f3nris/riposte-marketplace
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat(cortex-xdr): incident write-back and external alert push

Browse Source 
Add three commands to the Cortex XDR integration (v1.2.0):
- update_incident: change status, severity, assignment and resolve
  comment on an incident (closes the SOAR ingest→action loop).
- insert_parsed_alerts: push external parsed alerts into Cortex XDR.
- insert_cef_alerts: push external CEF-format alerts.

Scripts follow the existing self-contained standard/advanced auth pattern.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
2026-06-29 22:32:47 +02:00
parent b99de4af19
commit 0263619e30
4 changed files with 190 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
integrations/cortex-xdr/manifest.yaml
+33 -3
View File
@@ -1,8 +1,8 @@
id: cortex_xdr
name: Cortex XDR
version: 1.1.0
description: "Palo Alto Cortex XDR (public API v1) — incident ingestion, endpoint isolation/scan/delete/tagging, RTR scripts, hash block/allow lists, file quarantine/restore/retrieval, alert exclusions, device-control violations, audits, distributions and RBAC/risk."
changelog: "1.1.0 — Full command coverage: added delete/alias/tag endpoints, abort scan, original alerts, script metadata/code/snippet/exec-status, file retrieval (+details), alert exclusions, device-control violations, audits, distribution url/status/create and RBAC (users, roles, groups, risk score, risky users/hosts). 1.0.0 — Initial release: incident ingestion (get_incidents) with OCSF mapper, endpoints, isolate/unisolate, scan, hash blocklist/allowlist, quarantine/restore, run script + results, alerts retrieval, distributions and action status. Standard or Advanced API authentication."
version: 1.2.0
description: "Palo Alto Cortex XDR (public API v1) — incident ingestion + write-back, endpoint isolation/scan/delete/tagging, RTR scripts, hash block/allow lists, file quarantine/restore/retrieval, alert exclusions, external alert push (parsed/CEF), device-control violations, audits, distributions and RBAC/risk."
changelog: "1.2.0 — Incident write-back (update_incident: status/severity/assignment/resolve comment) and external alert push (insert_parsed_alerts, insert_cef_alerts). 1.1.0 — Full command coverage: added delete/alias/tag endpoints, abort scan, original alerts, script metadata/code/snippet/exec-status, file retrieval (+details), alert exclusions, device-control violations, audits, distribution url/status/create and RBAC (users, roles, groups, risk score, risky users/hosts). 1.0.0 — Initial release: incident ingestion (get_incidents) with OCSF mapper, endpoints, isolate/unisolate, scan, hash blocklist/allowlist, quarantine/restore, run script + results, alerts retrieval, distributions and action status. Standard or Advanced API authentication."
category: endpoint
# Per-instance configuration. The base URL is the tenant API root, e.g.
@@ -67,6 +67,20 @@ commands:
alerts_limit: { type: number, description: "Max alerts to return (default 1000)" }
required: [incident_id]
outputs_schema: { properties: {} }
- id: update_incident
name: cortex-xdr-update-incident
description: "Update an incident's status, severity, assignment and resolve comment (write-back / close the loop)."
inputs_schema:
properties:
incident_id: { type: string, description: "Incident ID to update" }
status: { type: string, description: "New status (new, under_investigation, resolved_threat_handled, resolved_known_issue, resolved_duplicate, resolved_false_positive, resolved_true_positive, resolved_security_testing, resolved_auto)" }
manual_severity: { type: string, description: "Override severity (low, medium, high, critical)" }
assigned_user_mail: { type: string, description: "Assignee email" }
assigned_user_pretty_name: { type: string, description: "Assignee display name" }
unassign: { type: boolean, description: "Clear the assignment when true" }
resolve_comment: { type: string, description: "Resolution comment (shown when resolving)" }
required: [incident_id]
outputs_schema: { properties: {} }
- id: get_alerts
name: cortex-xdr-get-alerts
description: "Retrieve alerts using a custom filter (get_alerts_by_filter_data). Returns rich alert objects."
@@ -78,6 +92,22 @@ commands:
limit: { type: number, description: "Maximum alerts to fetch (default 100)" }
required: []
outputs_schema: { properties: {} }
- id: insert_parsed_alerts
name: cortex-xdr-insert-parsed-alerts
description: "Push external alerts (parsed JSON objects) into Cortex XDR for correlation."
inputs_schema:
properties:
alerts: { type: string, description: "JSON array of parsed alert objects (each with product, vendor, severity, alert_name, etc.)" }
required: [alerts]
outputs_schema: { properties: {} }
- id: insert_cef_alerts
name: cortex-xdr-insert-cef-alerts
description: "Push external alerts in CEF format into Cortex XDR for correlation."
inputs_schema:
properties:
alerts: { type: string, description: "CEF alert lines: a JSON array of CEF strings, or newline-separated CEF lines" }
required: [alerts]
outputs_schema: { properties: {} }
# ── Endpoints ─────────────────────────────────────────────────────────────
- id: get_endpoints