commonfields:
  id: Cortex XDR - IR CTF
  version: -1
name: Cortex XDR - IR CTF
display: Cortex XDR - IR CTF
category: Endpoint
provider: Palo Alto Networks
description: Cortex XDR is the world's first detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks.
sectionorder:
- Collect
configuration:
- display: Fetch incidents
  name: isFetch
  defaultvalue: "true"
  type: 8
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- display: Incident Mirroring Direction
  name: mirror_direction
  defaultvalue: None
  type: 15
  required: false
  options:
  - None
  - Incoming
  - Outgoing
  - Both
  section: Collect
- display: HTTP Timeout
  name: timeout
  defaultvalue: "120"
  type: 0
  required: false
  additionalinfo: The timeout of the HTTP requests sent to Cortex XDR API (in seconds).
  section: Collect
- display: Maximum number of incidents per fetch
  name: max_fetch
  defaultvalue: "201"
  type: 0
  required: false
  additionalinfo: The maximum number of incidents per fetch. Cannot exceed 100.
  section: Collect
- display: Only fetch starred incidents
  name: starred
  type: 8
  required: false
  section: Collect
- display: Starred incidents fetch window
  name: starred_incidents_fetch_window
  defaultvalue: 3 days
  type: 0
  required: false
  additionalinfo: Starred fetch window timestamp (<number> <time unit>, e.g., 12 hours, 7 days). Fetches only starred incidents within the specified time range.
  section: Collect
- display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: fetch_time
  defaultvalue: 3 days
  type: 0
  required: false
  section: Collect
- display: Sync Incident Owners
  name: sync_owners
  type: 8
  required: false
  additionalinfo: For Cortex XSOAR version 6.0.0 and above. If selected, for every incident fetched from Cortex XDR to Cortex XSOAR, the incident owners will be synced. Note that once this value is changed and synchronized between the systems, additional changes will not be reflected. For example, if you change the owner in Cortex XSOAR, the new owner will also be changed in Cortex XDR. However, if you now change the owner back in Cortex XDR, this additional change will not be reflected in Cortex XSOAR. In addition, for this change to be reflected, the owners must exist in both Cortex XSOAR and Cortex XDR.
  section: Collect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Collect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Collect
- display: Prevent Only Mode
  name: prevent_only
  type: 8
  required: false
  additionalinfo: Whether the XDR tenant Mode is prevent only
  section: Collect
- display: Incident Statuses to Fetch
  name: status
  type: 16
  required: false
  options:
  - new
  - under_investigation
  - resolved_known_issue
  - resolved_false_positive
  - resolved_true_positive
  - resolved_security_testing
  - resolved_other
  - resolved_auto
  additionalinfo: 'The statuses of the incidents that will be fetched. If no status is provided then incidents of all the statuses will be fetched. Note: An incident whose status was changed to a filtered status after its creation time will not be fetched.'
  section: Collect
- display: Incidents Fetch Interval
  name: incidentFetchInterval
  defaultvalue: "500000000000"
  type: 19
  required: false
  section: Collect
script:
  script: ''
  type: python
  commands:
  - description: "Gets mapping fields from remote incident. Note: This method will not update the current incident, it's here for debugging purposes."
    name: get-mapping-fields
    arguments: []
  - name: xdr-get-incident-extra-data-ctf
    arguments:
    - name: incident_id
      required: true
      description: The ID of the incident for which to get additional data.
    - name: alerts_limit
      description: Maximum number of alerts to return.
      defaultValue: "1000"
    - name: return_only_updated_incident
      description: Return data only if the incident was changed since the last time it was mirrored into Cortex XSOAR.  This flag should be used only from within a Cortex XDR incident.
      defaultValue: "False"
    outputs:
    - contextPath: PaloAltoNetworksXDR.Incident.incident_id
      description: Unique ID assigned to each returned incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.creation_time
      description: Date and time the incident was created on Cortex XDR.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.modification_time
      description: Date and time that the incident was last modified.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.detection_time
      description: Date and time that the first alert occurred in the incident.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.status
      description: |-
        Current status of the incident. Valid values are:
        "new","under_investigation","resolved_known_issue","resolved_duplicate","resolved_false_positive","resolved_true_positive","resolved_security_testing","resolved_other".
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.severity
      description: 'Calculated severity of the incident. Valid values are: "low","medium","high".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.description
      description: Dynamic calculated description of the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.assigned_user_mail
      description: Email address of the assigned user.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.assigned_user_pretty_name
      description: Full name of the user assigned to the incident.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alert_count
      description: Total number of alerts in the incident.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.low_severity_alert_count
      description: Number of alerts with the severity LOW.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.med_severity_alert_count
      description: Number of alerts with the severity MEDIUM.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.high_severity_alert_count
      description: Number of alerts with the severity HIGH.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.user_count
      description: Number of users involved in the incident.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.host_count
      description: Number of hosts involved in the incident.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.notes
      description: Comments entered by the user regarding the incident.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.resolve_comment
      description: Comments entered by the user when the incident was resolved.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.manual_severity
      description: Incident severity assigned by the user. This does not affect the calculated severity of low, medium, or high.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.manual_description
      description: Incident description provided by the user.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.xdr_url
      description: A link to the incident view on Cortex XDR.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.starred
      description: Incident starred.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_techniques_ids_and_names
      description: Incident Mitre techniques IDs and names.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.wildfire_hits.mitre_tactics_ids_and_names
      description: Incident Mitre tactics ids and names.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.alert_id
      description: Unique ID for each alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.detection_timestamp
      description: Date and time that the alert occurred.
      type: Date
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.source
      description: Source of the alert. The product/vendor this alert came from.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.severity
      description: 'Severity of the alert.Valid values are: "low","medium","high""".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.name
      description: Calculated name of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.category
      description: Category of the alert, for example, Spyware Detected via Anti-Spyware profile.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.description
      description: Textual description of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.host_ip_list
      description: Host IP involved in the alert.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.host_name
      description: Host name involved in the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.user_name
      description: User name involved with the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.event_type
      description: 'Event type. Valid values are: "Process Execution","Network Event","File Event","Registry Event","Injection Event","Load Image Event","Windows Event Log".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action
      description: 'The action that triggered the alert. Valid values are: "REPORTED", "BLOCKED", "POST_DETECTED", "SCANNED", "DOWNLOAD", "PROMPT_ALLOW", "PROMPT_BLOCK", "DETECTED", "BLOCKED_1", "BLOCKED_2", "BLOCKED_3", "BLOCKED_5", "BLOCKED_6", "BLOCKED_7", "BLOCKED_8", "BLOCKED_9", "BLOCKED_10", "BLOCKED_11", "BLOCKED_13", "BLOCKED_14", "BLOCKED_15", "BLOCKED_16", "BLOCKED_17", "BLOCKED_24", "BLOCKED_25", "DETECTED_0", "DETECTED_4", "DETECTED_18", "DETECTED_19", "DETECTED_20", "DETECTED_21", "DETECTED_22", "DETECTED_23".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_pretty
      description: 'The action that triggered the alert. Valid values are: "Detected (Reported)" "Prevented (Blocked)" "Detected (Post Detected)" "Detected (Scanned)" "Detected (Download)" "Detected (Prompt Allow)" "Prevented (Prompt Block)" "Detected" "Prevented (Denied The Session)" "Prevented (Dropped The Session)" "Prevented (Dropped The Session And Sent a TCP Reset)" "Prevented (Blocked The URL)" "Prevented (Blocked The IP)" "Prevented (Dropped The Packet)" "Prevented (Dropped All Packets)" "Prevented (Terminated The Session And Sent a TCP Reset To Both Sides Of The Connection)" "Prevented (Terminated The Session And Sent a TCP Reset To The Client)" "Prevented (Terminated The Session And Sent a TCP Reset To The Server)" "Prevented (Continue)" "Prevented (Block-Override)" "Prevented (Override-Lockout)" "Prevented (Override)" "Prevented (Random-Drop)" "Prevented (Silently Dropped The Session With An ICMP Unreachable Message To The Host Or Application)" "Prevented (Block)" "Detected (Allowed The Session)" "Detected (Raised An Alert)" "Detected (Syncookie Sent)" "Detected (Forward)" "Detected (Wildfire Upload Success)" "Detected (Wildfire Upload Failure)" "Detected (Wildfire Upload Skip)" "Detected (Sinkhole)".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_image_name
      description: Image name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_command_line
      description: Command line.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_status
      description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.actor_process_signature_vendor
      description: Signature vendor name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_image_name
      description: Image name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_command_line
      description: Command line.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_status
      description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_process_signature_vendor
      description: Signature vendor.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.causality_actor_causality_id
      description: Causality ID.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_name
      description: Image name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_command_line
      description: Command line.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_image_sha256
      description: Image SHA256.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_signature_status
      description: 'Signature status. Valid values are: "Signed" "Invalid Signature" "Unsigned" "Revoked" "Signature Fail" "N/A" "Weak Hash".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_process_signature_vendor
      description: Signature vendor name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_path
      description: File path.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_md5
      description: File MD5.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_file_sha256
      description: File SHA256.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_registry_data
      description: Registry data.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_registry_full_key
      description: Registry full key.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_local_ip
      description: Local IP.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_local_port
      description: Local port.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_remote_ip
      description: Remote IP.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_remote_port
      description: Remote port.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.action_external_hostname
      description: External hostname.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.fw_app_id
      description: Firewall app id.
      type: Unknown
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.is_whitelisted
      description: 'Is the alert on allow list. Valid values are: "Yes" "No".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.alerts.starred
      description: Alert starred.
      type: Boolean
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.type
      description: Network artifact type.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_port
      description: The remote port related to the artifact.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.alert_count
      description: Number of alerts related to the artifact.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_remote_ip
      description: The remote IP related to the artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.is_manual
      description: Whether the artifact was created by the user (manually).
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_domain
      description: The domain related to the artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.type
      description: 'The artifact type. Valid values are: "META", "GID", "CID", "HASH", "IP", "DOMAIN", "REGISTRY", "HOSTNAME".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.network_artifacts.network_country
      description: The country related to the artifact.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_status
      description: 'Digital signature status of the file. Valid values are: "SIGNATURE_UNAVAILABLE" "SIGNATURE_SIGNED" "SIGNATURE_INVALID" "SIGNATURE_UNSIGNED" "SIGNATURE_WEAK_HASH".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_process
      description: Whether the file artifact is related to a process execution.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_name
      description: Name of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_wildfire_verdict
      description: 'The file verdict, calculated by Wildfire. Valid values are: "BENIGN" "MALWARE" "GRAYWARE" "PHISHING" "UNKNOWN".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.alert_count
      description: Number of alerts related to the artifact.
      type: number
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_malicious
      description: Whether the artifact is malicious, as decided by the Wildfire verdict.
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.is_manual
      description: Whether the artifact was created by the user (manually).
      type: boolean
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.type
      description: 'The artifact type. Valid values are: "META" "GID" "CID" "HASH" "IP" "DOMAIN" "REGISTRY" "HOSTNAME".'
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_sha256
      description: SHA256 hash of the file.
      type: String
    - contextPath: PaloAltoNetworksXDR.Incident.file_artifacts.file_signature_vendor_name
      description: File signature vendor name.
      type: String
    - contextPath: Account.Username
      description: The username in the relevant system.
      type: String
    - contextPath: Endpoint.Hostname
      description: The hostname that is mapped to this endpoint.
      type: String
    - contextPath: File.Path
      description: The path where the file is located.
      type: String
    - contextPath: File.MD5
      description: The MD5 hash of the file.
      type: String
    - contextPath: File.SHA256
      description: The SHA256 hash of the file.
      type: String
    - contextPath: File.Name
      description: The full file name (including file extension).
      type: String
    - contextPath: Process.Name
      description: The name of the process.
      type: String
    - contextPath: Process.MD5
      description: The MD5 hash of the process.
      type: String
    - contextPath: Process.SHA256
      description: The SHA256 hash of the process.
      type: String
    - contextPath: Process.PID
      description: The PID of the process.
      type: String
    - contextPath: Process.Path
      description: The file system path to the binary file.
      type: String
    - contextPath: Process.Start Time
      description: The timestamp of the process start time.
      type: String
    - contextPath: Process.CommandLine
      description: The full command line (including arguments).
      type: String
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: IP.Geo.Country
      description: The country in which the IP address is located.
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    description: Returns additional data for the specified incident, for example, related alerts, file artifacts, network artifacts, and so on.
  - name: xdr-endpoint-isolate-ctf
    arguments:
    - name: incident_id
      description: Allows linking the response action to the incident that triggered it.
    - name: endpoint_id
      required: true
      description: The endpoint ID (string) to isolate. You can retrieve the string from the xdr-get-endpoints command.
    - name: suppress_disconnected_endpoint_error
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to suppress an error when trying to isolate a disconnected endpoint. When sets to false, an error will be returned.
      defaultValue: "false"
    - name: interval_in_seconds
      description: Interval in seconds between each poll.
    - name: timeout_in_seconds
      description: Polling timeout in seconds.
    - name: action_id
      deprecated: true
      description: For polling use.
      isArray: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.Isolation.endpoint_id
      description: The endpoint ID.
      type: String
    description: Isolates the specified endpoint.
    execution: true
    polling: true
  - name: xdr-file-retrieve-ctf
    arguments:
    - name: endpoint_ids
      required: true
      description: A comma-separated list of endpoint IDs.
      isArray: true
    - name: generic_file_path
      required: true
      description: A comma-separated list of file paths in any platform. Can be used instead of the mac/windows/linux file paths. The order of the files path list must be parallel to the endpoints list order, so the first file path in the list is related to the first endpoint and so on.
      isArray: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.action_id
      description: ID of the action to retrieve files from selected endpoints.
      type: string
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.endpoint_id
      description: Endpoint ID. Added only when the operation is successful.
      type: string
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.file_link
      description: Link to the file. Added only when the operation is successful.
      type: string
    - contextPath: PaloAltoNetworksXDR.RetrievedFiles.status
      description: The action status. Added only when the operation is unsuccessful.
      type: string
    description: Retrieves files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. At least one endpoint ID and one file path are necessary in order to run the command. After running this command, you can use the xdr-action-status-get command with returned action_id, to check the action status.
    polling: true
  - name: xdr-get-alerts-ctf
    arguments:
    - name: alert_id
      description: The unique ID of the alert.
      isArray: true
    - name: severity
      auto: PREDEFINED
      predefined:
      - low
      - medium
      - high
      description: The severity of the alert.
      isArray: true
    - name: custom_filter
      description: "a custom filter, when using this argument, other filter arguments are not relevant. example: \n`{\n                \"OR\": [\n                    {\n                        \"SEARCH_FIELD\": \"actor_process_command_line\",\n                        \"SEARCH_TYPE\": \"EQ\",\n                        \"SEARCH_VALUE\": \"path_to_file\"\n                    }\n                ]\n            }`."
    - name: Identity_type
      auto: PREDEFINED
      predefined:
      - ANONYMOUS
      - APPLICATION
      - COMPUTE
      - FEDERATED_IDENTITY
      - SERVICE
      - SERVICE_ACCOUNT
      - TEMPORARY_CREDENTIALS
      - TOKEN
      - UNKNOWN
      - USER
      description: Account type.
      isArray: true
    - name: agent_id
      description: A unique identifier per agent.
      isArray: true
    - name: action_external_hostname
      description: The host name to connect to. In case of a proxy connection, this value will differ from action_remote_ip.
      isArray: true
    - name: rule_id
      description: A string identifying the user rule.
      isArray: true
    - name: rule_name
      description: The name of the user rule.
      isArray: true
    - name: alert_name
      description: The alert name.
      isArray: true
    - name: alert_source
      description: The alert source.
      isArray: true
    - name: time_frame
      auto: PREDEFINED
      predefined:
      - 60 minutes
      - 3 hours
      - 12 hours
      - 24 hours
      - 2 days
      - 7 days
      - 14 days
      - 30 days
      - custom
      description: Supports relative times or “custom” time option. If you choose the "custom" option, you should use start_time and end_time arguments.
    - name: user_name
      description: The name assigned to the user_id during agent runtime.
      isArray: true
    - name: actor_process_image_name
      description: The file name of the binary file.
      isArray: true
    - name: causality_actor_process_image_command_line
      description: CGO CMD.
      isArray: true
    - name: actor_process_image_command_line
      description: |-
        Trimmed to 128 unicode chars during event serialization.
        Full value reported as part of the original process event.
      isArray: true
    - name: action_process_image_command_line
      description: The command line of the process created.
      isArray: true
    - name: actor_process_image_sha256
      description: SHA256 of the binary file.
      isArray: true
    - name: causality_actor_process_image_sha256
      description: SHA256 of the binary file.
      isArray: true
    - name: action_process_image_sha256
      description: SHA256 of the binary file.
      isArray: true
    - name: action_file_image_sha256
      description: SHA256 of the file related to the event.
      isArray: true
    - name: action_registry_name
      description: The name of the registry.
      isArray: true
    - name: action_registry_key_data
      description: The key data of the registry.
      isArray: true
    - name: host_ip
      description: The host IP.
      isArray: true
    - name: action_local_ip
      description: The local IP address for the connection.
      isArray: true
    - name: action_remote_ip
      description: Remote IP address for the connection.
      isArray: true
    - name: alert_action_status
      auto: PREDEFINED
      predefined:
      - detected
      - detected (allowed the session)
      - detected (download)
      - detected (forward)
      - detected (post detected)
      - detected (prompt allow)
      - detected (raised an alert)
      - detected (reported)
      - detected (on write)
      - detected (scanned)
      - detected (sinkhole)
      - detected (syncookie sent)
      - detected (wildfire upload failure)
      - detected (wildfire upload success)
      - detected (wildfire upload skip)
      - detected (xdr managed threat hunting)
      - prevented (block)
      - prevented (blocked)
      - prevented (block-override)
      - prevented (blocked the url)
      - prevented (blocked the ip)
      - prevented (continue)
      - prevented (denied the session)
      - prevented (dropped all packets)
      - prevented (dropped the session)
      - prevented (dropped the session and sent a tcp reset)
      - prevented (dropped the packet)
      - prevented (override)
      - prevented (override-lockout)
      - prevented (post detected)
      - prevented (prompt block)
      - prevented (random-drop)
      - prevented (silently dropped the session with an icmp unreachable message to the host or application)
      - prevented (terminated the session and sent a tcp reset to both sides of the connection)
      - prevented (terminated the session and sent a tcp reset to the client)
      - prevented (terminated the session and sent a tcp reset to the server)
      - prevented (on write)
      description: Alert action status.
    - name: action_local_port
      description: The local IP address for the connection.
      isArray: true
    - name: action_remote_port
      description: The remote port for the connection.
      isArray: true
    - name: dst_action_external_hostname
      description: The hostname we connect to. In case of a proxy connection, this value will differ from action_remote_ip.
      isArray: true
    - name: sort_field
      description: The field by which we sort the results.
      isArray: true
      defaultValue: source_insert_ts
    - name: sort_order
      auto: PREDEFINED
      predefined:
      - DESC
      - ASC
      description: The order in which we sort the results.
    - name: offset
      description: The first page from which we bring the alerts.
      isArray: true
      defaultValue: "0"
    - name: limit
      description: The last page from which we bring the alerts.
      isArray: true
      defaultValue: "50"
    - name: start_time
      description: Relevant when "time_frame" argument is "custom". Supports Epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss.000Z).
    - name: end_time
      description: Relevant when "time_frame" argument is "custom". Supports Epoch timestamp and simplified extended ISO format (YYYY-MM-DDThh:mm:ss.000Z).
    - name: starred
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether the alert is starred or not.
    - name: mitre_technique_id_and_name
      description: The MITRE attack technique.
      isArray: true
    outputs:
    - contextPath: PaloAltoNetworksXDR.Alert.internal_id
      description: The unique ID of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.source_insert_ts
      description: The detection timestamp.
      type: Number
    - contextPath: PaloAltoNetworksXDR.Alert.alert_name
      description: The name of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.severity
      description: The severity of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_category
      description: The category of the alert.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_action_status
      description: |-
        The alert action. Possible values.

        DETECTED: detected
        DETECTED_0: detected (allowed the session)
        DOWNLOAD: detected (download)
        DETECTED_19: detected (forward)
        POST_DETECTED: detected (post detected)
        PROMPT_ALLOW: detected (prompt allow)
        DETECTED_4: detected (raised an alert)
        REPORTED: detected (reported)
        REPORTED_TRIGGER_4: detected (on write)
        SCANNED: detected (scanned)
        DETECTED_23: detected (sinkhole)
        DETECTED_18: detected (syncookie sent)
        DETECTED_21: detected (wildfire upload failure)
        DETECTED_20: detected (wildfire upload success)
        DETECTED_22: detected (wildfire upload skip)
        DETECTED_MTH: detected (xdr managed threat hunting)
        BLOCKED_25: prevented (block)
        BLOCKED: prevented (blocked)
        BLOCKED_14: prevented (block-override)
        BLOCKED_5: prevented (blocked the url)
        BLOCKED_6: prevented (blocked the ip)
        BLOCKED_13: prevented (continue)
        BLOCKED_1: prevented (denied the session)
        BLOCKED_8: prevented (dropped all packets)
        BLOCKED_2: prevented (dropped the session)
        BLOCKED_3: prevented (dropped the session and sent a tcp reset)
        BLOCKED_7: prevented (dropped the packet)
        BLOCKED_16: prevented (override)
        BLOCKED_15: prevented (override-lockout)
        BLOCKED_26: prevented (post detected)
        PROMPT_BLOCK: prevented (prompt block)
        BLOCKED_17: prevented (random-drop)
        BLOCKED_24: prevented (silently dropped the session with an icmp unreachable message to the host or application)
        BLOCKED_9: prevented (terminated the session and sent a tcp reset to both sides of the connection)
        BLOCKED_10: prevented (terminated the session and sent a tcp reset to the client)
        BLOCKED_11: prevented (terminated the session and sent a tcp reset to the server)
        BLOCKED_TRIGGER_4: prevented (on write).
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_action_status_readable
      description: The alert action.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_name
      description: The alert name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.alert_description
      description: The alert description.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.agent_ip_addresses
      description: The host IP.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.agent_hostname
      description: The host name.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.mitre_tactic_id_and_name
      description: The MITRE attack tactic.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.mitre_technique_id_and_name
      description: The MITRE attack technique.
      type: String
    - contextPath: PaloAltoNetworksXDR.Alert.starred
      description: Whether the alert is starred or not.
      type: Boolean
    description: "Returns a list of alerts and their metadata, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. \nMultiple filter arguments will be concatenated using the AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value."
  dockerimage: demisto/python3:3.12.13.10116658
  isfetch: true
  runonce: false
  subtype: python3
  ismappable: true
  isremotesyncin: true
  isremotesyncout: true
fromversion: 8.2.0
defaultmapperin: XDR - Incoming Mapper CTF
defaultclassifier: Cortex XDR Incident Handler - Classifier CTF
tests:
- No tests (auto formatted)