isArray: true
      name: generic_file_path
    - description: 'The delimiter used to separate multiple file paths. Set to a different character (for example, ";") when a file path contains a comma.'
      name: paths_separator
      defaultValue: ','
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Retrieves files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. At least one endpoint ID and one file path are necessary in order to run the command. After running this command, you can use the xdr-action-status-get command with returned action_id, to check the action status.
    name: xdr-file-retrieve
    outputs:
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.action_id
      description: ID of the action to retrieve files from selected endpoints.
      type: string
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.endpoint_id
      description: Endpoint ID. Added only when the operation is successful.
      type: string
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.file_link
      description: Link to the file. Added only when the operation is successful.
      type: string
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.status
      description: The action status. Added only when the operation is unsuccessful.
      type: string
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
    polling: true
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs.
      isArray: true
      name: endpoint_ids
      required: true
    - description: A comma-separated list of file paths on the Windows platform.
      isArray: true
      name: windows_file_paths
    - description: A comma-separated list of file paths on the Linux platform.
      isArray: true
      name: linux_file_paths
    - description: A comma-separated list of file paths on the Mac platform.
      isArray: true
      name: mac_file_paths
    - description: A comma-separated list of file paths in any platform. Can be used instead of the mac/windows/linux file paths. The order of the files path list must be parallel to the endpoints list order, so the first file path in the list is related to the first endpoint and so on.
      isArray: true
      name: generic_file_path
    deprecated: true
    description: Deprecated. Use `xdr-file-retrieve` instead.
    name: xdr-retrieve-files
    outputs:
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.action_id
      description: ID of the action to retrieve files from selected endpoints.
      type: string
  - arguments:
    - description: Action IDs retrieved from the xdr-retrieve-files command.
      isArray: true
      name: action_id
      required: true
    description: View the file retrieved by the xdr-retrieve-files command according to the action ID. Before running this command, you can use the xdr-action-status-get command to check if this action completed successfully.
    name: xdr-retrieve-file-details
    outputs:
    - contextPath: File
      description: The file details command results.
      type: Unknown
    - contextPath: File.Name
      description: The full file name (including the file extension).
      type: String
    - contextPath: File.EntryID
      description: The ID for locating the file in the War Room.
      type: String
    - contextPath: File.Size
      description: The size of the file in bytes.
      type: Number
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Extension
      description: 'The file extension. For example: "xls".'
      type: String
    - contextPath: File.Type
      description: The file type, as determined by libmagic (same as displayed in file entries).
      type: String
  - arguments:
    - description: Unique identifier of the script, returned by the xdr-get-scripts command.
      name: script_uid
      required: true
    description: Gets the full definition of a specific script in the scripts library.
    name: xdr-get-script-metadata
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata
      description: The script metadata command results.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.script_id
      description: Script ID.
      type: number
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.name
      description: Script name.
      type: string
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.description
      description: Description of the script.
      type: string
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.modification_date
      description: Timestamp of when the script was last modified.
      type: unknown
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.created_by
      description: Name of the user who created the script.
      type: string
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.is_high_risk
      description: Whether the script has a high-risk outcome.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.windows_supported
      description: Whether the script can be executed on a Windows operating system.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.linux_supported
      description: Whether the script can be executed on a Linux operating system.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.macos_supported
      description: Whether the script can be executed on a Mac operating system.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.entry_point
      description: Name of the entry point selected for the script. An empty string indicates the script was defined as just run.
      type: string
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.script_input
      description: Name and type for the specified entry point.
      type: string
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.script_output_type
      description: Type of the output.
      type: string
    - contextPath: PaloAltoNetworksXDR.ScriptMetadata.script_output_dictionary_definitions
      description: If the script_output_type is a dictionary, an array with friendly name, name, and type for each output.
      type: Unknown
  - arguments:
    - description: Unique identifier of the script, returned by the xdr-get-scripts command.
      name: script_uid
      required: true
    description: Gets the code of a specific script in the script library.
    name: xdr-get-script-code
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptCode
      description: The script code command results.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.ScriptCode.code
      description: The code of a specific script in the script library.
      type: string
    - contextPath: PaloAltoNetworksXDR.ScriptCode.script_uid
      description: Unique identifier of the script.
      type: string
  - arguments:
    - description: The action IDs of the selected request. After performing an action, you will receive an action ID.
      isArray: true
      name: action_id
      required: true
    description: Retrieves the status of the requested actions according to the action ID.
    name: xdr-action-status-get
    outputs:
    - contextPath: PaloAltoNetworksXDR.GetActionStatus
      description: The action status command results.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.endpoint_id
      description: Endpoint ID.
      type: string
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.status
      description: The status of the specific endpoint ID.
      type: string
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.action_id
      description: The specified action ID.
      type: number
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      name: endpoint_ids
      required: true
    - description: Unique identifier of the script. Can be retrieved by running the xdr-get-scripts command.
      name: script_uid
      required: true
    - description: Dictionary containing the parameter name as key and its value for this execution as the value. For example, {"param1":"param1_value","param2":"param2_value"}.
      name: parameters
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    description: Deprecated. Run xdr-script-run instead.
    name: xdr-run-script
    deprecated: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      name: endpoint_ids
      required: true
    - description: Unique identifier of the script. Can be retrieved by running the xdr-get-scripts command.
      name: script_uid
      required: true
    - description: Dictionary containing the parameter name as key and its value for this execution as the value. For example, {"param1":"param1_value","param2":"param2_value"}.
      name: parameters
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    - description: Interval in seconds between each poll.
      defaultValue: '10'
      name: polling_interval_in_seconds
    - description: Polling timeout in seconds.
      name: polling_timeout_in_seconds
      defaultValue: '600'
    - description: The action ID for polling use.
      name: action_id
      deprecated: true
    - name: hide_polling_output
      deprecated: true
      description: Whether to hide the polling result (automatically filled by polling).
    description: Initiates a new endpoint script execution action using a script from the script library and returns the results.
    name: xdr-script-run
    polling: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptResult.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.retrieved_files
      description: Number of successfully retrieved files.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_ip_address
      description: Endpoint IP address.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_name
      description: Name of successfully retrieved files.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.failed_files
      description: Number of files failed to be retrieved.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_status
      description: Endpoint status.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.domain
      description: Domain to which the endpoint belongs.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_id
      description: Endpoint ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.execution_status
      description: Execution status of this endpoint.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.return_value
      description: Value returned by the script in case the type is not a dictionary.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.standard_output
      description: The STDOUT and the STDERR logged by the script during the execution.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.retention_date
      description: Timestamp in which the retrieved files will be deleted from the server.
      type: Date
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      name: endpoint_ids
      required: true
    - description: Section of a script to initiate on an endpoint (e.g., print("7")).
      name: snippet_code
      required: true
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: Action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Initiates a new endpoint script execution action using the provided snippet code.
    name: xdr-snippet-code-script-execute
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
    polling: true
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: |-
        A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      name: endpoint_ids
      required: true
    - description: |-
        Section of a script you want to initiate on an endpoint (e.g., print("7")).
      name: snippet_code
      required: true
    deprecated: true
    description: Deprecated. Use `xdr-snippet-code-script-execute` instead.
    name: xdr-run-snippet-code-script
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
  - arguments:
    - description: Action IDs retrieved from the xdr-run-script command.
      isArray: true
      name: action_id
      required: true
    description: Retrieves the status of a script execution action.
    name: xdr-get-script-execution-status
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.general_status
      description: General status of the action, considering the status of all the endpoints.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.error_message
      description: Error message regarding permissions for running APIs or the action doesn't exist.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_timeout
      description: Number of endpoints in the "timeout" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_pending_abort
      description: Number of endpoints in the "pending abort" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_pending
      description: Number of endpoints in the "pending" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_in_progress
      description: Number of endpoints in the "in progress" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_failed
      description: Number of endpoints in the "failed" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_expired
      description: Number of endpoints in the "expired" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_completed_successfully
      description: Number of endpoints in the "completed successfully" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_canceled
      description: Number of endpoints in the "canceled" status.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptStatus.endpoints_aborted
      description: Number of endpoints in the "aborted" status.
      type: Number
  - arguments:
    - description: Action IDs retrieved from the xdr-run-script command.
      isArray: true
      name: action_id
      required: true
    description: Retrieve the results of a script execution action.
    name: xdr-get-script-execution-results
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptResult.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.retrieved_files
      description: Number of successfully retrieved files.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_ip_address
      description: Endpoint IP address.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_name
      description: Name of successfully retrieved files.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.failed_files
      description: Number of files failed to be retrieved.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_status
      description: Endpoint status.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.domain
      description: Domain to which the endpoint belongs.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.endpoint_id
      description: Endpoint ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.execution_status
      description: Execution status of this endpoint.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.return_value
      description: Value returned by the script in case the type is not a dictionary.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.standard_output
      description: The STDOUT and the STDERR logged by the script during the execution.
      type: String
    - contextPath: PaloAltoNetworksXDR.ScriptResult.results.retention_date
      description: Timestamp in which the retrieved files will be deleted from the server.
      type: Date
  - arguments:
    - description: Action IDs retrieved from the xdr-run-script command.
      isArray: true
      name: action_id
      required: true
    - description: Endpoint ID. Can be retrieved by running the xdr-get-endpoints command.
      isArray: true
      name: endpoint_id
      required: true
    description: Gets the files retrieved from a specific endpoint during a script execution.
    name: xdr-get-script-execution-result-files
    outputs:
    - contextPath: File.Size
      description: The size of the file.
      type: String
    - contextPath: File.SHA1
      description: The SHA1 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.SHA512
      description: The SHA512 hash of the file.
      type: String
    - contextPath: File.Name
      description: The name of the file.
      type: String
    - contextPath: File.SSDeep
      description: The SSDeep hash of the file.
      type: String
    - contextPath: File.EntryID
      description: EntryID of the file.
      type: String
    - contextPath: File.Info
      description: Information about the file.
      type: String
    - contextPath: File.Type
      description: The file type.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.Extension
      description: The extension of the file.
      type: String
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      name: endpoint_ids
      required: true
    - description: A comma-separated list of shell commands to execute. Set the `is_raw_command` argument to `true` to prevent splitting by commas. (Useful when using `||`, `&&`, `;` separators for controlling the flow of multiple commands).
      name: commands
      required: true
    - description: Whether to pass the command as-is. When false, the command is split by commas and sent as a list of commands, that are run independently.
      name: is_raw_command
      type: Boolean
      required: false
    - description: Type of shell command.
      auto: PREDEFINED
      name: command_type
      predefined:
      - 'powershell'
      - 'native'
      required: false
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Initiates a new endpoint script execution of shell commands.
    name: xdr-script-commands-execute
    polling: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      name: endpoint_ids
      required: true
    - description: A comma-separated list of shell commands to execute.
      name: commands
      required: true
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    deprecated: true
    description: Deprecated. Use `xdr-script-commands-execute` instead.
    name: xdr-run-script-execute-commands
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      isArray: true
      name: endpoint_ids
      required: true
    - description: A comma-separated list of paths of the files to delete. All of the given file paths will run on all of the endpoints.
      isArray: true
      name: file_path
      required: true
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Initiates a new endpoint script execution to delete the specified file.
    name: xdr-file-delete-script-execute
    polling: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      isArray: true
      name: endpoint_ids
      required: true
    - description: A comma-separated list of paths of the files to delete. All of the given file paths will run on all of the endpoints.
      isArray: true
      name: file_path
      required: true
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    deprecated: true
    description: Deprecated. Use `xdr-file-delete-script-execute` instead.
    name: xdr-run-script-delete-file
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      isArray: true
      name: endpoint_ids
      required: true
    - description: A comma-separated list of paths of the files to check for existence. All of the given file paths will run on all of the endpoints.
      isArray: true
      name: file_path
      required: true
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Initiates a new endpoint script execution to check if the file exists.
    name: xdr-file-exist-script-execute
    polling: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      isArray: true
      name: endpoint_ids
      required: true
    - description: A comma-separated list of paths of the files to check for existence. All of the given file paths will run on all of the endpoints.
      isArray: true
      name: file_path
      required: true
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    deprecated: true
    description: Deprecated. Use `xdr-file-exist-script-execute` instead.
    name: xdr-run-script-file-exists
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
  - arguments:
    - description: Allows to link the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      isArray: true
      name: endpoint_ids
      required: true
    - description: Names of processes to kill. Will kill all of the given processes on all of the endpoints.
      isArray: true
      name: process_name
      required: true
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    - description: Interval in seconds between each poll.
      name: interval_in_seconds
    - description: Polling timeout in seconds.
      name: timeout_in_seconds
    - description: The action IDs for polling use.
      isArray: true
      name: action_id
      deprecated: true
    description: Initiates a new endpoint script execution kill process.
    name: xdr-kill-process-script-execute
    polling: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.bucket
      description: The bucket in which the error occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_name
      description: The name of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_path
      description: The path of the file that caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.file_size
      description: The size of the file that caused the error.
      type: Number
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.missing_files
      description: The missing files that caused the error.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorData
      description: The error reason data.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminated_by
      description: The instance ID which terminated the action and caused the error.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.errorDescription
      description: The error reason description.
      type: String
    - contextPath: PaloAltoNetworksXDR.GetActionStatus.ErrorReasons.terminate_result
      description: The error reason terminate result.
      type: Unknown
  - arguments:
    - description: Allows linking the response action to the incident that triggered it.
      name: incident_id
    - description: A comma-separated list of endpoint IDs. Can be retrieved by running the xdr-get-endpoints command.
      isArray: true
      name: endpoint_ids
      required: true
    - description: Names of processes to kill. Will kill all of the given processes on all of the endpoints.
      isArray: true
      name: process_name
      required: true
    - defaultValue: '600'
      description: The timeout in seconds for this execution.
      name: timeout
    deprecated: true
    description: Deprecated. Use `xdr-kill-process-script-execute` instead.
    name: xdr-run-script-kill-process
    outputs:
    - contextPath: PaloAltoNetworksXDR.ScriptRun.action_id
      description: ID of the action initiated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.ScriptRun.endpoints_count
      description: Number of endpoints the action was initiated on.
      type: Number
  - arguments:
    - description: The endpoint ID.
      isArray: true
      name: id
    - default: true
      description: The endpoint IP address.
      isArray: true
      name: ip
    - description: The endpoint hostname.
      isArray: true
      name: hostname
    description: Returns information about an endpoint.
    name: endpoint
    outputs:
    - contextPath: Endpoint.Hostname
      description: The endpoint hostname.
      type: String
    - contextPath: Endpoint.OS
      description: The endpoint operation system.
      type: String
    - contextPath: Endpoint.IPAddress
      description: The endpoint IP address.
      type: String
    - contextPath: Endpoint.ID
      description: The endpoint ID.
      type: String
    - contextPath: Endpoint.Status
      description: The endpoint status.
      type: String
    - contextPath: Endpoint.IsIsolated
      description: The endpoint isolation status.
      type: String
    - contextPath: Endpoint.MACAddress
      description: The endpoint MAC address.
      type: String
    - contextPath: Endpoint.Vendor
      description: The integration name of the endpoint vendor.
      type: String
  - arguments:
    - description: 'A comma-separated list of endpoint statuses to filter. Valid values are: connected, disconnected, lost, uninstalled, windows, linux, macos, android, isolated, unisolated.'
      name: status
      required: true
      isArray: true
    - description: |-
        All the agents that were last seen after {last_seen_gte}. Supported
                values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00"
                (date).
      name: last_seen_gte
    - description: |-
        All the agents that were last seen before {last_seen_lte}. Supported
                values: 1579039377301 (time in milliseconds) "3 days" (relative date) "2019-10-21T23:45:00"
                (date).
      name: last_seen_lte
    description: Returns the number of the connected\disconnected endpoints.
    name: xdr-get-endpoints-by-status
    outputs:
    - contextPath: PaloAltoNetworksXDR.EndpointsStatus.status
      description: The endpoint status.
      type: String
    - contextPath: PaloAltoNetworksXDR.EndpointsStatus.count
      description: The number of endpoints with this status.
      type: Number
  - arguments:
    - description: A comma-separated list of alert IDs.
      isArray: true
      name: alert_ids
      required: true
    - description: Whether to return only a subset of the alert fields. Filtering the fields can reduce response size for large alerts.
      name: filter_alert_fields
      auto: PREDEFINED
      defaultValue: 'true'
      predefined:
      - 'true'
      - 'false'
    - description: Whether to return events_from_decider context output as a dictionary (the raw API response) or as a list (improved for playbook automation) - relevant only when filter_alert_fields is set to False.
      name: events_from_decider_format
      auto: PREDEFINED
      defaultValue: 'dict'
      predefined:
      - 'list'
      - 'dict'
    description: This command is deprecated. Returns information about each alert ID.
    name: xdr-get-cloud-original-alerts
    deprecated: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event._time
      description: The timestamp of the occurrence of the event.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.vendor
      description: Vendor name.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.event_timestamp
      description: Event timestamp.
      type: Number
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.event_type
      description: Event type (static 500).
      type: Number
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.cloud_provider
      description: The cloud provider - GCP, AZURE, or AWS.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.project
      description: The project in which the event occurred.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.cloud_provider_event_id
      description: The ID given to the event by the cloud provider, if the ID exists.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.cloud_correlation_id
      description: The ID the cloud provider is using to aggregate events that are part of the same general event.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.operation_name_orig
      description: The name of the operation that occurred, as supplied by the cloud provider.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.operation_name
      description: The normalized name of the operation performed by the event.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_orig
      description: Contains the original identity related fields as provided by the cloud provider.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_name
      description: The name of the identity that initiated the action.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_uuid
      description: Same as identity_name but also contains the UUID of the identity if it exists.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_type
      description: An enum representing the type of the identity.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_sub_type
      description: An enum representing the sub-type of the identity, respective to its identity_type.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_name
      description: The name of the identity that invoked the action as it appears in the log.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_uuid
      description: The UUID of the identity that invoked the action as it appears in the log.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_type
      description: An enum that represents the type of identity event that invoked the action.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.identity_invoked_by_sub_type
      description: An enum that represents the respective sub_type of the type of identity (identity_type) that has invoked the action.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.operation_status
      description: Status of whether the operation has succeed or failed, if provided.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.operation_status_orig
      description: The operation status code as it appears in the log, including the lookup from the code number to code name.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.operation_status_orig_code
      description: The operation status code as it appears in the log.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.operation_status_reason_provided
      description: Description of the error, if the log record indicates an error and the cloud provider supplied the reason.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.resource_type
      description: The normalized type of the service that emitted the log row.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.resource_type_orig
      description: The type of the service that emitted the log as provided by the cloud provider.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.resource_sub_type
      description: The sub-type respective to the resource_type field, normalized across all cloud providers.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.resource_sub_type_orig
      description: The sub-type of the service that emitted this log row as provided by the cloud provider.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.region
      description: The cloud region of the resource that emitted the log.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.zone
      description: The availability zone of the resource that emitted the log.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.referenced_resource
      description: The cloud resource referenced in the audit log.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.referenced_resource_name
      description: Same as referenced_resource but provides only the substring that represents the resource name instead of the full asset ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.referenced_resources_count
      description: The number of extracted resources referenced in this audit log.
      type: Number
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.user_agent
      description: The user agent provided in the call to the API of the cloud provider.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.caller_ip
      description: The IP of the caller that performed the action in the log.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.caller_ip_geolocation
      description: The geolocation associated with the caller_ip's value.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.caller_ip_asn
      description: The ASN of the caller_ip's value.
      type: Number
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.caller_project
      description: The project of the caller entity.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.raw_log
      description: The raw log that is being normalized.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.log_name
      description: The name of the log that contains the log row.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.caller_ip_asn_org
      description: The organization associated with the ASN of the caller_ip's value.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.event_base_id
      description: Event base ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.OriginalAlert.event.ingestion_time
      description: Ingestion time.
      type: String
  - arguments:
    - description: The unique ID of the alert.
      isArray: true
      name: alert_id
    - auto: PREDEFINED
      description: The severity of the alert.
      isArray: true
      name: severity
      predefined:
      - low
      - medium
      - high
    - description: "A custom filter. When using this argument, other filter arguments are not relevant. example: \n`{\n                \"OR\": [\n                    {\n                        \"SEARCH_FIELD\": \"actor_process_command_line\",\n                        \"SEARCH_TYPE\": \"EQ\",\n                        \"SEARCH_VALUE\": \"path_to_file\"\n                    }\n                ]\n            }`."
      name: custom_filter
    - auto: PREDEFINED
      description: Account type.
      isArray: true
      name: Identity_type
      predefined:
      - ANONYMOUS
      - APPLICATION
      - COMPUTE
      - FEDERATED_IDENTITY
      - SERVICE
      - SERVICE_ACCOUNT
      - TEMPORARY_CREDENTIALS
      - TOKEN
      - UNKNOWN
      - USER
    - description: A unique identifier per agent.
      isArray: true
      name: agent_id
    - description: The hostname to connect to. In case of a proxy connection, this value will differ from action_remote_ip.
      isArray: true
      name: action_external_hostname
    - description: A string identifying the user rule.
      isArray: true
      name: rule_id
    - description: The name of the user rule.
      isArray: true
      name: rule_name
    - description: The alert name.
      isArray: true
      name: alert_name
    - description: The alert source.
      isArray: true
      name: alert_source
    - auto: PREDEFINED
      description: Supports relative times or “custom” time option. If you choose the "custom" option, you should use start_time and end_time arguments.
      name: time_frame
      predefined:
      - 60 minutes
      - 3 hours
      - 12 hours
      - 24 hours
      - 2 days
      - 7 days
      - 14 days
      - 30 days
      - custom
    - description: The name assigned to the user_id during agent runtime.
      isArray: true
      name: user_name
    - description: The file name of the binary file.
      isArray: true
      name: actor_process_image_name
    - description: CGO CMD.
      isArray: true
      name: causality_actor_process_image_command_line
    - description: |-
        Trimmed to 128 unicode chars during event serialization.
        Full value reported as part of the original process event.
      isArray: true
      name: actor_process_image_command_line
    - description: The command line of the process created.
      isArray: true
      name: action_process_image_command_line
    - description: SHA256 hash of the binary file.
      isArray: true
      name: actor_process_image_sha256
    - description: SHA256 hash of the binary file.
      isArray: true
      name: causality_actor_process_image_sha256
    - description: SHA256 of the binary file.
      isArray: true
      name: action_process_image_sha256
    - description: SHA256 of the file related to the event.
      isArray: true
      name: action_file_image_sha256
    - description: The name of the registry.
      isArray: true
      name: action_registry_name
    - description: The key data of the registry.
      isArray: true
      name: action_registry_key_data
    - description: The host IP address.
      isArray: true
      name: host_ip
    - description: The local IP address for the connection.
      isArray: true
      name: action_local_ip
    - description: Remote IP address for the connection.
      isArray: true
      name: action_remote_ip
    - auto: PREDEFINED
      description: Alert action status.
      name: alert_action_status
      predefined:
      - detected
      - detected (allowed the session)
      - detected (download)
      - detected (forward)
      - detected (post detected)
      - detected (prompt allow)
      - detected (raised an alert)
      - detected (reported)
      - detected (on write)
      - detected (scanned)
      - detected (sinkhole)
      - detected (syncookie sent)
      - detected (wildfire upload failure)
      - detected (wildfire upload success)
      - detected (wildfire upload skip)
      - detected (xdr managed threat hunting)
      - prevented (block)
      - prevented (blocked)
      - prevented (block-override)
      - prevented (blocked the url)
      - prevented (blocked the ip)
      - prevented (continue)
      - prevented (denied the session)
      - prevented (dropped all packets)
      - prevented (dropped the session)
      - prevented (dropped the session and sent a tcp reset)
      - prevented (dropped the packet)
      - prevented (override)
      - prevented (override-lockout)
      - prevented (post detected)
      - prevented (prompt block)
      - prevented (random-drop)
      - prevented (silently dropped the session with an icmp unreachable message to the host or application)
      - prevented (terminated the session and sent a tcp reset to both sides of the connection)
      - prevented (terminated the session and sent a tcp reset to the client)
      - prevented (terminated the session and sent a tcp reset to the server)
      - prevented (on write)
    - description: The local IP address for the connection.
      isArray: true
      name: action_local_port
    - description: The remote port for the connection.
      isArray: true
      name: action_remote_port
    - description: The hostname connected to. In case of a proxy connection, this value will differ from action_remote_ip.
      isArray: true
      name: dst_action_external_hostname
    - defaultValue: source_insert_ts
      description: The field by which to sort the results.
      isArray: true
      name: sort_field
    - auto: PREDEFINED
      description: The order in which to sort the results.
      name: sort_order
      predefined:
      - DESC
      - ASC
    - defaultValue: '0'
      description: The first page from which we bring the alerts.
      isArray: true
      name: offset
    - defaultValue: '50'
      description: The last page from which we bring the alerts.
      isArray: true
      name: limit
    - description: Relevant when "time_frame" argument is "custom". Supports epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss.000Z).
      name: start_time
    - description: Relevant when "time_frame" argument is "custom". Supports epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss.000Z).
      name: end_time
    - auto: PREDEFINED
      description: Whether the alert is starred or not.
      name: starred
      predefined:
      - 'true'
      - 'false'
    - description: The MITRE attack technique.
      isArray: true
      name: mitre_technique_id_and_name
    description: "This command is deprecated, please use xdr-issue-list instead. Returns a list of alerts and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. \nMultiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value."
    name: xdr-get-alerts
    deprecated: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.Alert.internal_id
      description: The unique ID of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.source_insert_ts
      description: The detection timestamp.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Alert.alert_name
      description: The name of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.severity
      description: The severity of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_category
      description: The category of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_action_status
      description: |-
        The alert action. Possible values.

        DETECTED: detected
        DETECTED_0: detected (allowed the session)
        DOWNLOAD: detected (download)
        DETECTED_19: detected (forward)
        POST_DETECTED: detected (post detected)
        PROMPT_ALLOW: detected (prompt allow)
        DETECTED_4: detected (raised an alert)
        REPORTED: detected (reported)
        REPORTED_TRIGGER_4: detected (on write)
        SCANNED: detected (scanned)
        DETECTED_23: detected (sinkhole)
        DETECTED_18: detected (syncookie sent)
        DETECTED_21: detected (wildfire upload failure)
        DETECTED_20: detected (wildfire upload success)
        DETECTED_22: detected (wildfire upload skip)
        DETECTED_MTH: detected (xdr managed threat hunting)
        BLOCKED_25: prevented (block)
        BLOCKED: prevented (blocked)
        BLOCKED_14: prevented (block-override)
        BLOCKED_5: prevented (blocked the url)
        BLOCKED_6: prevented (blocked the ip)
        BLOCKED_13: prevented (continue)
        BLOCKED_1: prevented (denied the session)
        BLOCKED_8: prevented (dropped all packets)
        BLOCKED_2: prevented (dropped the session)
        BLOCKED_3: prevented (dropped the session and sent a tcp reset)
        BLOCKED_7: prevented (dropped the packet)
        BLOCKED_16: prevented (override)
        BLOCKED_15: prevented (override-lockout)
        BLOCKED_26: prevented (post detected)
        PROMPT_BLOCK: prevented (prompt block)
        BLOCKED_17: prevented (random-drop)
        BLOCKED_24: prevented (silently dropped the session with an icmp unreachable message to the host or application)
        BLOCKED_9: prevented (terminated the session and sent a tcp reset to both sides of the connection)
        BLOCKED_10: prevented (terminated the session and sent a tcp reset to the client)
        BLOCKED_11: prevented (terminated the session and sent a tcp reset to the server)
        BLOCKED_TRIGGER_4: prevented (on write).

      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_action_status_readable
      description: The alert action.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_name
      description: The alert name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_description
      description: The alert description.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.agent_ip_addresses
      description: The host IP address.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.agent_hostname
      description: The hostname.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.mitre_tactic_id_and_name
      description: The MITRE attack tactic.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.mitre_technique_id_and_name
      description: The MITRE attack technique.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.starred
      description: Whether the alert is starred or not.
      type: Boolean
  - arguments:
    - description: Links the response action to the incident that triggered it.
      name: incident_id
    - description: String that represents a list of hashed files to add to the allow list. Must be a valid SHA256 hash.
      isArray: true
      name: hash_list
      required: true
    - description: String that represents additional information regarding the action.
      name: comment
    description: Removes requested files from allow list.
    name: xdr-remove-allowlist-files
    outputs:
    - contextPath: PaloAltoNetworksXDR.allowlist.removed_hashes
      description: Removed file hash.
      type: Number
  - arguments:
    - description: Links the response action to the incident that triggered it.
      name: incident_id
    - description: String that represents a list of hashed files to add to the allow list. Must be a valid SHA256 hash.
      isArray: true
      name: hash_list
      required: true
    - description: String that represents additional information regarding the action.
      name: comment
    description: Removes requested files from the block list.
    name: xdr-remove-blocklist-files
    outputs:
    - contextPath: PaloAltoNetworksXDR.blocklist.removed_hashes
      description: Removed file hash from block list.
      type: Number
  - arguments:
    - description: The alert ID's from where to retrieve the contributing events.
      isArray: true
      name: alert_ids
      required: true
    - defaultValue: '50'
      description: The maximum number of contributing events to retrieve.
      name: limit
    - defaultValue: '1'
      description: The page number to retrieve. Minimum is 1.
      name: page_number
    - defaultValue: '50'
      description: The page size.
      name: page_size
    description: Retrieves contributing events for a specific correlation alert.
    name: xdr-get-contributing-event
    outputs:
    - contextPath: PaloAltoNetworksXDR.ContributingEvent.alertID
      description: The alert ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.ContributingEvent.events
      description: The contributing events.
      type: Unknown
  - arguments:
    - auto: PREDEFINED
      description: The field type to change.
      name: field_type
      predefined:
      - hosts
      - users
      - ip_addresses
      - ad_groups
      required: true
    - description: The string value, which defines the new field. Maximum length is 256 characters.
      isArray: true
      name: values
      required: true
    - description: The string value, which represents additional information regarding the featured alert field.
      name: comments
    - auto: PREDEFINED
      defaultValue: group
      description: |-
        The string value to replace an active directory group or organizational unit.
      name: ad_type
      predefined:
      - group
      - ou
    description: Replace the featured hosts\users\IP addresses\active directory groups listed in your environment.
    name: xdr-replace-featured-field
    outputs:
    - contextPath: PaloAltoNetworksXDR.FeaturedField.fieldType
      description: The field type that changed.
      type: String
    - contextPath: PaloAltoNetworksXDR.FeaturedField.fields
      description: String value that defines the new field.
      type: String
  - arguments:
    - description: A comma-separated list of endpoint IDs.
      isArray: true
      name: endpoint_ids
      required: true
    - description: Tag to add.
      name: tag
      required: true
    description: Adds a tag to specified endpoint_ids.
    name: xdr-endpoint-tag-add
  - arguments:
    - description: A comma-separated list of endpoint IDs.
      isArray: true
      required: true
      name: endpoint_ids
    - description: Tag to remove from specified endpoint_ids.
      name: tag
      required: true
    description: Removes a tag from specified endpoint_ids.
    name: xdr-endpoint-tag-remove
  - name: xdr-get-tenant-info
    outputs:
    - contextPath: PaloAltoNetworksXDR.TenantInformation.pro_per_endpoint_expiration
      description: Expiration time pro per endpoint.
      type: Date
    - contextPath: PaloAltoNetworksXDR.TenantInformation.purchased_pro_per_endpoint.agents
      description: Number of endpoint agents purchased.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.data_enabled_pro_per_endpoint
      description: Enabled data per pro endpoint.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.prevent_expiration
      description: Number of prevent expirations.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.purchased_prevent
      description: Number of purchased prevents.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.installed_prevent
      description: Number of installed prevents.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.pro_tb_expiration
      description: pro_tb license expiration time.
      type: Date
    - contextPath: PaloAltoNetworksXDR.TenantInformation.purchased_pro_tb.tb
      description: Number of pro_tbs purchased.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.installed_pro_tb
      description: Number of pro_tbs installed.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.compute_unit_expiration
      description: Compute unit expiration time.
      type: Date
    - contextPath: PaloAltoNetworksXDR.TenantInformation.purchased_compute_unit
      description: Number of compute units purchased.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.compute_unit_is_trial
      description: Whether the compute unit is a trial.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.TenantInformation.host_insights_expiration
      description: Host insight expiration date.
      type: Date
    - contextPath: PaloAltoNetworksXDR.TenantInformation.enabled_host_insights
      description: Number of host insights enabled.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.purchased_host_insights
      description: Number of purchased host insights.
      type: Number
    - contextPath: PaloAltoNetworksXDR.TenantInformation.forensics_expiration
      description: Forensic expiration date.
      type: Date
    - contextPath: PaloAltoNetworksXDR.TenantInformation.purchased_forensics
      description: Number of forensics purchased.
      type: Number
    arguments: []
    description: Provides information about the tenant.
  - name: xdr-list-users
    description: Retrieve a list of the current users in the environment.
    arguments: []
    outputs:
    - contextPath: PaloAltoNetworksXDR.User.user_email
      description: Email address of the user.
      type: string
    - contextPath: PaloAltoNetworksXDR.User.user_first_name
      description: First name of the user.
      type: string
    - contextPath: PaloAltoNetworksXDR.User.user_last_name
      description: Last name of the user.
      type: string
    - contextPath: PaloAltoNetworksXDR.User.role_name
      description: Role name associated with the user.
      type: string
    - contextPath: PaloAltoNetworksXDR.User.last_logged_in
      description: Timestamp of when the user last logged in.
      type: Number
    - contextPath: PaloAltoNetworksXDR.User.user_type
      description: Type of user.
      type: string
    - contextPath: PaloAltoNetworksXDR.User.groups
      description: Name of user groups associated with the user, if applicable.
      type: array
    - contextPath: PaloAltoNetworksXDR.User.scope
      description: Name of scope associated with the user, if applicable.
      type: array
  - arguments:
    - description: |
        Unique ID of a specific user.
        User ID could be either of the `foo/dummy` format, or just `dummy`.
      name: user_id
    - description: Limit the number of users that will appear in the list. (Use limit when no specific host is requested.)
      name: limit
      defaultValue: '10'
    name: xdr-list-risky-users
    description: Retrieve the risk score of a specific user or list of users with the highest risk score in the environment along with the reason affecting each score.
    outputs:
    - contextPath: PaloAltoNetworksXDR.RiskyUser.type
      description: Form of identification element.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyUser.id
      description: Identification value of the type field.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyUser.score
      description: The score assigned to the user.
      type: Number
    - contextPath: PaloAltoNetworksXDR.RiskyUser.reasons.date created
      description: Date when the incident was created.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyUser.reasons.description
      description: Description of the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyUser.reasons.severity
      description: The severity of the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyUser.reasons.status
      description: The incident status.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyUser.reasons.points
      description: The score.
      type: Number
  - arguments:
    - description: The host name of a specific host.
      name: host_id
    - description: Limit the number of hosts that will appear in the list. By default, the limit is 50 hosts.(Use limit when no specific host is requested.)
      name: limit
      defaultValue: '10'
    name: xdr-list-risky-hosts
    description: Retrieve the risk score of a specific host or list of hosts with the highest risk score in the environment along with the reason affecting each score.
    outputs:
    - contextPath: PaloAltoNetworksXDR.RiskyHost.type
      description: Form of identification element.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyHost.id
      description: Identification value of the type field.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyHost.score
      description: The score assigned to the host.
      type: Number
    - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.date created
      description: Date when the incident was created.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.description
      description: Description of the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.severity
      description: The severity of the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.status
      description: The incident status.
      type: String
    - contextPath: PaloAltoNetworksXDR.RiskyHost.reasons.points
      description: The score.
      type: Number
  - arguments:
    - description: A comma-separated list of one or more user group names for the associated users.
      name: group_names
      isArray: true
      required: true
    name: xdr-list-user-groups
    description: Retrieve a list of the current user emails associated with one or more user groups in the environment.
    outputs:
    - contextPath: PaloAltoNetworksXDR.UserGroup.group_name
      description: Name of the user group.
      type: String
    - contextPath: PaloAltoNetworksXDR.UserGroup.description
      description: Description of the user group, if available.
      type: String
    - contextPath: PaloAltoNetworksXDR.UserGroup.pretty_name
      description: Name of the user group as it appears in the management console.
      type: String
    - contextPath: PaloAltoNetworksXDR.UserGroup.insert_time
      description: Timestamp of when the user group was created.
      type: Number
    - contextPath: PaloAltoNetworksXDR.UserGroup.update_time
      description: Timestamp of when the user group was last updated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.UserGroup.user_email
      description: List of email addresses belonging to the users associated with the user group.
      type: array
    - contextPath: PaloAltoNetworksXDR.UserGroup.source
      description: Type of user group.
      type: String
  - arguments:
    - description: A comma-separated list of one or more role names in your environment for which to retrieve detailed information.
      name: role_names
      required: true
    name: xdr-list-roles
    description: Retrieve information about one or more roles created in the environment.
    outputs:
    - contextPath: PaloAltoNetworksXDR.Role.pretty_name
      description: Name of the role as it appears in the management console.
      type: String
    - contextPath: PaloAltoNetworksXDR.Role.permissions
      description: List of permissions associated with this role.
      type: array
    - contextPath: PaloAltoNetworksXDR.Role.insert_time
      description: Timestamp of when the role was created.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Role.update_time
      description: Timestamp of when the role was last updated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Role.created_by
      description: Email of the user who created the role.
      type: String
    - contextPath: PaloAltoNetworksXDR.Role.description
      description: Description of the role, if available.
      type: String
    - contextPath: PaloAltoNetworksXDR.Role.groups
      description: Group names associated with the role.
      type: array
    - contextPath: PaloAltoNetworksXDR.Role.users
      description: Email address of users associated with the role.
      type: array
  - arguments:
    - description: A comma-separated list of one or more user emails of users you want to add to a role.
      name: user_emails
      required: true
      isArray: true
    - description: Name of the role to add a user to.
      name: role_name
      required: true
    name: xdr-set-user-role
    description: Add one or more users to a role.
  - arguments:
    - description: A comma-separate list of one or more user emails of users to remove from a role.
      name: user_emails
      required: true
      isArray: true
    name: xdr-remove-user-role
    description: Remove one or more users from a role.
  - arguments:
    - description: A comma-separated list of alert IDs.
      name: alert_ids
      required: true
      isArray: true
    - auto: PREDEFINED
      description: Required severity to update alerts to.
      name: severity
      required: false
      predefined:
      - critical
      - high
      - medium
      - low
    - auto: PREDEFINED
      description: New status for updated alerts.
      name: status
      required: false
      predefined:
      - new
      - resolved_threat_handled
      - under_investigation
      - resolved_security_testing
      - resolved_auto
      - resolved_known_issue
      - resolved_duplicate
      - resolved_other
      - resolved_false_positive
      - resolved_true_positive
    - description: Comment to append to updated alerts.
      name: comment
      required: false
    description: |-
      This command is deprecated, please use xdr-issue-update instead. Update one or more alerts with the provided arguments.
      Required license: Cortex XDR Prevent, Cortex XDR Pro per Endpoint, or Cortex XDR Pro per GB.
    name: xdr-update-alert
    deprecated: true
  - arguments:
    - description: A comma-separated list of API key IDs to retrieve.
      isArray: true
      name: api_id
    - description: A comma-separated list of API key roles to retrieve.
      isArray: true
      name: role
    - description: 'Filters API keys that expire before this date. For example: "1 year". Filters API keys that have an expiration date.'
      name: expires_before
    - description: 'Filters API keys that expire after this date. For example: "1 year". Filters API keys that have an expiration date.'
      name: expires_after
    description: Gets a list of existing API keys.
    name: xdr-api-key-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.APIKeyData.id
      description: The API key ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.APIKeyData.roles
      description: The roles associated with the API key.
      type: String
    - contextPath: PaloAltoNetworksXDR.APIKeyData.expiration
      description: The expiration date of the API key.
      type: Date
  - arguments:
    - description: A comma-separated list of API key IDs to delete.
      isArray: true
      name: api_id
      required: true
    description: Deletes the specified API keys.
    name: xdr-api-key-delete
  - arguments:
    - description: 'A comma-separated list of asset IDs. For example: "1,2,3". When using this argument, the other filters will not be used.'
      isArray: true
      name: asset_id
    - description: 'The field used to sort the results. For example: xdm.asset.first_observed. For additional sortable fields, see the documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Get-all-or-filtered-assets.'
      name: sort_field
    - auto: PREDEFINED
      description: The order in which to sort the results.
      name: sort_order
      predefined:
      - asc
      - desc
    - description: 'The JSON to use for the "filter" field in the API. You can use xdr-asset-schema-get to retrieve the schema. For more details, see the documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Get-all-or-filtered-assets.'
      name: filter_json
    - description: Maximum number of assets to return. Default is 50.
      name: limit
      defaultValue: '50'
    - description: Page size for pagination.
      name: page_size
      defaultValue: '50'
    - defaultValue: '0'
      description: Page number for pagination.
      name: page
    description: Returns a list of assets.
    name: xdr-asset-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_id
      description: The unique identifier of the asset.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_name
      description: The name of the asset (e.g., image SHA).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_strong_id
      description: The strong identifier (SHA256) of the asset.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_provider
      description: The provider of the asset.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_external_provider_id
      description: External provider ID (if applicable).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_first_observed
      description: Timestamp when the asset was first observed.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_last_observed
      description: Timestamp when the asset was last observed.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_type_id
      description: The ID of the asset type (e.g., CORE_IMAGE).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_type_name
      description: The name of the asset type.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_type_category
      description: The category of the asset (e.g., Container Image).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_type_class
      description: The class of the asset (e.g., Compute).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_development_cycle_stages
      description: The development cycle stages (e.g., RUNTIME).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_architecture
      description: The architecture of the image (e.g., amd64).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_digest
      description: The image digest hash.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_identifier
      description: The image identifier.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_names
      description: List of names/tags associated with the image.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_os
      description: The OS version of the image.
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_os_distribution
      description: The OS distribution (e.g., UBUNTU).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_os_family
      description: The OS family (e.g., Linux).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_os_release
      description: The OS release name (e.g., noble).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_labels
      description: Labels associated with the image.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_layers
      description: List of layers making up the image.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_layers_created_at
      description: Timestamp of when the layer was created.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_layers_instruction
      description: The instruction used to create the layer (e.g., RUN, ADD).
      type: String
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_image_layers_size
      description: The size of the layer in bytes.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_related_cases_cases_breakdown
      description: Breakdown of related cases by severity.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_related_cases_critical_cases
      description: Count of critical cases.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_related_issues_issues_breakdown
      description: Breakdown of related issues by severity.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_relations
      description: Relations to other assets.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Asset.xdm_asset_group_ids
      description: Group IDs associated with the asset.
      type: Number
  - name: xdr-asset-schema-get
    description: Gets the schema of the asset inventory.
    outputs:
    - contextPath: PaloAltoNetworksXDR.AssetSchema.field_name
      description: The name of the field.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetSchema.field_type
      description: The type of the field.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetSchema.field_pretty_name
      description: The pretty name of the field.
      type: String
  - arguments:
    - description: "The name of the field to get options for. You can use xdr-asset-schema-get to retrieve the schema. The field must be of type ENUM, for example: xdm.asset.provider."
      name: field_name
      required: true
    description: Gets the enum values of a specified field in the asset schema.
    name: xdr-asset-schema-field-options-get
    outputs:
    - contextPath: PaloAltoNetworksXDR.AssetSchema.field_name
      description: The name of the field.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetSchema.options
      description: The enum values of the field.
      type: Unknown
  - arguments:
    - description: The name of the asset group.
      name: group_name
      required: true
    - auto: PREDEFINED
      description: The type of the asset group.
      name: group_type
      predefined:
      - Static
      - Dynamic
      required: true
    - description: The description of the asset group.
      name: group_description
    - description: 'Define the filter conditions for selecting which assets to be included in a dynamic Asset Group. For example: "{\"AND\":[{\"SEARCH_FIELD\":\"xdm.asset.type.class\",\"SEARCH_TYPE\":\"NEQ\",\"SEARCH_VALUE\":\"Other\"}]}". The SEARCH_FIELD needs to be in lower case. For more information, please refer to the documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Create-an-Asset-Group.'
      name: membership_predicate_json
    description: Creates an asset group.
    name: xdr-asset-group-create
  - arguments:
    - description: The ID of the asset group to delete.
      name: group_id
      required: true
    description: Deletes an asset group.
    name: xdr-asset-group-delete
  - arguments:
    - description: 'The field by which to sort the results. For example: XDM.ASSET_GROUP.NAME. Use the documentation for finding more fields https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Get-all-or-filtered-asset-groups.'
      name: sort_field
    - auto: PREDEFINED
      description: The order in which to sort the results.
      name: sort_order
      predefined:
      - asc
      - desc
    - description: 'The JSON to use for the "filter" field in the API. For example: "{\"AND\": [{\"SEARCH_FIELD\": \"XDM.ASSET_GROUP.TYPE\", \"SEARCH_TYPE\": \"EQ\", \"SEARCH_VALUE\": \"Dynamic\"}]}". For more information, please refer to the documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Get-all-or-filtered-asset-groups.'
      name: filter_json
    - defaultValue: '50'
      description: Maximum number of asset groups to return. Default is 50.
      name: limit
    - description: Page size for pagination.
      name: page_size
    - defaultValue: '0'
      description: Page number for pagination. 0 is the first page.
      name: page
    description: Returns a list of asset groups.
    name: xdr-asset-group-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_ID
      description: The unique identifier of the asset group.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_NAME
      description: The name of the asset group.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_TYPE
      description: The type of the asset group (Static or Dynamic).
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_FILTER
      description: The filter query string used to define the members of the XDM asset group.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_DESCRIPTION
      description: The description of the asset group.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_CREATION_TIME
      description: The timestamp when the group was created (Epoch).
      type: Date
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_LAST_UPDATE_TIME
      description: The timestamp when the group was last updated (Epoch).
      type: Date
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_CREATED_BY_PRETTY
      description: The user or API key that created the group.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_MODIFIED_BY_PRETTY
      description: The user or API key that last modified the group.
      type: String
    - contextPath: PaloAltoNetworksXDR.AssetGroup.XDM_ASSET_GROUP_MEMBERSHIP_PREDICATE
      description: The JSON object defining the search criteria for dynamic groups.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.AssetGroup.IS_USED_BY_SBAC
      description: Indicates whether this asset group is currently utilized to define Scope-Based Access Control (SBAC) rules.
      type: Boolean
  - arguments:
    - description: The ID of the asset group to update.
      name: group_id
      required: true
    - description: The name of the asset group.
      name: group_name
    - auto: PREDEFINED
      description: The type of the asset group.
      name: group_type
      predefined:
      - Static
      - Dynamic
    - description: The description of the asset group.
      name: group_description
    - description: 'Define the filter conditions for selecting which assets to be included in a dynamic Asset Group. For example: "{\"AND\":[{\"SEARCH_FIELD\":\"xdm.asset.type.class\",\"SEARCH_TYPE\":\"NEQ\",\"SEARCH_VALUE\":\"Other\"}]}". The SEARCH_FIELD needs to be in lower case. For more information, please refer to the documentation: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Update-an-Asset-Group.'
      name: membership_predicate_json
    description: Updates an asset group.
    name: xdr-asset-group-update
  - arguments:
    - description: The entry ID of the file. The script should be a zipped YAML file.
      name: entry_id
      required: true
    description: Creates or updates an automation script.
    name: xdr-automation-script-create
  - arguments:
    - description: The field to search by.
      name: field
      required: true
      auto: PREDEFINED
      predefined:
      - id
      - name
    - description: The field value to search for.
      name: value
      required: true
    description: Gets an automation script.
    name: xdr-automation-script-get
  - arguments:
    - description: The field to search by.
      name: field
      required: true
      auto: PREDEFINED
      predefined:
      - id
      - name
    - description: The field value to search for.
      name: value
      required: true
    description: Deletes an automation script.
    name: xdr-automation-script-delete
  - arguments:
    - description: The entry ID of the file. The playbook should be a zipped YAML file.
      name: entry_id
      required: true
    description: Creates or updates an automation playbook.
    name: xdr-automation-playbook-create
  - arguments:
    - description: The field to search by.
      name: field
      required: true
      auto: PREDEFINED
      predefined:
      - id
      - name
    - description: The field value to search for.
      name: value
      required: true
    description: Gets an automation playbook.
    name: xdr-automation-playbook-get
  - arguments:
    - description: The field to search by.
      name: field
      required: true
      auto: PREDEFINED
      predefined:
      - id
      - name
    - description: The field value to search for.
      name: value
      required: true
    description: Deletes an automation playbook.
    name: xdr-automation-playbook-delete
  - arguments:
    - description: A comma-separated list of case IDs to filter by.
      isArray: true
      name: case_id
    - description: "A comma-separated list of case domains to filter by. Note: this filter is not applied when extra_data is set to true."
      isArray: true
      name: case_domain
    - description: "A comma-separated list of severities to filter by. Note: this filter is not applied when extra_data is set to true."
      isArray: true
      name: severity
    - description: Filters cases that were created before this date. Supports natural language expressions such as "one year".
      name: created_before
    - description: Filters cases that were created after this date. Supports natural language expressions such as "one year".
      name: created_after
    - description: A comma-separated list of statuses to filter by.
      isArray: true
      name: status
    - auto: PREDEFINED
      description: "The field by which to sort the results. Note: sorting by severity is not supported when extra_data is set to true."
      name: sort_field
      predefined:
      - case_id
      - severity
      - creation_time
    - auto: PREDEFINED
      description: The order in which to sort the results.
      name: sort_order
      predefined:
      - asc
      - desc
    - description: Maximum number of cases to return.
      name: limit
    - description: Page size for pagination.
      name: page_size
    - description: Page number for pagination.
      name: page
    - description: Whether to retrieve extra case data including the associated issues, file artifacts, and network artifacts for each case.
      name: extra_data
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      defaultValue: "false"
    description: Returns a list of cases based on the specified filters.
    name: xdr-case-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.Case.case_id
      description: The unique identifier of the case.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.case_name
      description: The name of the case.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.severity
      description: The severity of the case.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.creation_time
      description: The creation time of the case.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.modification_time
      description: The modification time of the case.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.status_progress
      description: The progress status of the case (e.g., New, Under Investigation).
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.description
      description: A detailed description of the case and involved entities.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.low_severity_issue_count
      description: The number of low severity issues associated with the case.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.med_severity_issue_count
      description: The number of medium severity issues associated with the case.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.case_domain
      description: The security domain of the case.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.xdr_url
      description: The direct URL to the incident view in the XDR console.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.is_blocked
      description: Indicates if the threat was blocked.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Case.aggregated_score
      description: The overall risk score calculated for the case.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.host_count
      description: The number of hosts involved in the case.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.user_count
      description: The number of users involved in the case.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.wildfire_hits
      description: The number of WildFire malware hits associated with the case.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.tags
      description: A list of tags associated with the case.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.starred
      description: Whether the case has been starred/flagged.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Case.high_severity_issue_count
      description: The number of high-severity issues associated with the case. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.critical_severity_issue_count
      description: The number of critical-severity issues associated with the case. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.resolved_timestamp
      description: The time the case was resolved. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.assigned_user_mail
      description: The email address of the user assigned to the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.assigned_user_pretty_name
      description: The display name of the user assigned to the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.hosts
      description: The hosts involved in the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.users
      description: The users involved in the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.mitre_tactics_ids_and_names
      description: The MITRE ATT&CK tactics associated with the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.mitre_techniques_ids_and_names
      description: The MITRE ATT&CK techniques associated with the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.issue_categories
      description: The categories of the issues associated with the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.resolve_comment
      description: The comment provided when the case was resolved. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.notes
      description: Notes associated with the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.manual_severity
      description: The severity manually set for the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.manual_description
      description: The description manually set for the case. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.rule_based_score
      description: The rule-based risk score of the case. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.predicted_score
      description: The predicted risk score of the case. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.issue_count
      description: The total number of issues associated with the case. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.Issues.issue_id
      description: The unique identifier of the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.case_id
      description: The identifier of the case the issue belongs to. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.detection_timestamp
      description: The detection time of the issue. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.Issues.name
      description: The name of the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.category
      description: The category of the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.severity
      description: The severity of the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.source
      description: The source of the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.action
      description: The action taken for the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.action_pretty
      description: The human-readable action taken for the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.host_ip
      description: The host IP addresses associated with the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.host_name
      description: The host name associated with the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.user_name
      description: The user name associated with the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.action_file_name
      description: The file name involved in the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.action_file_path
      description: The file path involved in the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.mitre_tactic_id_and_name
      description: The MITRE ATT&CK tactic associated with the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.Issues.mitre_technique_id_and_name
      description: The MITRE ATT&CK technique associated with the issue. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.case_id
      description: The identifier of the case associated with the file artifact. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.type
      description: The type of the file artifact. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.file_name
      description: The name of the file. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.file_sha256
      description: The SHA256 hash of the file. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.file_wildfire_verdict
      description: The WildFire verdict for the file. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.is_malicious
      description: Whether the file has been identified as malicious. Returned when extra_data is set to true.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.is_process
      description: Whether the file was a running process. Returned when extra_data is set to true.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.is_manual
      description: Whether the file artifact was added manually. Returned when extra_data is set to true.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.file_signature_vendor_name
      description: The vendor name from the file signature. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.file_signature_status
      description: The status of the file digital signature. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.FileArtifacts.alert_count
      description: The number of issues associated with the file artifact. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.case_id
      description: The identifier of the case associated with the network artifact. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.type
      description: The type of the network artifact. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.network_remote_ip
      description: The remote IP address associated with the network artifact. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.network_remote_port
      description: The remote port associated with the network artifact. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.network_domain
      description: The domain associated with the network artifact. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.network_country
      description: The country associated with the network artifact. Returned when extra_data is set to true.
      type: String
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.alert_count
      description: The number of issues associated with the network artifact. Returned when extra_data is set to true.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Case.NetworkArtifacts.is_manual
      description: Whether the network artifact was added manually. Returned when extra_data is set to true.
      type: Boolean
  - arguments:
    - description: The ID of the case to update.
      name: case_id
      required: true
    - auto: PREDEFINED
      description: The status to set for the case. When set to "resolved", the resolve_reason argument is required.
      name: status
      predefined:
      - new
      - under_investigation
      - resolved
    - auto: PREDEFINED
      description: The reason for resolving the case. Can only be provided when status is set to "resolved", and is required when resolving.
      name: resolve_reason
      predefined:
      - resolved_known_issue
      - resolved_duplicate
      - resolved_false_positive
      - resolved_true_positive
      - resolved_security_testing
      - resolved_other
    - description: The free-text comment explaining the resolution. Can only be provided when status is set to "resolved".
      name: resolve_comment
    - auto: PREDEFINED
      description: The user-defined severity to set for the case. Provide an empty string to clear the severity.
      name: user_severity
      predefined:
      - low
      - medium
      - high
      - critical
    - description: The valid Cortex XDR user email address to assign the case to.
      name: assigned_user
    - description: The free-text note for the case, used for operational or intermediate comments (e.g., a ServiceNow Ticket ID).
      name: notes
    - description: 'The JSON object string of tenant-defined custom fields to update on the case. The keys must be the exact custom field names as configured in your Cortex XDR tenant, and the values must match each field''s configuration. It is the user''s responsibility to ensure the custom field names are valid/correct for the tenant; the integration does not validate field names, only that the input is valid JSON. Example: {"my_custom_field": "value", "another_field": 42}.'
      name: custom_fields
    description: Updates an existing case with the specified details.
    name: xdr-case-update
  - arguments:
    - description: The ID of the case for which to retrieve artifacts.
      name: case_id
      required: true
    description: Retrieves a list of artifacts for a specific case.
    name: xdr-case-artifact-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.CaseNetworkArtifact.case_id
      description: The ID of the case associated with the network artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseNetworkArtifact.network_remote_ip
      description: The remote IP address associated with the artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseNetworkArtifact.network_remote_port
      description: The remote port used in the network connection.
      type: Number
    - contextPath: PaloAltoNetworksXDR.CaseNetworkArtifact.alert_count
      description: Number of alerts associated with this network artifact.
      type: Number
    - contextPath: PaloAltoNetworksXDR.CaseNetworkArtifact.type
      description: The type of network artifact (e.g., IP).
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseNetworkArtifact.is_manual
      description: Indicates if the artifact was added manually.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.case_id
      description: The ID of the case associated with the file artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.file_name
      description: The name of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.file_sha256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.file_wildfire_verdict
      description: The verdict from WildFire (e.g., MALWARE, BENIGN).
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.is_malicious
      description: Whether the file has been identified as malicious.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.is_process
      description: Indicates if the file was a running process.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.file_signature_vendor_name
      description: The vendor name from the file signature.
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.file_signature_status
      description: The status of the digital signature (e.g., SIGNATURE_SIGNED).
      type: String
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.alert_count
      description: Number of alerts associated with this file artifact.
      type: Number
    - contextPath: PaloAltoNetworksXDR.CaseFileArtifact.low_confidence
      description: Indicates if the detection confidence is low.
      type: Boolean
  - arguments:
    - description: The BIOC name to filter by. Can filter by only one name at a time.
      name: name
    - auto: PREDEFINED
      description: 'The BIOC severity to filter by.'
      name: severity
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - auto: PREDEFINED
      description: 'The BIOC type to filter by.'
      name: type
      predefined:
      - other
      - persistence
      - evasion
      - tampering
      - file_type_obfuscation
      - privilege_escalation
      - credential_access
      - lateral_movement
      - execution
      - collection
      - exfiltration
      - infiltration
      - dropper
      - file_privilege_manipulation
      - reconnaissance
      - discovery
    - auto: PREDEFINED
      description: 'Whether the BIOC is XQL.'
      name: is_xql
      predefined:
      - 'true'
      - 'false'
    - description: 'The BIOC comment to filter by.'
      name: comment
    - auto: PREDEFINED
      description: 'The BIOC status to filter by. Options are enabled or disabled.'
      name: status
      predefined:
      - enabled
      - disabled
    - description: 'The BIOC indicator to filter by.'
      name: indicator
    - description: "The MITRE technique ID and name. Must be in format 'ID - Name', for example: ['T1566 - Phishing']."
      isArray: true
      name: mitre_technique_id_and_name
    - description: "The MITRE tactic ID and name. Must be in format 'ID - Name', for example: ['T1566 - Phishing']."
      isArray: true
      name: mitre_tactic_id_and_name
    - auto: PREDEFINED
      description: Whether to return extended data.
      name: extra_data
      predefined:
      - 'true'
      - 'false'
    - description: Maximum number of results to return.
      name: limit
    - description: Page size.
      name: page_size
    - description: Page number.
      name: page
    description: Returns a list of BIOCs.
    name: xdr-bioc-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.BIOC.rule_id
      description: BIOC rule ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.BIOC.name
      description: BIOC name.
      type: String
    - contextPath: PaloAltoNetworksXDR.BIOC.type
      description: BIOC type.
      type: String
    - contextPath: PaloAltoNetworksXDR.BIOC.severity
      description: BIOC severity.
      type: String
    - contextPath: PaloAltoNetworksXDR.BIOC.status
      description: BIOC status.
      type: String
    - contextPath: PaloAltoNetworksXDR.BIOC.is_xql
      description: Whether the BIOC is XQL.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.BIOC.comment
      description: The BIOC comment.
      type: String
    - contextPath: PaloAltoNetworksXDR.BIOC.indicator
      description: The BIOC indicator.
      type: String
  - arguments:
    - description: The BIOC name.
      name: name
      required: true
    - auto: PREDEFINED
      description: The BIOC severity.
      name: severity
      required: true
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - auto: PREDEFINED
      description: The BIOC type.
      name: type
      predefined:
      - other
      - persistence
      - evasion
      - tampering
      - file_type_obfuscation
      - privilege_escalation
      - credential_access
      - lateral_movement
      - execution
      - collection
      - exfiltration
      - infiltration
      - dropper
      - file_privilege_manipulation
      - reconnaissance
      - discovery
    - auto: PREDEFINED
      description: Whether the new BIOC is XQL.
      name: is_xql
      predefined:
      - 'true'
      - 'false'
    - description: The BIOC comment.
      name: comment
    - auto: PREDEFINED
      description: The BIOC status.
      name: status
      predefined:
      - enabled
      - disabled
    - description: |-
        The BIOC indicator,
        for example: '{\"runOnCGO\":true,\"investigationType\":\"FILE_EVENT\",\"investigation\":{\"FILE_EVENT\":{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"action_file_name\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":\"testfile.exe\"}]}}}}'.
        For more information, refer to the documentation https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Insert-or-update-BIOCs.
      isArray: true
      name: indicator
      required: true
    - description: "The MITRE technique ID and name. Must be in format 'ID - Name', for example: ['T1566 - Phishing']."
      isArray: true
      name: mitre_technique_id_and_name
    - description: "The MITRE tactic ID and name. Must be in format 'ID - Name', for example: ['TA0001 - Initial Access']."
      isArray: true
      name: mitre_tactic_id_and_name
    description: Creates a new BIOC.
    name: xdr-bioc-create
    outputs:
    - contextPath: PaloAltoNetworksXDR.BIOC.rule_id
      description: BIOC ID.
      type: String
  - arguments:
    - description: BIOC rule ID.
      name: rule_id
      required: true
    - description: BIOC name.
      name: name
      required: true
    - auto: PREDEFINED
      description: BIOC severity.
      name: severity
      required: true
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - auto: PREDEFINED
      description: BIOC type.
      name: type
      predefined:
      - other
      - persistence
      - evasion
      - tampering
      - file_type_obfuscation
      - privilege_escalation
      - credential_access
      - lateral_movement
      - execution
      - collection
      - exfiltration
      - infiltration
      - dropper
      - file_privilege_manipulation
      - reconnaissance
      - discovery
    - auto: PREDEFINED
      description: Whether the BIOC is XQL.
      name: is_xql
      predefined:
      - 'true'
      - 'false'
    - description: BIOC comment.
      name: comment
    - auto: PREDEFINED
      description: BIOC status.
      name: status
      predefined:
      - enabled
      - disabled
    - description: |-
        The BIOC indicator,
        for example: '{\"runOnCGO\":true,\"investigationType\":\"FILE_EVENT\",\"investigation\":{\"FILE_EVENT\":{\"filter\":{\"AND\":[{\"SEARCH_FIELD\":\"action_file_name\",\"SEARCH_TYPE\":\"EQ\",\"SEARCH_VALUE\":\"testfile.exe\"}]}}}}'.
        For more information, refer to the documentation https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR-Platform-APIs/Insert-or-update-BIOCs.
      isArray: true
      name: indicator
      required: true
    - description: "The MITRE technique ID and name. Must be in format 'ID - Name', for example: ['T1566 - Phishing']."
      isArray: true
      name: mitre_technique_id_and_name
    - description: "The MITRE tactic ID and name. Must be in format 'ID - Name', for example: ['TA0001 - Initial Access']."
      isArray: true
      name: mitre_tactic_id_and_name
    description: Updates an existing BIOC.
    name: xdr-bioc-update
    outputs:
    - contextPath: PaloAltoNetworksXDR.BIOC.rule_id
      description: BIOC ID.
      type: String
  - arguments:
    - description: BIOC name.
      name: name
    - auto: PREDEFINED
      description: BIOC severity.
      name: severity
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - auto: PREDEFINED
      description: BIOC type.
      name: type
      predefined:
      - other
      - persistence
      - evasion
      - tampering
      - file_type_obfuscation
      - privilege_escalation
      - credential_access
      - lateral_movement
      - execution
      - collection
      - exfiltration
      - infiltration
      - dropper
      - file_privilege_manipulation
      - reconnaissance
      - discovery
    - auto: PREDEFINED
      description: Whether the BIOC is XQL.
      name: is_xql
      predefined:
      - 'true'
      - 'false'
    - description: BIOC comment.
      name: comment
    - description: BIOC indicator.
      isArray: true
      name: indicator
    - description: "The MITRE technique ID and name. Must be in format 'ID - Name', for example: ['T1566 - Phishing']."
      isArray: true
      name: mitre_technique_id_and_name
    - description: "The MITRE tactic ID and name. Must be in format 'ID - Name', for example: ['TA0001 - Initial Access']."
      isArray: true
      name: mitre_tactic_id_and_name
    description: Deletes a BIOC.
    name: xdr-bioc-delete
  - arguments:
    - description: Correlation rule name.
      name: name
    - auto: PREDEFINED
      description: Correlation rule severity.
      name: severity
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - description: Correlation rule XQL query.
      name: xql_query
    - auto: PREDEFINED
      description: Whether the correlation rule is XQL.
      name: is_xql
      predefined:
      - 'true'
      - 'false'
    - description: Correlation rule dataset.
      name: dataset
    - description: Alert name.
      name: alert_name
    - description: Alert category.
      name: alert_category
    - description: Alert fields. Can be a string or a dictionary.
      name: alert_fields
    - description: Alert domain.
      name: alert_domain
    - description: Filter JSON.
      name: filter_json
    - auto: PREDEFINED
      description: Whether to return extended view.
      name: extra_data
      predefined:
      - 'true'
      - 'false'
    - description: Maximum number of results to return.
      name: limit
    - description: Page size.
      name: page_size
    - description: Page number.
      name: page
    description: Returns a list of correlation rules.
    name: xdr-correlation-rule-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.suppression_duration
      description: The duration for which alerts are suppressed.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.alert_category
      description: The category of the alert (e.g., DROPPER).
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.mitre_defs
      description: MITRE ATT&CK definitions associated with the rule.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.simple_schedule
      description: The frequency at which the rule runs in a human-readable format.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.mapping_strategy
      description: The strategy used for field mapping.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.suppression_fields
      description: Fields used to determine alert suppression.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.alert_domain
      description: The security domain the alert belongs to.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.crontab
      description: The cron expression for the rule execution schedule.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.search_window
      description: The time window the query searches across.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.user_defined_severity
      description: Custom severity level defined by the user.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.drilldown_query_timeframe
      description: The timeframe used for drilldown queries.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.user_defined_category
      description: Custom category defined by the user.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.lookup_mapping
      description: Mapping details for lookups.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.execution_mode
      description: "How the rule is executed, for example: SCHEDULED."
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.name
      description: The name of the correlation rule.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.is_enabled
      description: Whether the correlation rule is currently active.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.investigation_query_link
      description: The query used for further investigation.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.alert_name
      description: The specific name assigned to the generated alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.suppression_enabled
      description: Whether suppression is enabled for this rule.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.action
      description: "The action taken when the rule triggers, for example: ALERTS."
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.dataset
      description: The dataset the rule queries.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.alert_description
      description: Detailed description of the generated alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.timezone
      description: The timezone used for the rule schedule.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.xql_query
      description: The XQL query string executed by the rule.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.alert_fields
      description: Specific fields included in the alert output.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.description
      description: General description of the correlation rule.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.alert_type
      description: The type of alert generated.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.severity
      description: The severity level of the rule.
      type: String
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.rule_id
      description: The unique identifier for the correlation rule.
      type: Number
  - arguments:
    - description: The correlation rule name.
      name: name
      required: true
    - auto: PREDEFINED
      description: 'The correlation rule severity. Example: severity=low.'
      name: severity
      required: true
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - description: 'The correlation rule XQL query. Example: xql_query="dataset = xdr_data | limit 1".'
      name: xql_query
      required: true
    - auto: PREDEFINED
      description: 'Whether the rule is enabled. Example: is_enabled=true.'
      name: is_enabled
      required: true
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: 'The alert category. Example: alert_category=dropper.'
      name: alert_category
      required: true
      predefined:
      - other
      - persistence
      - evasion
      - tampering
      - file_type_obfuscation
      - privilege_escalation
      - credential_access
      - lateral_movement
      - execution
      - collection
      - exfiltration
      - infiltration
      - dropper
      - file_privilege_manipulation
      - reconnaissance
      - discovery
    - auto: PREDEFINED
      description: 'The rule execution mode. Example: execution_mode=scheduled.'
      name: execution_mode
      required: true
      predefined:
      - scheduled
      - real_time
    - description: 'The correlation rule timezone. Example: timezone="Asia/Jerusalem".'
      name: timezone
      required: true
    - auto: PREDEFINED
      description: 'The rule mapping strategy. Example: mapping_strategy=auto.'
      name: mapping_strategy
      required: true
      predefined:
      - auto
      - custom
    - description: The correlation rule description.
      name: description
    - description: The alert name.
      name: alert_name
    - description: The alert description.
      name: alert_description
    - description: Alert fields (string or dictionary).
      name: alert_fields
    - description: 'The search window timeframe. Example: search_window="1 hours".'
      name: search_window
    - description: 'The correlation rule schedule. Example: schedule="10 minutes".'
      name: schedule
    - description: 'Linux scheduling for the rule. Example: schedule_linux="*/10 * * * *".'
      name: schedule_linux
    - auto: PREDEFINED
      description: Whether suppression is enabled.
      name: suppression_enabled
      predefined:
      - 'true'
      - 'false'
    - description: Duration of correlation rule suppression.
      name: suppression_duration
    - description: Suppression fields.
      name: suppression_fields
    - description: 'The correlation rule dataset. Example: dataset=alerts.'
      name: dataset
      required: true
    - description: User-defined severity.
      name: user_defined_severity
    - description: User-defined category.
      name: user_defined_category
    - description: "MITRE definitions. For example: '{\"TA0005 - Defense Evasion\": [\"T1014 - Rootkit\"]}'."
      name: mitre_defs_json
    - description: Investigation query link.
      name: investigation_query_link
    - description: 'The drilldown query timeframe. Example: drilldown_query_timeframe="ALERT".'
      name: drilldown_query_timeframe
    description: Creates a new correlation rule.
    name: xdr-correlation-rule-create
    outputs:
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.rule_id
      description: Correlation rule ID.
      type: String
  - arguments:
    - description: Correlation rule ID.
      name: rule_id
      required: true
    - description: The correlation rule name.
      name: name
      required: true
    - auto: PREDEFINED
      description: 'The correlation rule severity. Example: severity=low.'
      name: severity
      required: true
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - description: 'The correlation rule XQL query. Example: xql_query="dataset = xdr_data | limit 1".'
      name: xql_query
      required: true
    - auto: PREDEFINED
      description: 'Whether the rule is enabled. Example: is_enabled=true.'
      name: is_enabled
      required: true
      predefined:
      - 'true'
      - 'false'
    - auto: PREDEFINED
      description: 'The alert category. Example: alert_category=dropper.'
      name: alert_category
      required: true
      predefined:
      - other
      - persistence
      - evasion
      - tampering
      - file_type_obfuscation
      - privilege_escalation
      - credential_access
      - lateral_movement
      - execution
      - collection
      - exfiltration
      - infiltration
      - dropper
      - file_privilege_manipulation
      - reconnaissance
      - discovery
    - description: 'The rule execution mode. Example: execution_mode=scheduled.'
      name: execution_mode
      required: true
      predefined:
      - scheduled
      - real_time
    - description: 'The correlation rule timezone. Example: timezone="Asia/Jerusalem".'
      name: timezone
      required: true
    - auto: PREDEFINED
      description: 'The rule mapping strategy. Example: mapping_strategy=auto.'
      name: mapping_strategy
      required: true
      predefined:
      - auto
      - custom
    - description: The correlation rule description.
      name: description
    - description: The alert name.
      name: alert_name
    - description: The alert description.
      name: alert_description
    - description: Alert fields (string or dictionary).
      name: alert_fields
    - description: 'The search window timeframe. Example: search_window="1 hours".'
      name: search_window
    - description: 'The correlation rule schedule. Example: schedule="10 minutes".'
      name: schedule
    - description: 'Linux scheduling for the rule. Example: schedule_linux="*/10 * * * *".'
      name: schedule_linux
    - auto: PREDEFINED
      description: Whether suppression is enabled.
      name: suppression_enabled
      predefined:
      - 'true'
      - 'false'
    - description: Duration of correlation rule suppression.
      name: suppression_duration
    - description: Suppression fields.
      name: suppression_fields
    - description: 'The correlation rule dataset. Example: dataset=alerts.'
      name: dataset
      required: true
    - description: User-defined severity.
      name: user_defined_severity
    - description: User-defined category.
      name: user_defined_category
    - description: "MITRE definitions. For example: '{\"TA0005 - Defense Evasion\": [\"T1014 - Rootkit\"]}'."
      name: mitre_defs_json
    - description: Investigation query link.
      name: investigation_query_link
    - description: 'The drilldown query timeframe. Example: drilldown_query_timeframe="ALERT".'
      name: drilldown_query_timeframe
    description: Updates an existing correlation rule.
    name: xdr-correlation-rule-update
    outputs:
    - contextPath: PaloAltoNetworksXDR.CorrelationRule.rule_id
      description: Correlation rule ID.
      type: String
  - arguments:
    - description: Correlation rule ID.
      isArray: true
      name: rule_id
      required: true
    description: Deletes correlation rules.
    name: xdr-correlation-rule-delete
  - arguments:
    - description: The vulnerability ID to retrieve details for.
      name: vulnerability_id
      required: true
    description: Gets vulnerability details by ID.
    name: xdr-vulnerability-details-get
    outputs:
    - contextPath: PaloAltoNetworksXDR.Vulnerability.vulnerabilityID
      description: The unique identifier (CVE ID).
      type: String
    - contextPath: PaloAltoNetworksXDR.Vulnerability.description
      description: Detailed description of the vulnerability.
      type: String
    - contextPath: PaloAltoNetworksXDR.Vulnerability.publishedDate
      description: The date the vulnerability was first published.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Vulnerability.epss_score
      description: The Probability of exploitability (0-1).
      type: Number
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.exploitMaturity
      description: Current state of exploit availability (e.g., weaponized).
      type: String
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.weaponizedExploitFound
      description: Whether a functional exploit exists in the wild.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.reportedExploited
      description: Whether the vulnerability has been actively exploited.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.reportedExploitedByThreatActors
      description: Whether known threat actors are exploiting this vulnerability.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.reportedExploitedByRansomware
      description: Whether the vulnerability is used in ransomware campaigns.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.reportedExploitedByBotnets
      description: Whether the vulnerability is being leveraged by botnet clusters.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.firstReportedThreatActor
      description: The timestamp of the first recorded threat actor activity.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Vulnerability.exploitDetails.mostRecentReportedThreatActor
      description: The timestamp of the last recorded threat actor activity.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Vulnerability.cisaKevDateDue
      description: The deadline set by CISA for federal agency remediation.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Vulnerability.weaknesses.cweId
      description: The Common Weakness Enumeration ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.Vulnerability.vulncheck-threat-actors
      description: A list of specific threat actor groups associated with the vulnerability.
      type: String
  - description: Runs a system health check on the Cortex XDR environment.
    name: xdr-healthcheck-run
    outputs:
    - contextPath: PaloAltoNetworksXDR.HealthStatus.status
      description: The health status of the Cortex XDR system.
      type: String
  - description: Gets a list of available triage presets.
    name: xdr-endpoint-triage-preset-list
    outputs:
    - contextPath: PaloAltoNetworksXDR.EndpointTriagePreset.created_by
      description: The user or system entity that created the triage preset.
      type: String
    - contextPath: PaloAltoNetworksXDR.EndpointTriagePreset.description
      description: A brief explanation of the preset's purpose or contents.
      type: String
    - contextPath: PaloAltoNetworksXDR.EndpointTriagePreset.name
      description: The unique display name of the triage preset.
      type: String
    - contextPath: PaloAltoNetworksXDR.EndpointTriagePreset.os
      description: The operating system platform the preset targets (e.g., windows, linux, macos).
      type: String
    - contextPath: PaloAltoNetworksXDR.EndpointTriagePreset.type
      description: The category or classification of the preset (e.g., standard, custom).
      type: String
    - contextPath: PaloAltoNetworksXDR.EndpointTriagePreset.uuid
      description: The unique universal identifier (UUID) assigned to this specific preset.
      type: String
  - arguments:
    - description: A comma-separated list of endpoint IDs to initiate triage on. You can find the endpoint ID under the "Inventory" section, under "All Endpoints".
      isArray: true
      name: endpoint_id
      required: true
    - description: The collector UUID to use for the triage.
      name: collector_uuid
    description: Initiates a forensics triage on the specified endpoints. You must have Cortex XDR with the Forensics add-on. The agent also must have the Forensics License enabled.
    name: xdr-endpoint-triage
    outputs:
    - contextPath: PaloAltoNetworksXDR.EndpointTriage.TRIAGE_ID
      description: The unique identifier assigned to the created triage action.
      type: String
    - contextPath: PaloAltoNetworksXDR.EndpointTriage.SUCCESSFUL_AGENT_IDS
      description: A list of agent IDs where the triage action was successfully initiated.
      type: Array
    - contextPath: PaloAltoNetworksXDR.EndpointTriage.UNSUCCESSFUL_AGENT_IDS
      description: A list of agent IDs where the triage action failed to initiate.
      type: Array
  - name: xdr-issue-list
    description: Retrieve issues based on filters. Issues with an 'INFO' severity level are filtered out.
    arguments:
    - name: issue_id
      description: A comma-separated list of issue IDs.
      isArray: true
    - name: external_id
      description: A comma-separated list of external IDs.
      isArray: true
    - name: detection_method
      description: "A comma-separated list of methods used to detect the activity. Possible values: 'BIOC', 'Correlation', 'Analytics', 'System', 'IOC'."
      auto: PREDEFINED
      isArray: true
      predefined:
      - BIOC
      - Correlation
      - Analytics
      - System
      - IOC
    - name: domain
      description: A comma-separated list of domains.
      isArray: true
    - name: severity
      description: "A comma-separated list of severities. Possible values: 'critical', 'high', 'medium', 'low', 'info'."
      auto: PREDEFINED
      predefined:
      - info
      - low
      - medium
      - high
      - critical
    - name: insert_time
      description: Filter by issues inserted after this time.
    - name: status
      description: "A comma-separated list of statuses. Possible values: 'new', 'in_progress', 'resolved'."
      auto: PREDEFINED
      predefined:
      - new
      - in_progress
      - resolved
      isArray: true
    - name: sort_field
      description: The field to sort by.
      auto: PREDEFINED
      predefined:
      - issue_id
      - severity
      - observation_time
    - name: sort_order
      description: The sort order.
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - name: limit
      description: The maximum number of results to return.
    - name: page_size
      description: The page size.
    - name: page
      description: The page number.
    outputs:
    - contextPath: PaloAltoNetworksXDR.Issue.observation_time
      description: The timestamp when the observation occurred.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Issue.domain
      description: The security domain associated with the observation.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.remediation
      description: Suggested remediation steps.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.impact
      description: The potential impact of the observed activity.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.status
      description: The current progress status (e.g., New).
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.status_resolution_comment
      description: Comments regarding the resolution of the status.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.status_progress
      description: The current progress status (e.g., New).
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.asset_ids
      description: List of asset IDs involved.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.assigned_to_pretty
      description: The display name of the user assigned to this item.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.last_update_timestamp
      description: The last time this record was updated.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Issue.detection_method
      description: The method used to detect the activity (e.g., BIOC).
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.is_starred
      description: Whether the item has been starred/flagged.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Issue.name
      description: The name of the observation or alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.external_id
      description: The unique UUID for external reference.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.insert_time
      description: The time the record was inserted into the database.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Issue.detection_rule_id
      description: The ID of the specific detection rule triggered.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.tags
      description: A list of tags associated with the observation.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.type
      description: The classification type of the observation.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.id
      description: The numeric ID of the observation.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Issue.description
      description: Detailed description of the observed activity.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.severity
      description: The severity level (e.g., LOW).
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.category
      description: The category classification.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.is_excluded
      description: Whether this observation is excluded from standard views.
      type: Boolean
  - name: xdr-issue-create
    description: Creates a new issue. Issues with an 'INFO' severity level are not displayed in the UI.
    arguments:
    - name: name
      description: The issue name.
      required: true
    - name: description
      description: The issue description.
      required: true
    - name: observation_time
      description: The observation time. Supports natural language expressions such as "one year".
      required: true
    - name: domain
      description: The domain.
      required: true
    - name: category
      description: The category.
      required: true
    - name: asset_id
      description: A comma-separated list of asset IDs.
      isArray: true
    - name: mitre_tactic
      description: A comma-separated list of MITRE tactics.
      isArray: true
    - name: mitre_technique
      description: A comma-separated list of MITRE techniques.
      isArray: true
    - name: type
      description: The issue type.
    - name: extended_description
      description: The extended description.
    - name: impact
      description: The impact.
    - name: tags
      description: A comma-separated list of tags.
      isArray: true
    - name: is_excluded
      description: Whether the issue is excluded.
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: is_starred
      description: Whether the issue is starred.
      auto: PREDEFINED
      predefined:
      - 'true'
      - 'false'
    - name: assigned_to
      description: The user assigned to the issue.
    - name: assigned_to_pretty
      description: The pretty name of the user assigned to the issue.
    - name: severity
      description: The severity.
      required: true
      auto: PREDEFINED
      predefined:
      - critical
      - info
      - low
      - medium
      - high
    - name: normalized_fields_json
      description: The JSON to add to the "normalized_fields" field in the API.
    - name: custom_fields_json
      description: The JSON to add to the "custom_fields" field in the API.
    outputs:
    - contextPath: PaloAltoNetworksXDR.Issue.external_id
      description: The issue external ID.
      type: String
    - contextPath: PaloAltoNetworksXDR.Issue.detection_method
      description: The issue detection method.
      type: String
  - name: xdr-issue-update
    description: Updates an existing issue.
    arguments:
    - name: issue_id
      description: The issue ID.
      required: true
    - name: severity
      description: The severity.
      auto: PREDEFINED
      predefined:
      - critical
      - info
      - low
      - medium
      - high
    - name: status
      description: The status.
      auto: PREDEFINED
      predefined:
      - new
      - in_progress
      - resolved
    - name: resolve_reason
      description: The resolve reason.
      auto: PREDEFINED
      predefined:
      - resolved_threat_handled
      - resolved_known_issue
      - resolved_duplicate
      - resolved_false_positive
      - resolved_other
      - resolved_true_positive
      - resolved_security_testing
    - name: resolve_comment
      description: The resolve comment.
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  isfetch:xpanse: false
  script: ''
  subtype: python3
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
  type: python
tests:
- Test XDR Playbook execute script commands
- Test XDR Playbook quarantine file command
- Test XDR Playbook general commands
- Test XDR Playbook retrieve file command
defaultmapperin: Cortex XDR - IR-mapper
defaultmapperout: Cortex XDR - IR-out-mapper
fromversion: 5.0.0