id: Cortex XDR disconnected endpoints version: -1 contentitemexportablefields: contentitemfields: {} name: Cortex XDR disconnected endpoints description: | A Job to periodically query disconnected Cortex XDR endpoints with a provided last seen time range playbook input. The Collected data, if found will be generated to a CSV report, including a detailed list of the disconnected endpoints. The report will be sent to the recipient's provided email addresses in the playbook input. The playbook includes an incident type with a dedicated layout to visualize the collected data. To set the job correctly, you will need to. 1. Create a new recurring job. 2. Set the recurring schedule. 3. Add a name. 4. Set type to Cortex XDR disconnected endpoints. 5. Set this playbook as the job playbook. https://xsoar.pan.dev/docs/incidents/incident-jobs The scheduled run time and the timestamp relative date should be identical, If the job is recurring every 7 days, the time range should be 7 days as well. starttaskid: "0" tasks: "0": id: "0" taskid: a7e4284c-c498-4306-8cfd-89a9072a8cd8 type: start task: id: a7e4284c-c498-4306-8cfd-89a9072a8cd8 version: -1 name: "" iscommand: false brand: "" description: '' nexttasks: '#none#': - "12" separatecontext: false view: |- { "position": { "x": 50, "y": 50 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "2": id: "2" taskid: 12957918-32bb-4c3b-8cdc-4b149812f2f7 type: regular task: id: 12957918-32bb-4c3b-8cdc-4b149812f2f7 version: -1 name: Generate a CSV report for disconnected XDR endpoints description: Export the given array to a CSV file. tags: - Endpoint report type: regular iscommand: false brand: "" script: ExportToCSV nexttasks: '#none#': - "9" scriptarguments: csvArray: complex: root: PaloAltoNetworksXDR.Endpoint filters: - - operator: isEqualString left: value: simple: PaloAltoNetworksXDR.Endpoint.endpoint_status iscontext: true right: value: simple: LOST - operator: isEqualString left: value: simple: PaloAltoNetworksXDR.Endpoint.endpoint_status iscontext: true right: value: simple: DISCONNECTED fileName: simple: Disconnected XDR endpoints - ${incident.created}.csv separatecontext: false view: |- { "position": { "x": 162.5, "y": 545 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "3": id: "3" taskid: 7b27a983-42e1-408d-8c6f-2c672b3f353f type: regular task: id: 7b27a983-42e1-408d-8c6f-2c672b3f353f version: -1 name: Mail disconnected endpoints report description: Sends an mail using Gmail/EWS. script: '|||send-mail' type: regular iscommand: true brand: "" nexttasks: '#none#': - "6" scriptarguments: attachIDs: complex: root: File accessor: EntryID htmlBody: complex: root: inputs.MessageBody subject: simple: Cortex XDR Disconnected Endpoints to: complex: root: inputs.Email separatecontext: false view: |- { "position": { "x": 50, "y": 895 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "4": id: "4" taskid: 6daa6400-3c03-4285-8c7a-672e14d9bf8c type: title task: id: 6daa6400-3c03-4285-8c7a-672e14d9bf8c version: -1 name: Done type: title iscommand: false brand: "" description: '' separatecontext: false view: |- { "position": { "x": 50, "y": 1770 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "5": id: "5" taskid: fa23f54f-4e1c-44dd-8ad7-d5c1ae59b2ca type: condition task: id: fa23f54f-4e1c-44dd-8ad7-d5c1ae59b2ca version: -1 name: Disconnected endpoints found? description: '''''' type: condition iscommand: false brand: "" nexttasks: '#default#': - "10" "yes": - "2" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: simple: PaloAltoNetworksXDR.Endpoint iscontext: true - - operator: isEqualString left: value: simple: PaloAltoNetworksXDR.Endpoint.endpoint_status iscontext: true right: value: simple: LOST - operator: isEqualString left: value: simple: PaloAltoNetworksXDR.Endpoint.endpoint_status iscontext: true right: value: simple: DISCONNECTED view: |- { "position": { "x": 50, "y": 370 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "6": id: "6" taskid: 004b7e07-9e8a-4ec3-8c63-a02e05bab64e type: regular task: id: 004b7e07-9e8a-4ec3-8c63-a02e05bab64e version: -1 name: Count involved users and hosts description: Count the users and hosts involved in the incidents and insert the amount in the incident field, script: Builtin|||setIncident type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "8" scriptarguments: xdrhostcount: complex: root: PaloAltoNetworksXDR.Endpoint filters: - - operator: isEqualString left: value: simple: PaloAltoNetworksXDR.Endpoint.endpoint_status iscontext: true right: value: simple: LOST - operator: isEqualString left: value: simple: PaloAltoNetworksXDR.Endpoint.endpoint_status iscontext: true right: value: simple: DISCONNECTED accessor: host_name transformers: - operator: count xdrusercount: complex: root: PaloAltoNetworksXDR.Endpoint filters: - - operator: isEqualString left: value: simple: PaloAltoNetworksXDR.Endpoint.endpoint_status iscontext: true right: value: simple: LOST - operator: isEqualString left: value: simple: PaloAltoNetworksXDR.Endpoint.endpoint_status iscontext: true right: value: simple: DISCONNECTED accessor: users transformers: - operator: count separatecontext: false view: |- { "position": { "x": 162.5, "y": 1070 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "7": id: "7" taskid: db61aeaf-0ea6-4a74-88e1-67d2909483d2 type: regular task: id: db61aeaf-0ea6-4a74-88e1-67d2909483d2 version: -1 name: Set endpoints grid description: Creates a grid table from items or key-value pairs. type: regular iscommand: false brand: "" script: SetGridField nexttasks: '#none#': - "10" scriptarguments: columns: simple: Endpoint Name,Endpoint Status,Endpoint OS,Endpoint ID,Endpoint Last Seen context_path: simple: XDR.DisconnectedEndpoints grid_id: simple: xdrdisconnectedendpoints keys: simple: host_name,endpoint_status,agent_type,endpoint_id,last_seen separatecontext: false view: |- { "position": { "x": 162.5, "y": 1420 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "8": id: "8" taskid: 6efdd411-a1da-45eb-8e58-49fbe793acd3 type: regular task: id: 6efdd411-a1da-45eb-8e58-49fbe793acd3 version: -1 name: Set disconnected endpoints description: |- Set a value in context under the key you entered. If no value is entered, the script doesn't do anything. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/6.13/Cortex-XSOAR-Administrator-Guide/Automations type: regular iscommand: false brand: "" script: SetAndHandleEmpty nexttasks: '#none#': - "7" scriptarguments: key: simple: XDR.DisconnectedEndpoints value: complex: root: PaloAltoNetworksXDR.Endpoint filters: - - operator: isEqualString left: value: simple: PaloAltoNetworksXDR.Endpoint.endpoint_status iscontext: true right: value: simple: LOST - operator: isEqualString left: value: simple: PaloAltoNetworksXDR.Endpoint.endpoint_status iscontext: true right: value: simple: DISCONNECTED separatecontext: false view: |- { "position": { "x": 162.5, "y": 1245 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "9": id: "9" taskid: 64c667fe-c0c9-45e5-8a98-36853b612485 type: condition task: id: 64c667fe-c0c9-45e5-8a98-36853b612485 version: -1 name: Email report? description: '''''' type: condition iscommand: false brand: "" nexttasks: '#default#': - "6" "yes": - "3" separatecontext: false conditions: - label: "yes" condition: - - operator: isNotEmpty left: value: complex: root: inputs.Email iscontext: true view: |- { "position": { "x": 162.5, "y": 720 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "10": id: "10" taskid: 531e649f-d89d-4269-8cbd-e1e041e272f9 type: regular task: id: 531e649f-d89d-4269-8cbd-e1e041e272f9 version: -1 name: Close job description: commands.local.cmd.close.inv script: Builtin|||closeInvestigation type: regular iscommand: true brand: Builtin nexttasks: '#none#': - "4" separatecontext: false view: |- { "position": { "x": 50, "y": 1595 } } note: false timertriggers: [] ignoreworker: false skipunavailable: false quietmode: 0 isoversize: false isautoswitchedtoquietmode: false continueonerrortype: "" "12": continueonerrortype: "" id: "12" ignoreworker: false isautoswitchedtoquietmode: false isoversize: false nexttasks: '#none#': - "5" note: false quietmode: 0 scriptarguments: all_results: simple: "false" last_seen_gte: complex: filters: - - left: iscontext: true value: simple: inputs.LastSeenStartDate operator: isNotEmpty root: inputs.LastSeenStartDate last_seen_lte: complex: filters: - - left: iscontext: true value: simple: inputs.LastSeenEndDate operator: isNotEmpty root: inputs.LastSeenEndDate status: simple: disconnected,lost use_hr_timestamps: simple: "true" separatecontext: false skipunavailable: false task: brand: "" description: Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoints from the start of the result set. (Start by counting from 0). id: 731a66f9-21d4-472a-8924-abf1fc7bf686 iscommand: true name: Get XDR disconnected endpoints script: '|||xdr-get-endpoints' type: regular version: -1 taskid: 731a66f9-21d4-472a-8924-abf1fc7bf686 timertriggers: [] type: regular view: |- { "position": { "x": 50, "y": 195 } } view: |- { "linkLabelsPosition": { "5_10_#default#": 0.1, "5_2_yes": 0.62, "9_6_#default#": 0.21 }, "paper": { "dimensions": { "height": 1785, "width": 492.5, "x": 50, "y": 50 } } } inputs: - key: LastSeenStartDate value: {} required: false description: 'Last seen start date, in relative timestamp - "1 Day" or "7 days" ' playbookInputQuery: - key: LastSeenEndDate value: {} required: false description: "Last seen end date, in relative timestamp - \"1 Day\" or \"7 days\" \nFor the current day use \"0 days\"" playbookInputQuery: - key: Email value: {} required: false description: Email addresses to send the disconnected endpoints report. playbookInputQuery: - key: MessageBody value: simple: |- This message contains an automatically generated report by Cortex XSOAR, including a list of disconnected Cortex XDR endpoints. Please investigate and remediate according to the organization's policy. required: false description: 'Body for the report email message. ' playbookInputQuery: outputs: [] tests: - Test XDR Playbook general commands - Test XDR Playbook fromversion: 5.5.0 inputSections: - description: Generic group for inputs. inputs: - LastSeenStartDate - LastSeenEndDate - Email - MessageBody name: General (Inputs group) outputSections: - description: Generic group for outputs. name: General (Outputs group) outputs: []