category: Vulnerability Management
provider: Palo Alto Networks
commonfields:
  id: Cortex Xpanse
  version: -1
sectionorder:
- Connect
- Collect
configuration:
- additionalinfo: The web UI with `api-` appended to front (e.g., https://api-xsiam.paloaltonetworks.com). For more information, see https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis.
  display: Server URL
  name: url
  required: true
  type: 0
  section: Connect
- additionalinfo: For more information, see https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis.  Only standard API key type is supported.
  display: API Key ID
  displaypassword: API Key
  name: credentials
  required: true
  type: 9
  section: Connect
- display: Trust any certificate (not secure)
  name: insecure
  type: 8
  required: false
  section: Connect
- display: Use system proxy settings
  name: proxy
  type: 8
  required: false
  section: Connect
- display: Fetch incidents
  name: isFetch
  type: 8
  required: false
  section: Connect
- defaultvalue: "1"
  display: Incidents Fetch Interval
  name: incidentFetchInterval
  type: 19
  required: false
  section: Collect
- display: Incident type
  name: incidentType
  type: 13
  required: false
  section: Collect
- additionalinfo: The maximum number of alerts per fetch. Cannot exceed 100.
  defaultvalue: '10'
  display: Maximum number of alerts per fetch
  name: max_fetch
  type: 0
  required: false
  section: Collect
- defaultvalue: 7 days
  display: First fetch timestamp (<number> <time unit>, e.g., 12 hours, 7 days)
  name: first_fetch
  type: 0
  required: false
  section: Collect
- additionalinfo: 'The severity of the alerts that will be fetched. If no severity is provided then alerts of all the severities will be fetched. Note: An alert whose status was changed to a filtered status after its creation time will not be fetched.'
  display: Alert Severities to Fetch
  name: severity
  options:
  - low
  - medium
  - high
  - critical
  - informational
  type: 16
  required: false
  section: Collect
- display: Alert Statuses to fetch
  name: status
  type: 16
  required: false
  options:
  - new
  - reopened
  - under_investigation
  - resolved_no_longer_observed
  - resolved_no_risk
  - resolved_risk_accepted
  - resolved_contested_asset
  - resolved_remediated_automatically
  - resolved
  additionalinfo: 'The statuses of the alerts that will be fetched. If no status is provided then alerts of all the statuses will be fetched. Note: An alert whose status was changed to a filtered status after its creation time will not be fetched.'
  section: Collect
- display: Fetch alerts with tags (comma separated string)
  name: tags
  type: 0
  required: false
  additionalinfo: 'The tags of the alerts that will be fetched. If no tags are provided then no tag filtering will be applied on fetched alerts. These should include the tag prefix, ex. AT:Asset Tag.'
  section: Collect
- name: integration_reliability
  display: Source Reliability
  additionalinfo: Reliability of the source providing the intelligence data.
  defaultvalue: A+ - 3rd party enrichment
  options:
  - A+ - 3rd party enrichment
  - A - Completely reliable
  - B - Usually reliable
  - C - Fairly reliable
  - D - Not usually reliable
  - E - Unreliable
  - F - Reliability cannot be judged
  required: false
  type: 15
  section: Collect
- additionalinfo: Maximum amount of search results for listing commands.
  defaultvalue: '100'
  display: Search Limit
  name: search_limit
  required: false
  type: 0
  section: Collect
- defaultvalue: 0
  display: 'Advanced: Minutes to look back when fetching (Warning: exceeding 720 could lead to issues with fetching)'
  additionalinfo: Use this parameter to determine how far back in time to look in the search for incidents that were created before the last run time and did not match the query when they were created.
  name: look_back
  type: 0
  required: false
  section: Collect
description: Integration to pull assets and other ASM related information.
display: Cortex Xpanse
name: Cortex Xpanse
script:
  commands:
  - arguments:
    - description: IP address on which to search.
      name: ip_address
    - description: Domain on which to search.
      name: domain
    - auto: PREDEFINED
      description: Whether the service is active.
      name: is_active
      predefined:
      - "yes"
      - "no"
    - auto: PREDEFINED
      description: How service was discovered.
      name: discovery_type
      predefined:
      - colocated_on_ip
      - directly_discovery
      - unknown
    description: Get a list of all your external services filtered by business units, externally detected providers, domain, externally inferred CVEs, active classifications, inactive classifications, service name, service type, protocol, IP address, is active, and discovery type. Maximum result limit is 100 assets.
    name: asm-list-external-service
    outputs:
    - contextPath: ASM.ExternalService.service_id
      description: External service UUID.
      type: String
    - contextPath: ASM.ExternalService.service_name
      description: Name of the external service.
      type: String
    - contextPath: ASM.ExternalService.service_type
      description: Type of the external service.
      type: String
    - contextPath: ASM.ExternalService.ip_address
      description: IP address of the external service.
      type: String
    - contextPath: ASM.ExternalService.externally_detected_providers
      description: Providers of external service.
      type: String
    - contextPath: ASM.ExternalService.is_active
      description: Whether the external service is active.
      type: String
    - contextPath: ASM.ExternalService.first_observed
      description: Date of the first observation of the external service.
      type: Date
    - contextPath: ASM.ExternalService.last_observed
      description: Date of the last observation of the external service.
      type: Date
    - contextPath: ASM.ExternalService.port
      description: Port number of the external service.
      type: Number
    - contextPath: ASM.ExternalService.protocol
      description: Protocol number of the external service.
      type: String
    - contextPath: ASM.ExternalService.inactive_classifications
      description: External service classifications that are no longer active.
      type: String
    - contextPath: ASM.ExternalService.discovery_type
      description: How the external service was discovered.
      type: String
    - contextPath: ASM.ExternalService.business_units
      description: External service associated business units.
      type: String
    - contextPath: ASM.ExternalService.externally_inferred_vulnerability_score
      description: External service vulnerability score.
      type: Unknown
  - arguments:
    - description: A string representing the service ID you want to get details for.
      name: service_id
      required: true
    description: Get service details according to the service ID.
    name: asm-get-external-service
    outputs:
    - contextPath: ASM.ExternalService.service_id
      description: External service UUID.
      type: String
    - contextPath: ASM.ExternalService.service_name
      description: Name of the external service.
      type: String
    - contextPath: ASM.ExternalService.service_type
      description: Type of the external service.
      type: String
    - contextPath: ASM.ExternalService.ip_address
      description: IP address of the external service.
      type: String
    - contextPath: ASM.ExternalService.externally_detected_providers
      description: Providers of the external service.
      type: String
    - contextPath: ASM.ExternalService.is_active
      description: Whether the external service is active.
      type: String
    - contextPath: ASM.ExternalService.first_observed
      description: Date of the first observation of the external service.
      type: Date
    - contextPath: ASM.ExternalService.last_observed
      description: Date of the last observation of the external service.
      type: Date
    - contextPath: ASM.ExternalService.port
      description: Port number of the external service.
      type: Number
    - contextPath: ASM.ExternalService.protocol
      description: Protocol of the external service.
      type: String
    - contextPath: ASM.ExternalService.inactive_classifications
      description: External service classifications that are no longer active.
      type: String
    - contextPath: ASM.ExternalService.discovery_type
      description: How the external service was discovered.
      type: String
    - contextPath: ASM.ExternalService.business_units
      description: External service associated business units.
      type: String
    - contextPath: ASM.ExternalService.externally_inferred_vulnerability_score
      description: External service vulnerability score.
      type: Unknown
    - contextPath: ASM.ExternalService.details
      description: Additional details.
      type: String
  - arguments: []
    description: Get a list of all your internet exposures filtered by business units and organization handles. Maximum result limit is 100 ranges.
    name: asm-list-external-ip-address-range
    outputs:
    - contextPath: ASM.ExternalIpAddressRange.range_id
      description: External IP address range UUID.
      type: String
    - contextPath: ASM.ExternalIpAddressRange.first_ip
      description: First IP address of the external IP address range.
      type: String
    - contextPath: ASM.ExternalIpAddressRange.last_ip
      description: Last IP address of the external IP address range.
      type: String
    - contextPath: ASM.ExternalIpAddressRange.ips_count
      description: Number of IP addresses of the external IP address range.
      type: Number
    - contextPath: ASM.ExternalIpAddressRange.active_responsive_ips_count
      description: The number of IPs in the external address range that are actively responsive.
      type: Number
    - contextPath: ASM.ExternalIpAddressRange.date_added
      description: Date the external IP address range was added.
      type: Date
    - contextPath: ASM.ExternalIpAddressRange.business_units
      description: External IP address range associated business units.
      type: String
    - contextPath: ASM.ExternalIpAddressRange.organization_handles
      description: External IP address range associated organization handles.
      type: String
  - arguments:
    - description: A string representing the range ID for which you want to get the details.
      name: range_id
      required: true
    description: Get the external IP address range details according to the range IDs.
    name: asm-get-external-ip-address-range
    outputs:
    - contextPath: ASM.ExternalIpAddressRange.range_id
      description: External IP address range UUID.
      type: String
    - contextPath: ASM.ExternalIpAddressRange.first_ip
      description: First IP address of the external IP address range.
      type: String
    - contextPath: ASM.ExternalIpAddressRange.last_ip
      description: Last IP address of the external IP address range.
      type: String
    - contextPath: ASM.ExternalIpAddressRange.ips_count
      description: Number of IP addresses of the external IP address range.
      type: Number
    - contextPath: ASM.ExternalIpAddressRange.active_responsive_ips_count
      description: The number of IPs in the external address range that are actively responsive.
      type: Number
    - contextPath: ASM.ExternalIpAddressRange.date_added
      description: Date the external IP address range was added.
      type: Date
    - contextPath: ASM.ExternalIpAddressRange.business_units
      description: External IP address range associated business units.
      type: String
    - contextPath: ASM.ExternalIpAddressRange.organization_handles
      description: External IP address range associated organization handles.
      type: String
    - contextPath: ASM.ExternalIpAddressRange.details
      description: Additional information.
      type: String
  - arguments:
    - description: IP address on which to search.
      name: ip_address
    - description: Name of the asset on which to search.
      name: name
    - auto: PREDEFINED
      description: Type of the external service.
      name: type
      predefined:
      - certificate
      - cloud_compute_instance
      - on_prem
      - domain
      - unassociated_responsive_ip
    - auto: PREDEFINED
      description: Whether the internet exposure has an active external service.
      name: has_active_external_services
      predefined:
      - "yes"
      - "no"
    - description: Represents the start offset index of results. Default is 0.
      name: search_from
    - description: Represents the end offset index of results.
      name: search_to
    - description: List of asm ids.
      name: asm_id_list
    - description: IPv6 address on which to search.
      name: ipv6_address
    - description: Search based on GCP cloud tags.
      name: gcp_cloud_tags
    - description: Search based on AWS cloud tags.
      name: aws_cloud_tags
    - description: Search based on AZURE cloud tags.
      name: azure_cloud_tags
    - description: Search based on xdr agent.
      name: has_xdr_agent
    - description: Search on externally detected providers.
      name: externally_detected_providers
    - description: Search on externally inferred cve.
      name: externally_inferred_cves
    - description: Search on Business units list.
      name: business_units_list
    - auto: PREDEFINED
      description: Whether it has BU overrides.
      name: has_bu_overrides
      predefined:
      - "True"
      - "False"
    - description: Search based on MAC address.
      name: mac_address
    description: Get a list of all your internet exposures filtered by IP address, domain, type, asm id, IPv6 address, AWS/GCP/Azure tags, has XDR agent, Externally detected providers, Externally inferred cves, Business units list, has BU overrides and/or if there is an active external service. Maximum result limit is 100 assets.
    name: asm-list-asset-internet-exposure
    outputs:
    - contextPath: ASM.AssetInternetExposure.asm_ids
      description: Attack surface management UUID.
      type: String
    - contextPath: ASM.AssetInternetExposure.name
      description: Name of the exposed asset.
      type: String
    - contextPath: ASM.AssetInternetExposure.asset_type
      description: Type of the exposed asset.
      type: String
    - contextPath: ASM.AssetInternetExposure.cloud_provider
      description: The cloud provider used to collect these cloud assets as either GCP, AWS, or Azure.
      type: Unknown
    - contextPath: ASM.AssetInternetExposure.region
      description: Displays the region as provided by the cloud provider.
      type: Unknown
    - contextPath: ASM.AssetInternetExposure.last_observed
      description: Last time the exposure was observed.
      type: Unknown
    - contextPath: ASM.AssetInternetExposure.first_observed
      description: First time the exposure was observed.
      type: Unknown
    - contextPath: ASM.AssetInternetExposure.has_active_externally_services
      description: Whether the internet exposure is associated with an active external service(s).
      type: Boolean
    - contextPath: ASM.AssetInternetExposure.has_xdr_agent
      description: Whether the internet exposure asset has an XDR agent.
      type: String
    - contextPath: ASM.AssetInternetExposure.cloud_id
      description: Displays the resource ID as provided from the cloud provider.
      type: Unknown
    - contextPath: ASM.AssetInternetExposure.domain_resolves
      description: Whether the asset domain is resolvable.
      type: Boolean
    - contextPath: ASM.AssetInternetExposure.operation_system
      description: The operating system reported by the source for this asset.
      type: Unknown
    - contextPath: ASM.AssetInternetExposure.agent_id
      description: The endpoint ID if there is an endpoint installed on this asset.
      type: Unknown
    - contextPath: ASM.AssetInternetExposure.externally_detected_providers
      description: The provider of the asset as determined by an external assessment.
      type: String
    - contextPath: ASM.AssetInternetExposure.service_type
      description: Type of the asset.
      type: String
    - contextPath: ASM.AssetInternetExposure.externally_inferred_cves
      description: If the internet exposure has associated CVEs.
      type: String
    - contextPath: ASM.AssetInternetExposure.ips
      description: IP addresses associated with the internet exposure.
      type: String
  - arguments:
    - description: A string representing the asset ID for which you want to get the details.
      name: asm_id
      required: true
    description: Get internet exposure asset details according to the asset ID.
    name: asm-get-asset-internet-exposure
    outputs:
    - contextPath: ASM.AssetInternetExposure.asm_ids
      description: Attack surface management UUID.
      type: String
    - contextPath: ASM.AssetInternetExposure.name
      description: Name of the exposed asset.
      type: String
    - contextPath: ASM.AssetInternetExposure.type
      description: Type of the exposed asset.
      type: String
    - contextPath: ASM.AssetInternetExposure.last_observed
      description: Last time the exposure was observed.
      type: Unknown
    - contextPath: ASM.AssetInternetExposure.first_observed
      description: First time the exposure was observed.
      type: Unknown
    - contextPath: ASM.AssetInternetExposure.created
      description: Date the ASM issue was created.
      type: Date
    - contextPath: ASM.AssetInternetExposure.business_units
      description: Asset associated business units.
      type: String
    - contextPath: ASM.AssetInternetExposure.domain
      description: Asset associated domain.
      type: Unknown
    - contextPath: ASM.AssetInternetExposure.certificate_issuer
      description: Asset certificate issuer.
      type: String
    - contextPath: ASM.AssetInternetExposure.certificate_algorithm
      description: Asset certificate algorithm.
      type: String
    - contextPath: ASM.AssetInternetExposure.certificate_classifications
      description: Asset certificate.classifications
      type: String
    - contextPath: ASM.AssetInternetExposure.resolves
      description: Whether the asset has a DNS resolution.
      type: Boolean
    - contextPath: ASM.AssetInternetExposure.details
      description: Additional details.
      type: Unknown
    - contextPath: ASM.AssetInternetExposure.externally_inferred_vulnerability_score
      description: Asset vulnerability score.
      type: Unknown
  - arguments:
    - description: Comma-separated list of integers of the alert ID.
      name: alert_id_list
    - description: Comma-separated list of strings of alert severity (valid values are low, medium, high, critical, informational).
      name: severity
    - description: Comma separated list of strings of alert tags. These should include the tag prefix, ex. AT:Asset Tag.
      name: tags
    - description: Comma-separated list of strings of the alert status.
      name: status
      auto: PREDEFINED
      predefined:
      - new
      - reopened
      - under_investigation
      - resolved_no_longer_observed
      - resolved_no_risk
      - resolved_risk_accepted
      - resolved_contested_asset
      - resolved_remediated_automatically
      - resolved
    - description: Comma-separated list of strings of the business units.
      name: business_units_list
    - description: A date in the format 2019-12-31T23:59:00. Only incidents that were created on or before the specified date/time will be retrieved.
      name: lte_creation_time
    - description: A date in the format 2019-12-31T23:59:00. Only incidents that were created on or after the specified date/time will be retrieved.
      name: gte_creation_time
    - description: Comma-separated list of case (incident) IDs.
      name: case_id_list
    - description: Sorts returned incidents by the date/time that the incident was created ("asc" - ascending, "desc" - descending).
      name: sort_by_creation_time
      auto: PREDEFINED
      predefined:
      - asc
      - desc
    - auto: PREDEFINED
      description: Sorts returned incidents by the date/time that the incident was created ("asc" - ascending, "desc" - descending).
      name: sort_by_severity
      predefined:
      - asc
      - desc
    - defaultValue: '0'
      description: Page number (for pagination). The default is 0 (the first page).
      name: page
    - defaultValue: '100'
      description: Maximum number of incidents to return per page. The default and maximum is 100.
      name: limit
    description: Get a list of all your ASM alerts filtered by alert IDs, severity and/or creation time. Can also sort by creation time or severity. Maximum result limit is 100 assets.
    name: asm-list-alerts
    outputs:
    - contextPath: ASM.Alert.alert_id
      description: A unique identifier that Cortex XSIAM assigns to each alert.
      type: String
    - contextPath: ASM.Alert.severity
      description: The severity that was assigned to this alert when it was triggered (Options are Informational, Low, Medium, High, Critical, or Unknown).
      type: String
    - contextPath: ASM.Alert.external_id
      description: The alert ID as recorded in the detector from which this alert was sent.
      type: String
    - contextPath: ASM.Alert.name
      description: Summary of the ASM internet exposure alert.
      type: String
    - contextPath: ASM.Alert.description
      description: More detailed explanation of internet exposure alert.
      type: String
    - contextPath: ASM.Alert.host_name
      description: The hostname of the endpoint or server on which this alert triggered.
      type: String
    - contextPath: ASM.Alert.dynamic_fields
      description: Alert fields pulled from Cortex XSOAR context.
      type: Unknown
    - contextPath: ASM.Alert.events
      description: Individual events that comprise the alert.
      type: Unknown
    - contextPath: ASM.Alert.detection_timestamp
      description: Date the alert was created.
      type: Date
  - name: asm-get-attack-surface-rule
    arguments:
    - name: enabled_status
      auto: PREDEFINED
      predefined:
      - "On"
      - "Off"
      description: Enablement status to search rules with.
    - name: category
      description: Comma separated list of strings attack surface rule categories.
    - name: priority
      description: Comma separated list of strings attack surface rule priorities. Options include Low, Medium, High, and Critical.
    - name: attack_surface_rule_id
      description: Comma-separated list of strings attack surface rule IDs.
    - name: limit
      description: Maximum number of results to return.
    outputs:
    - contextPath: ASM.AttackSurfaceRules.priority
      description: Priority level for the different rules. Low, Medium, High, Critical.
    - contextPath: ASM.AttackSurfaceRules.attack_surface_rule_name
      description: Name of the attack surface rule.
    - contextPath: ASM.AttackSurfaceRules.attack_surface_rule_id
      description: ID of the attack surface rule.
    - contextPath: ASM.AttackSurfaceRules.description
      description: Description of the attack surface rule.
    - contextPath: ASM.AttackSurfaceRules.category
      description: Category of the attack surface rule.
    - contextPath: ASM.AttackSurfaceRules.remediation_guidance
      description: Guidance for how to address various ASM risks.
    - contextPath: ASM.AttackSurfaceRules.enabled_status
      description: Enablement status of the attack surface rule.
    - contextPath: ASM.AttackSurfaceRules.created
      description: Creation date of the attack surface rule.
    - contextPath: ASM.AttackSurfaceRules.modified
      description: Last modification of the attack surface rule.
    description: Fetches attack surface rules related to how Cortex Xpanse does assessment.
  - name: asm-tag-asset-assign
    arguments:
    - name: asm_id_list
      required: true
      description: Comma-separated list of asset IDs to add tags to.
    - name: tags
      required: true
      description: The name of the tags to apply to supplied assets.
    description: Assigns tags to a list of assets.
  - name: asm-add-note-to-asset
    arguments:
    - name: asset_id
      description: The asset ID to add a note to.
      required: true
    - name: entity_type
      description: "The type of Xpanse asset. Allowed values are: 'asset' or 'ip_range'."
      auto: PREDEFINED
      predefined:
      - ip_range
      - asset
      required: true
    - name: note_to_add
      required: true
      description: The custom note to be added to the notes section of the asset in Cortex Xpanse.
    - name: should_append
      required: false
      auto: PREDEFINED
      predefined:
      - 'True'
      - 'False'
      defaultValue: true
      description: Set to 'false' to overwrite the current note on the asset. Set to 'true' to append to the current note.
    description: Adds a note to an asset in Xpanse.
    outputs:
    - contextPath: ASM.AssetAnnotation.status
      description: Status of the note being added to the asset in Cortex Xpanse.
      type: String
  - name: asm-tag-asset-remove
    arguments:
    - name: asm_id_list
      description: Comma-separated list of asset IDs to remove tags from.
    - name: tags
      description: The name of the tags to remove from supplied assets.
    description: Removes tags from a list of assets.
  - name: asm-tag-range-assign
    arguments:
    - name: range_id_list
      description: Comma-separated list of range IDs to add tags to.
    - name: tags
      description: The name of the tags to apply to supplied assets.
    description: Assigns tags to a list of IP ranges.
  - name: asm-tag-range-remove
    arguments:
    - name: range_id_list
      description: 'Comma-separated list of range IDs to remove tags from.'
    - name: tags
      description: The name of the tags to remove from supplied IP ranges.
    description: Removes tags from a list of IP ranges.
  - name: asm-list-incidents
    arguments:
    - name: incident_id_list
      description: 'Incident IDs to filter on. Note: Incident IDs may also be references as "Case IDs'' elsewhere in the API.'
    - name: description
      description: String to search for within the incident description field.
    - name: status
      description: Status to search incidents for.
      auto: PREDEFINED
      predefined:
      - new
      - under_investigation
      - resolved
    - name: lte_creation_time
      description: A date in the format 2019-12-31T23:59:00. Only incidents that were created on or before the specified date/time will be retrieved.
    - name: gte_creation_time
      description: A date in the format 2019-12-31T23:59:00. Only incidents that were created on or after the specified date/time will be retrieved.
    - name: sort_by_creation_time
      description: Sorts returned incidents by the date/time that the incident was created ("asc" - ascending, "desc" - descending).
    - name: sort_by_severity
      description: Sorts returned incidents by the severity of the incident.
    - name: page
      description: Page number (for pagination). The default is 0 (the first page).
    - name: limit
      description: Maximum number of incidents to return per page. The default and maximum is 100.
    outputs:
    - contextPath: ASM.Incident.alert_count
      description: Number of alerts included in the incident.
      type: Number
    - contextPath: ASM.Incident.alerts_grouping_status
      description: Whether alert grouping is enabled.
      type: String
    - contextPath: ASM.Incident.assigned_user_mail
      description: Email of the assigned user.
      type: Unknown
    - contextPath: ASM.Incident.assigned_user_pretty_name
      description: Friendly name of the assigned user.
      type: Unknown
    - contextPath: ASM.Incident.creation_time
      description: Creation timestamp.
      type: Date
    - contextPath: ASM.Incident.critical_severity_alert_count
      description: Number of critical alerts.
      type: Number
    - contextPath: ASM.Incident.description
      description: Description of the incident.
      type: String
    - contextPath: ASM.Incident.high_severity_alert_count
      description: Number of high alerts.
      type: Number
    - contextPath: ASM.Incident.incident_id
      description: ID of the incident.
      type: String
    - contextPath: ASM.Incident.incident_name
      description: Incident name.
      type: Unknown
    - contextPath: ASM.Incident.incident_sources
      description: Incident source.
      type: String
    - contextPath: ASM.Incident.low_severity_alert_count
      description: Number of low alerts.
      type: Number
    - contextPath: ASM.Incident.manual_severity
      description: Severity override.
      type: Unknown
    - contextPath: ASM.Incident.med_severity_alert_count
      description: Number of medium alerts.
      type: Number
    - contextPath: ASM.Incident.modification_time
      description: Modification timestamp.
      type: Date
    - contextPath: ASM.Incident.notes
      description: Incident notes.
      type: Unknown
    - contextPath: ASM.Incident.original_tags
      description: Tags on the incident at creation time.
      type: Unknown
    - contextPath: ASM.Incident.resolve_comment
      description: Resolution comment (optional).
      type: Unknown
    - contextPath: ASM.Incident.resolved_timestamp
      description: Resolution timestamp.
      type: Unknown
    - contextPath: ASM.Incident.severity
      description: Severity of the incident.
      type: String
    - contextPath: ASM.Incident.starred
      description: Whether the incident has been starred.
      type: Boolean
    - contextPath: ASM.Incident.status
      description: Status of the incident.
      type: String
    - contextPath: ASM.Incident.tags
      description: Tags on the incident.
      type: String
    - contextPath: ASM.Incident.xdr_url
      description: Link to navigate to the incident.
      type: String
    - contextPath: ASM.Incident.xpanse_risk_score
      description: Risk score of the incident.
      type: Unknown
    description: 'Fetches ASM incidents that match provided filters. Incidents are an aggregation of related alerts. Note: Incident IDs may also be references as "Case IDs'' elsewhere in the API.'
  - name: asm-update-incident
    arguments:
    - name: incident_id
      description: ID of the incident to modify.
      required: true
    - name: alert_id
      description: Used for scoping updates such as comments to the alert level.
    - name: assigned_user_mail
      description: Email address of the user to assign incident to. This user must exist within your Expander instance.
    - name: manual_severity
      description: Administrator-defined severity for the incident.
      auto: PREDEFINED
      predefined:
      - Low
      - Medium
      - High
      - Critical
    - name: status
      auto: PREDEFINED
      predefined:
      - new
      - under_investigation
      - resolved
      description: Incident status.
    - name: resolve_comment
      description: Optional resolution comment when resolving the incident.
    - name: comment
      description: A comment to add to the incident. If an alert_id is supplied it will be prefixed to the comment.
    outputs:
    - contextPath: ASM.IncidentUpdate
      description: Whether the incident update was successful.
    description: Updates a given incident. Can be used to modify the status, severity, assignee, or add comments.
  - name: asm-update-alerts
    arguments:
    - name: alert_id_list
      description: Comma-separated list of integers of the alert ID.
    - name: status
      auto: PREDEFINED
      predefined:
      - new
      - reopened
      - under_investigation
      - resolved
      - resolved_contested_asset
      - resolved_risk_accepted
      - resolved_no_risk
      - resolved_remediated_automatically
      description: Updated alert status.
    - name: severity
      auto: PREDEFINED
      predefined:
      - low
      - medium
      - high
      - critical
      description: The severity of the alert.
    - name: resolution_comment
      description: Descriptive comment explaining the alert change.
    outputs:
    - contextPath: ASM.UpdatedAlerts
      description: IDs of the updated alerts.
    description: Updates the state of one or more alerts.
  - name: ip
    arguments:
    - name: ip
      description: IP address to enrich.
      required: true
      isArray: true
      default: true
    outputs:
    - contextPath: ASM.IP.ip
      description: The IP address of the asset.
      type: string
    - contextPath: ASM.IP.domain
      description: The domain affiliated with an asset.
      type: string
    - contextPath: ASM.IP.name
      description: The asset name.
      type: string
    - contextPath: ASM.IP.asset_type
      description: The asset type.
      type: string
    - contextPath: ASM.IP.first_observed
      description: When the asset was first observed.
    - contextPath: ASM.IP.last_observed
      description: When the asset was last observed.
    - contextPath: ASM.IP.asm_ids
      description: The ID of the asset.
    - contextPath: ASM.IP.service_type
      description: Affiliated service types for the asset.
    - contextPath: ASM.IP.tags
      description: A list of tags that have been assigned to the asset.
    - contextPath: ASM.IP.asset_explainers
      description: The asset explanation details.
    - contextPath: ASM.IP.domain_details
      description: Additional domain details.
    - contextPath: ASM.IP.recent_ips
      description: Details about the recent IP observations.
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: The reliability of the source providing the intelligence data.
      type: String
    - contextPath: IP.Address
      description: IP address.
      type: String
    - contextPath: ASM.TIM.IP.name
      description: The existing Cortex Xpanse IP address recently updated in the Cortex XSOAR indicators.
      type: String
    - contextPath: ASM.TIM.IP.indicator_type
      description: The existing Cortex Xpanse indicator type in the Cortex XSOAR indicators.
      type: String
    - contextPath: ASM.TIM.IP.id
      description: The existing indicator ID in the Cortex XSOAR indicators.
      type: String
    - contextPath: ASM.TIM.IP.reliability
      description: The existing indicator reliability recently updated in the Cortex XSOAR indicators.
      type: String
    - contextPath: ASM.TIM.IP.score
      description: The existing indicator score recently updated in the Cortex XSOAR indicators.
      type: Number
    description: (Deprecated) Returns enrichment for an IP address.
    deprecated: true
  - name: domain
    arguments:
    - name: domain
      required: true
      description: Domain to enrich.
      isArray: true
      default: true
    outputs:
    - contextPath: ASM.Domain.domain
      description: The domain affiliated with an asset.
      type: string
    - contextPath: ASM.Domain.name
      description: The asset name.
      type: string
    - contextPath: ASM.Domain.asset_type
      description: The asset type.
      type: string
    - contextPath: ASM.Domain.first_observed
      description: When the asset was first observed.
    - contextPath: ASM.Domain.last_observed
      description: When the asset was last observed.
    - contextPath: ASM.Domain.asm_ids
      description: The ID of the asset.
    - contextPath: ASM.Domain.service_type
      description: Affiliated service types for the asset.
    - contextPath: ASM.Domain.tags
      description: A list of tags that have been assigned to the asset.
    - contextPath: ASM.Domain.asset_explainers
      description: The asset explanation details.
    - contextPath: ASM.Domain.domain_details
      description: Additional domain details.
    - contextPath: ASM.Domain.recent_ips
      description: Details about the recent IP observations.
    - contextPath: DBotScore.Indicator
      description: The indicator that was tested.
      type: String
    - contextPath: DBotScore.Type
      description: The indicator type.
      type: String
    - contextPath: DBotScore.Vendor
      description: The vendor used to calculate the score.
      type: String
    - contextPath: DBotScore.Score
      description: The actual score.
      type: Number
    - contextPath: DBotScore.Reliability
      description: The reliability of the source providing the intelligence data.
      type: String
    - contextPath: Domain.Name
      description: 'The domain name, for example: "google.com".'
      type: String
    - contextPath: ASM.TIM.Domain.name
      description: The existing Cortex Xpanse domain recently updated in XSOAR indicators.
      type: String
    - contextPath: ASM.TIM.Domain.indicator_type
      description: The existing Cortex Xpanse indicator type in the Cortex XSOAR indicators.
      type: String
    - contextPath: ASM.TIM.Domain.id
      description: The existing indicator ID in the Cortex XSOAR indicators.
      type: String
    - contextPath: ASM.TIM.Domain.reliability
      description: The existing indicator reliability recently updated in the Cortex XSOAR indicators.
      type: String
    - contextPath: ASM.TIM.Domain.score
      description: The existing indicator score recently updated in the Cortex XSOAR indicators.
      type: Number
    description: (Deprecated) Returns enrichment for a domain.
    deprecated: true
  - name: asm-get-incident
    arguments:
    - name: incident_id
      description: The ID of the incident to be fetched.
      required: true
    outputs:
    - contextPath: ASM.Incident.incident_id
      description: The ID of the incident.
      type: string
    - contextPath: ASM.Incident.xpanse_risk_score
      description: The Xpanse risk score of the incident.
      type: number
    - contextPath: ASM.Incident.alerts
      description: The alerts included in the incident.
    - contextPath: ASM.Incident.tags
      description: Tags assigned to assets included in the incident.
    - contextPath: ASM.Incident.status
      description: The status of the incident.
      type: string
    - contextPath: ASM.Incident.severity
      description: The severity of the incident.
      type: string
    - contextPath: ASM.Incident.description
      description: A brief description of the incident.
      type: string
    - contextPath: ASM.Incident.notes
      description: User-provided notes related to the incident.
      type: string
    description: Returns additional details about a specific incident.
  - name: asm-list-external-websites
    arguments:
    - name: authentication
      description: Authentication type string on which to search.
    - name: limit
      description: Maximum number of assets to return. The maximum value is 100.
      defaultValue: "100"
    - name: use_page_token
      auto: PREDEFINED
      predefined:
      - "true"
      - "false"
      description: Whether to paginate the response data.  Set to true to paginate and receive a token indicating the location of the next page.
    - name: next_page_token
      description: A string representing the next page location when pagination is used.
    outputs:
    - contextPath: ASM.ExternalWebsite
      description: A list of the websites results assets.
    - contextPath: ASM.ExternalWebsiteReply
      description: Contextual information about the request including total count, result count, and next page token.
    - contextPath: ASM.ExternalWebsiteReply.NextPageToken
      description: The next page token for the request (for pagination).
    description: Get external websites assets.
  - name: asm-reset-last-run
    arguments: []
    description: Resets the fetch incidents last run value, which resets the fetch to its initial fetch state.
  dockerimage: demisto/python3:3.12.13.10116658
  isFetchSamples: true
  isfetch: true
  script: ''
  subtype: python3
  type: python
defaultmapperin: Xpanse - Incoming Mapper
defaultclassifier: Xpanse - Classifier
fromversion: 6.5.0
tests:
- CortexXpanse_Test