Guillaume BOURGEOIS 0263619e30 feat(cortex-xdr): incident write-back and external alert push ...

Add three commands to the Cortex XDR integration (v1.2.0):
- update_incident: change status, severity, assignment and resolve
  comment on an incident (closes the SOAR ingest→action loop).
- insert_parsed_alerts: push external parsed alerts into Cortex XDR.
- insert_cef_alerts: push external CEF-format alerts.

Scripts follow the existing self-contained standard/advanced auth pattern.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-29 22:32:47 +02:00

..

abort_scan.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

action_status.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

add_exclusion.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

add_tag_endpoint.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

allowlist_files.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

audit_management_logs.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

blocklist_files.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

create_distribution.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

delete_endpoints.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

delete_exclusion.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

get_alerts.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

get_audit_agent_reports.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

get_device_control_violations.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

get_distribution_status.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

get_distribution_url.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

get_distribution_versions.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

get_endpoints.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

get_exclusion.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

get_incident_extra_data.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

get_incidents.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

get_original_alerts.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

get_policy.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

get_quarantine_status.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

get_risk_score.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

get_script_code.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

get_script_execution_results.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

get_script_execution_status.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

get_script_metadata.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

get_scripts.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

insert_cef_alerts.py

feat(cortex-xdr): incident write-back and external alert push

2026-06-29 22:32:47 +02:00

insert_parsed_alerts.py

feat(cortex-xdr): incident write-back and external alert push

2026-06-29 22:32:47 +02:00

isolate_endpoint.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

list_risky_hosts.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

list_risky_users.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

list_roles.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

list_user_groups.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

list_users.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

quarantine_files.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

remove_allowlist_files.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

remove_blocklist_files.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

remove_tag_endpoint.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

remove_user_role.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

restore_file.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

retrieve_file_details.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

retrieve_file.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

run_script.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

run_snippet_code_script.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

scan_endpoints.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

set_endpoint_alias.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

set_user_role.py

feat(cortex-xdr): full command coverage (50 commands) — endpoints, scripts, exclusions, tags, audits, RBAC, distributions

2026-06-26 15:41:59 +02:00

test_connection.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

unisolate_endpoint.py

feat(cortex-xdr): new Cortex XDR integration — incident ingestion + OCSF mapper, IR actions, standard/advanced auth

2026-06-26 15:28:43 +02:00

update_incident.py

feat(cortex-xdr): incident write-back and external alert push

2026-06-29 22:32:47 +02:00