feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This commit is contained in:
Guillaume BOURGEOIS
@@ -0,0 +1,270 @@
|
||||
id: cortex_xdr
|
||||
name: Cortex XDR
|
||||
version: 1.0.0
|
||||
description: "Palo Alto Cortex XDR (public API v1) — incident ingestion, endpoint isolation, RTR scripts, hash block/allow lists, file quarantine/restore, scans and alert retrieval."
|
||||
changelog: "1.0.0 — Initial release: incident ingestion (get_incidents) with OCSF mapper, endpoints, isolate/unisolate, scan, hash blocklist/allowlist, quarantine/restore, run script + results, alerts retrieval, distributions and action status. Standard or Advanced API authentication."
|
||||
category: endpoint
|
||||
|
||||
# Per-instance configuration. The base URL is the tenant API root, e.g.
|
||||
# https://api-yourtenant.xdr.eu.paloaltonetworks.com (scripts append /public_api/v1).
|
||||
config_schema:
|
||||
properties:
|
||||
url:
|
||||
type: string
|
||||
description: "Cortex XDR API base URL, e.g. https://api-<tenant>.xdr.<region>.paloaltonetworks.com"
|
||||
api_key_id:
|
||||
type: string
|
||||
description: "API Key ID (the integer ID shown next to the API key in Settings → API Keys)"
|
||||
api_key:
|
||||
type: string
|
||||
description: "API Key secret"
|
||||
x-soar-sensitive: true
|
||||
auth_type:
|
||||
type: string
|
||||
description: "Authentication method: standard (key sent as-is) or advanced (nonce + timestamp SHA-256 hash)"
|
||||
default: standard
|
||||
required:
|
||||
- url
|
||||
- api_key_id
|
||||
- api_key
|
||||
|
||||
# Documented for reference; the bundled scripts build the headers themselves.
|
||||
# Standard: x-xdr-auth-id: <id>, Authorization: <api_key>
|
||||
# Advanced: x-xdr-auth-id: <id>, x-xdr-nonce, x-xdr-timestamp,
|
||||
# Authorization: sha256(api_key + nonce + timestamp)
|
||||
auth:
|
||||
- id: apikey
|
||||
type: api_key
|
||||
in: header
|
||||
name: Authorization
|
||||
value_template: "{{secret}}"
|
||||
secret_field: api_key
|
||||
|
||||
commands:
|
||||
# ── Ingestion ─────────────────────────────────────────────────────────────
|
||||
- id: get_incidents
|
||||
name: cortex-xdr-get-incidents
|
||||
description: "Fetch Cortex XDR incidents for ingestion. Returns {reply:{incidents:[...]}}; use reply.incidents as the alert rule results path."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
status: { type: string, description: "Filter by status (e.g. new, under_investigation, resolved_threat_handled)" }
|
||||
created_after: { type: string, description: "Lower bound on creation_time, ISO8601 or epoch ms (incremental fetch watermark)" }
|
||||
limit: { type: number, description: "Maximum incidents to fetch (default 100)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
ingest:
|
||||
results_path: reply.incidents
|
||||
dedup_key: incident_id
|
||||
incremental_field: created_after
|
||||
- id: get_incident_extra_data
|
||||
name: cortex-xdr-get-incident-extra-data
|
||||
description: "Get full incident data including its alerts and network artifacts by incident ID."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
incident_id: { type: string, description: "Incident ID" }
|
||||
alerts_limit: { type: number, description: "Max alerts to return (default 1000)" }
|
||||
required: [incident_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_alerts
|
||||
name: cortex-xdr-get-alerts
|
||||
description: "Retrieve alerts using a custom filter (get_alerts_by_filter_data). Returns rich alert objects."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
severity: { type: string, description: "Comma-separated severities (low, medium, high, critical)" }
|
||||
created_after: { type: string, description: "Lower bound on alert source_insert_ts, epoch ms" }
|
||||
limit: { type: number, description: "Maximum alerts to fetch (default 100)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── Endpoints ─────────────────────────────────────────────────────────────
|
||||
- id: get_endpoints
|
||||
name: cortex-xdr-get-endpoints
|
||||
description: "List/search endpoints by hostname, IP, status, platform, group, etc."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
hostname: { type: string, description: "Hostname to filter by" }
|
||||
ip_list: { type: string, description: "Comma-separated IPs" }
|
||||
status: { type: string, description: "Endpoint status (connected, disconnected, ...)" }
|
||||
platform: { type: string, description: "OS platform (windows, linux, macos, android)" }
|
||||
limit: { type: number, description: "Max endpoints (default 30)" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: isolate_endpoint
|
||||
name: cortex-xdr-isolate-endpoint
|
||||
description: "Network-isolate an endpoint by endpoint (agent) ID."
|
||||
inputs_schema:
|
||||
properties:
|
||||
endpoint_id: { type: string, description: "Endpoint (agent) ID to isolate" }
|
||||
incident_id: { type: string, description: "Optional incident ID to associate the action with" }
|
||||
required: [endpoint_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: unisolate_endpoint
|
||||
name: cortex-xdr-unisolate-endpoint
|
||||
description: "Remove network isolation from an endpoint by endpoint (agent) ID."
|
||||
inputs_schema:
|
||||
properties:
|
||||
endpoint_id: { type: string, description: "Endpoint (agent) ID to unisolate" }
|
||||
incident_id: { type: string, description: "Optional incident ID to associate the action with" }
|
||||
required: [endpoint_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: scan_endpoints
|
||||
name: cortex-xdr-scan-endpoints
|
||||
description: "Trigger a malware scan on endpoints matching the given filters (or all)."
|
||||
inputs_schema:
|
||||
properties:
|
||||
endpoint_id_list: { type: string, description: "Comma-separated endpoint IDs (omit + use all=true to scan all)" }
|
||||
hostname: { type: string, description: "Comma-separated hostnames" }
|
||||
all: { type: boolean, description: "Scan all endpoints when true and no other filter is set" }
|
||||
incident_id: { type: string, description: "Optional incident ID" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_policy
|
||||
name: cortex-xdr-get-policy
|
||||
description: "Get the policy name applied to an endpoint."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
endpoint_id: { type: string, description: "Endpoint (agent) ID" }
|
||||
required: [endpoint_id]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── Hash block / allow lists ──────────────────────────────────────────────
|
||||
- id: blocklist_files
|
||||
name: cortex-xdr-blocklist-files
|
||||
description: "Add file hashes to the block list."
|
||||
inputs_schema:
|
||||
properties:
|
||||
hash_list: { type: string, description: "Comma-separated SHA-256 hashes to block" }
|
||||
comment: { type: string, description: "Optional comment" }
|
||||
incident_id: { type: string, description: "Optional incident ID" }
|
||||
required: [hash_list]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: remove_blocklist_files
|
||||
name: cortex-xdr-remove-blocklist-files
|
||||
description: "Remove file hashes from the block list."
|
||||
inputs_schema:
|
||||
properties:
|
||||
hash_list: { type: string, description: "Comma-separated SHA-256 hashes to remove" }
|
||||
comment: { type: string, description: "Optional comment" }
|
||||
incident_id: { type: string, description: "Optional incident ID" }
|
||||
required: [hash_list]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: allowlist_files
|
||||
name: cortex-xdr-allowlist-files
|
||||
description: "Add file hashes to the allow list."
|
||||
inputs_schema:
|
||||
properties:
|
||||
hash_list: { type: string, description: "Comma-separated SHA-256 hashes to allow" }
|
||||
comment: { type: string, description: "Optional comment" }
|
||||
incident_id: { type: string, description: "Optional incident ID" }
|
||||
required: [hash_list]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: remove_allowlist_files
|
||||
name: cortex-xdr-remove-allowlist-files
|
||||
description: "Remove file hashes from the allow list."
|
||||
inputs_schema:
|
||||
properties:
|
||||
hash_list: { type: string, description: "Comma-separated SHA-256 hashes to remove" }
|
||||
comment: { type: string, description: "Optional comment" }
|
||||
incident_id: { type: string, description: "Optional incident ID" }
|
||||
required: [hash_list]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── File quarantine / restore ─────────────────────────────────────────────
|
||||
- id: quarantine_files
|
||||
name: cortex-xdr-quarantine-files
|
||||
description: "Quarantine a file by path + hash on the given endpoints."
|
||||
inputs_schema:
|
||||
properties:
|
||||
endpoint_id_list: { type: string, description: "Comma-separated endpoint IDs" }
|
||||
file_path: { type: string, description: "Full path of the file to quarantine" }
|
||||
file_hash: { type: string, description: "SHA-256 of the file" }
|
||||
incident_id: { type: string, description: "Optional incident ID" }
|
||||
required: [endpoint_id_list, file_path, file_hash]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: restore_file
|
||||
name: cortex-xdr-restore-file
|
||||
description: "Restore a quarantined file by hash."
|
||||
inputs_schema:
|
||||
properties:
|
||||
file_hash: { type: string, description: "SHA-256 of the file to restore" }
|
||||
endpoint_id: { type: string, description: "Optional endpoint ID" }
|
||||
incident_id: { type: string, description: "Optional incident ID" }
|
||||
required: [file_hash]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_quarantine_status
|
||||
name: cortex-xdr-get-quarantine-status
|
||||
description: "Check whether a file is quarantined on an endpoint."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
endpoint_id: { type: string, description: "Endpoint ID" }
|
||||
file_path: { type: string, description: "File path" }
|
||||
file_hash: { type: string, description: "SHA-256 of the file" }
|
||||
required: [endpoint_id, file_path, file_hash]
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── Real-time scripts ─────────────────────────────────────────────────────
|
||||
- id: run_script
|
||||
name: cortex-xdr-run-script
|
||||
description: "Run a script (by UID) on endpoints with optional parameters."
|
||||
inputs_schema:
|
||||
properties:
|
||||
script_uid: { type: string, description: "Script UID" }
|
||||
endpoint_ids: { type: string, description: "Comma-separated endpoint IDs" }
|
||||
parameters: { type: string, description: "JSON object of parameter values" }
|
||||
timeout: { type: number, description: "Timeout in seconds (default 600)" }
|
||||
incident_id: { type: string, description: "Optional incident ID" }
|
||||
required: [script_uid, endpoint_ids]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_script_execution_results
|
||||
name: cortex-xdr-get-script-execution-results
|
||||
description: "Get the results of a script execution by action ID."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
action_id: { type: string, description: "Action ID returned by run_script" }
|
||||
required: [action_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_scripts
|
||||
name: cortex-xdr-get-scripts
|
||||
description: "List available scripts, optionally filtered by name/description/OS support."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
name: { type: string, description: "Comma-separated script names" }
|
||||
windows_supported: { type: boolean, description: "Filter scripts supporting Windows" }
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
# ── Actions / misc ────────────────────────────────────────────────────────
|
||||
- id: action_status
|
||||
name: cortex-xdr-action-status
|
||||
description: "Get the status of a group action by action ID."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties:
|
||||
action_id: { type: string, description: "Group action ID" }
|
||||
required: [action_id]
|
||||
outputs_schema: { properties: {} }
|
||||
- id: get_distribution_versions
|
||||
name: cortex-xdr-get-distribution-versions
|
||||
description: "List available agent installer versions."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties: {}
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
|
||||
- id: test_connection
|
||||
name: cortex-xdr-test-connection
|
||||
description: "Verify connectivity and credentials (used by the Test button)."
|
||||
risk: read
|
||||
inputs_schema:
|
||||
properties: {}
|
||||
required: []
|
||||
outputs_schema: { properties: {} }
|
||||
Reference in New Issue
Block a user