f3nris
a6e1245c79
incidents/get_incidents/ answers with a summary and nothing else: 21 fields,
no hosts, no users, no MITRE, no tags, and not one of the alerts the incident
aggregates. Ingesting through it leaves an incident whose raw payload says
almost nothing about what happened — and the shipped mapper had been written
for a richer shape than the endpoint ever returns, mapping hosts[0], users[0]
and mitre_* that simply are not in that response.
incidents/get_multiple_incidents_extra_data/ returns the same incidents with
39 fields, every alert in full — 156 fields each — and the file and network
artifacts. It is what the reference client fetches through (demisto/content,
CortexXDRIR.get_multiple_incidents_extra_data), and full_alert_fields must be
set or the nested alerts come back trimmed to a handful of fields.
Records arrive as {incident, alerts, network_artifacts, file_artifacts} with
each nested block wrapped as {total_count, data}. The script flattens them, so
every expression written against get_incidents keeps working — the summary's
21 fields are a subset of these 39 — while the alerts and artifacts land beside
them as plain lists, and their total_count says when a list is a sample rather
than the whole set. incident_sources is lifted into a scalar for the same
reason severity was on the alerts side: the incident-field mapper reads dotted
paths and cannot index a list.
get_incidents stays, for cheap polling, and now says in its description what it
does and does not carry.
The mapper maps the aggregate first and the first alert last, so the alert
fills in whatever the aggregate leaves silent — including the detection anchor,
since an XDR incident's detection_time is usually null while its alerts carry
theirs. Verified against the vendor's recorded response
(test_data/get_multiple_incidents_extra_data.json): 33 of 52 entries resolve,
severity critical lands on 5, source reads "XDR Agent", and the anchor falls
through to the alert's detection timestamp.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
601 lines
30 KiB
YAML
601 lines
30 KiB
YAML
id: cortex_xdr
|
|
name: Cortex XDR
|
|
version: 1.3.0
|
|
description: "Palo Alto Cortex XDR (public API v1) — incident and alert ingestion + write-back, endpoint isolation/scan/delete/tagging, RTR scripts, hash block/allow lists, file quarantine/restore/retrieval, alert exclusions, external alert push (parsed/CEF), device-control violations, audits, distributions and RBAC/risk."
|
|
changelog: "1.3.0 — Richer incident ingestion (fetch_incidents, on get_multiple_incidents_extra_data): incidents now arrive with their alerts in full and their file/network artifacts, where get_incidents only ever answered a 21-field summary carrying neither hosts, users, MITRE nor a single alert. Alert ingestion, and the alerts endpoint answers at last: get_alerts was sending the incidents dialect ({filters, search_from, search_to, sort}) to a grid endpoint that speaks request_data.filter_data (SEARCH_FIELD/SEARCH_TYPE/SEARCH_VALUE blocks, paging.from/to, sort as a list), and every call came back HTTP 500. Body rebuilt from the reference client, rows unwrapped out of their alert_fields envelope, severity code and the dotted status.progress key derived into readable fields. Alert ingestion: get_alerts is now a fetch command (results path reply.alerts, dedup on alert_id, incremental on source_insert_ts) with a bundled OCSF mapper and a Cortex XDR Alert incident type, so detections can be ingested alongside — or instead of — incidents. The incident mapper is fixed on the way past: its severity expression compared strings, which the mapping engine cannot do, so every ingested incident silently took the rule's default severity; it also now carries a detection anchor so MTTD is measurable. It pages past the API's 100-results-per-call ceiling, and sorts oldest-first on an incremental fetch so a truncated window drops the alerts the next poll can still see. 1.2.1 — Connection troubleshooting: the URL is normalised to the tenant host (a pasted /public_api/v1 or console path no longer breaks the call), a non-JSON reply reports the status, content type and body instead of a bare JSON parse error, missing key/key ID is caught up front, nonce and timestamp are sent in both auth modes as the reference client does, and test_connection now probes get_incidents. 1.2.0 — Incident write-back (update_incident: status/severity/assignment/resolve comment) and external alert push (insert_parsed_alerts, insert_cef_alerts). 1.1.0 — Full command coverage: added delete/alias/tag endpoints, abort scan, original alerts, script metadata/code/snippet/exec-status, file retrieval (+details), alert exclusions, device-control violations, audits, distribution url/status/create and RBAC (users, roles, groups, risk score, risky users/hosts). 1.0.0 — Initial release: incident ingestion (get_incidents) with OCSF mapper, endpoints, isolate/unisolate, scan, hash blocklist/allowlist, quarantine/restore, run script + results, alerts retrieval, distributions and action status. Standard or Advanced API authentication."
|
|
category: endpoint
|
|
|
|
# Per-instance configuration. The base URL is the tenant API root, e.g.
|
|
# https://api-yourtenant.xdr.eu.paloaltonetworks.com (scripts append /public_api/v1).
|
|
config_schema:
|
|
properties:
|
|
url:
|
|
type: string
|
|
description: "Tenant API host — Settings → Configurations → API Keys → Copy URL, e.g. https://api-<tenant>.xdr.<region>.paloaltonetworks.com. Not the console URL you log into (that one answers with HTML, not JSON)."
|
|
api_key_id:
|
|
type: string
|
|
description: "API Key ID (the integer ID shown next to the API key in Settings → API Keys)"
|
|
api_key:
|
|
type: string
|
|
description: "API Key secret"
|
|
x-soar-sensitive: true
|
|
auth_type:
|
|
type: string
|
|
description: "How the key was created in Cortex XDR: standard (key sent as-is) or advanced (nonce + timestamp SHA-256 hash). A mismatch here is rejected with 401."
|
|
default: standard
|
|
required:
|
|
- url
|
|
- api_key_id
|
|
- api_key
|
|
|
|
# Documented for reference; the bundled scripts build the headers themselves.
|
|
# Standard: x-xdr-auth-id: <id>, Authorization: <api_key>
|
|
# Advanced: x-xdr-auth-id: <id>, x-xdr-nonce, x-xdr-timestamp,
|
|
# Authorization: sha256(api_key + nonce + timestamp)
|
|
auth:
|
|
- id: apikey
|
|
type: api_key
|
|
in: header
|
|
name: Authorization
|
|
value_template: "{{secret}}"
|
|
secret_field: api_key
|
|
|
|
commands:
|
|
# ── Ingestion ─────────────────────────────────────────────────────────────
|
|
- id: get_incidents
|
|
name: cortex-xdr-get-incidents
|
|
description: "List Cortex XDR incidents as a 21-field summary (no hosts, no users, no MITRE, no alerts). Cheap to poll, but for ingestion prefer cortex-xdr-fetch-incidents, which returns the same incidents with their alerts and artifacts. Returns {reply:{incidents:[...]}}."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
status: { type: string, description: "Filter by status (e.g. new, under_investigation, resolved_threat_handled)" }
|
|
created_after: { type: string, description: "Lower bound on creation_time, ISO8601 or epoch ms (incremental fetch watermark)" }
|
|
limit: { type: number, description: "Maximum incidents to fetch (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
ingest:
|
|
results_path: reply.incidents
|
|
dedup_key: incident_id
|
|
incremental_field: created_after
|
|
- id: fetch_incidents
|
|
name: cortex-xdr-fetch-incidents
|
|
description: "Fetch incidents WITH their alerts and artifacts (get_multiple_incidents_extra_data) — the ingestion command to prefer. get_incidents answers with a 21-field summary carrying no hosts, no users, no MITRE and none of the alerts; this one returns 39 incident fields, every alert in full (156 fields each) and the file/network artifacts. Records are flattened, so mapping expressions written against get_incidents keep working and alerts[], file_artifacts[], network_artifacts[] sit beside them. Returns {reply:{incidents:[...]}}."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
status: { type: string, description: "Comma-separated statuses to keep (new, under_investigation, resolved_threat_handled…)" }
|
|
created_after: { type: string, description: "Lower bound on creation_time, ISO8601 or epoch ms (incremental fetch watermark)" }
|
|
limit: { type: number, description: "Maximum incidents to fetch (default 50, paged 50 at a time). A full incident weighs a few KB and up to a few hundred with its alerts, so raise this knowingly." }
|
|
exclude_artifacts: { type: boolean, description: "Drop the file and network artifact blocks, keeping the alerts (lighter payload)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
ingest:
|
|
results_path: reply.incidents
|
|
dedup_key: incident_id
|
|
incremental_field: created_after
|
|
- id: get_incident_extra_data
|
|
name: cortex-xdr-get-incident-extra-data
|
|
description: "Get full incident data including its alerts and network artifacts by incident ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
incident_id: { type: string, description: "Incident ID" }
|
|
alerts_limit: { type: number, description: "Max alerts to return (default 1000)" }
|
|
required: [incident_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: update_incident
|
|
name: cortex-xdr-update-incident
|
|
description: "Update an incident's status, severity, assignment and resolve comment (write-back / close the loop)."
|
|
inputs_schema:
|
|
properties:
|
|
incident_id: { type: string, description: "Incident ID to update" }
|
|
status: { type: string, description: "New status (new, under_investigation, resolved_threat_handled, resolved_known_issue, resolved_duplicate, resolved_false_positive, resolved_true_positive, resolved_security_testing, resolved_auto)" }
|
|
manual_severity: { type: string, description: "Override severity (low, medium, high, critical)" }
|
|
assigned_user_mail: { type: string, description: "Assignee email" }
|
|
assigned_user_pretty_name: { type: string, description: "Assignee display name" }
|
|
unassign: { type: boolean, description: "Clear the assignment when true" }
|
|
resolve_comment: { type: string, description: "Resolution comment (shown when resolving)" }
|
|
required: [incident_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_alerts
|
|
name: cortex-xdr-get-alerts
|
|
description: "Fetch Cortex XDR alerts for ingestion (get_alerts_by_filter_data). Returns {reply:{alerts:[...]}}; use reply.alerts as the alert rule results path. Each row is unwrapped out of the API's alert_fields envelope and carries a readable severity_name and status_progress, so alerts-grid field names (internal_id, alert_name, agent_hostname) are what mapping expressions see. Alerts are the detection layer under incidents: ingest them alongside get_incidents when the SOC works detections, not only aggregates."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
severity: { type: string, description: "Comma-separated severities (informational, low, medium, high, critical)" }
|
|
created_after: { type: string, description: "Lower bound on alert source_insert_ts, ISO8601 or epoch ms (incremental fetch watermark)" }
|
|
limit: { type: number, description: "Maximum alerts to fetch (default 100). The API serves 100 per call at most; above that the script pages until the limit is reached." }
|
|
# Left unfiltered, the call is bounded to the last 30 days: the alerts
|
|
# grid is not meant to be asked for a tenant's whole retention.
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
ingest:
|
|
results_path: reply.alerts
|
|
dedup_key: internal_id
|
|
incremental_field: created_after
|
|
- id: insert_parsed_alerts
|
|
name: cortex-xdr-insert-parsed-alerts
|
|
description: "Push external alerts (parsed JSON objects) into Cortex XDR for correlation."
|
|
inputs_schema:
|
|
properties:
|
|
alerts: { type: string, description: "JSON array of parsed alert objects (each with product, vendor, severity, alert_name, etc.)" }
|
|
required: [alerts]
|
|
outputs_schema: { properties: {} }
|
|
- id: insert_cef_alerts
|
|
name: cortex-xdr-insert-cef-alerts
|
|
description: "Push external alerts in CEF format into Cortex XDR for correlation."
|
|
inputs_schema:
|
|
properties:
|
|
alerts: { type: string, description: "CEF alert lines: a JSON array of CEF strings, or newline-separated CEF lines" }
|
|
required: [alerts]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Endpoints ─────────────────────────────────────────────────────────────
|
|
- id: get_endpoints
|
|
name: cortex-xdr-get-endpoints
|
|
description: "List/search endpoints by hostname, IP, status, platform, group, etc."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
hostname: { type: string, description: "Hostname to filter by" }
|
|
ip_list: { type: string, description: "Comma-separated IPs" }
|
|
status: { type: string, description: "Endpoint status (connected, disconnected, ...)" }
|
|
platform: { type: string, description: "OS platform (windows, linux, macos, android)" }
|
|
limit: { type: number, description: "Max endpoints (default 30)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: isolate_endpoint
|
|
name: cortex-xdr-isolate-endpoint
|
|
description: "Network-isolate an endpoint by endpoint (agent) ID."
|
|
inputs_schema:
|
|
properties:
|
|
endpoint_id: { type: string, description: "Endpoint (agent) ID to isolate" }
|
|
incident_id: { type: string, description: "Optional incident ID to associate the action with" }
|
|
required: [endpoint_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: unisolate_endpoint
|
|
name: cortex-xdr-unisolate-endpoint
|
|
description: "Remove network isolation from an endpoint by endpoint (agent) ID."
|
|
inputs_schema:
|
|
properties:
|
|
endpoint_id: { type: string, description: "Endpoint (agent) ID to unisolate" }
|
|
incident_id: { type: string, description: "Optional incident ID to associate the action with" }
|
|
required: [endpoint_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: scan_endpoints
|
|
name: cortex-xdr-scan-endpoints
|
|
description: "Trigger a malware scan on endpoints matching the given filters (or all)."
|
|
inputs_schema:
|
|
properties:
|
|
endpoint_id_list: { type: string, description: "Comma-separated endpoint IDs (omit + use all=true to scan all)" }
|
|
hostname: { type: string, description: "Comma-separated hostnames" }
|
|
all: { type: boolean, description: "Scan all endpoints when true and no other filter is set" }
|
|
incident_id: { type: string, description: "Optional incident ID" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_policy
|
|
name: cortex-xdr-get-policy
|
|
description: "Get the policy name applied to an endpoint."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
endpoint_id: { type: string, description: "Endpoint (agent) ID" }
|
|
required: [endpoint_id]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Hash block / allow lists ──────────────────────────────────────────────
|
|
- id: blocklist_files
|
|
name: cortex-xdr-blocklist-files
|
|
description: "Add file hashes to the block list."
|
|
inputs_schema:
|
|
properties:
|
|
hash_list: { type: string, description: "Comma-separated SHA-256 hashes to block" }
|
|
comment: { type: string, description: "Optional comment" }
|
|
incident_id: { type: string, description: "Optional incident ID" }
|
|
required: [hash_list]
|
|
outputs_schema: { properties: {} }
|
|
- id: remove_blocklist_files
|
|
name: cortex-xdr-remove-blocklist-files
|
|
description: "Remove file hashes from the block list."
|
|
inputs_schema:
|
|
properties:
|
|
hash_list: { type: string, description: "Comma-separated SHA-256 hashes to remove" }
|
|
comment: { type: string, description: "Optional comment" }
|
|
incident_id: { type: string, description: "Optional incident ID" }
|
|
required: [hash_list]
|
|
outputs_schema: { properties: {} }
|
|
- id: allowlist_files
|
|
name: cortex-xdr-allowlist-files
|
|
description: "Add file hashes to the allow list."
|
|
inputs_schema:
|
|
properties:
|
|
hash_list: { type: string, description: "Comma-separated SHA-256 hashes to allow" }
|
|
comment: { type: string, description: "Optional comment" }
|
|
incident_id: { type: string, description: "Optional incident ID" }
|
|
required: [hash_list]
|
|
outputs_schema: { properties: {} }
|
|
- id: remove_allowlist_files
|
|
name: cortex-xdr-remove-allowlist-files
|
|
description: "Remove file hashes from the allow list."
|
|
inputs_schema:
|
|
properties:
|
|
hash_list: { type: string, description: "Comma-separated SHA-256 hashes to remove" }
|
|
comment: { type: string, description: "Optional comment" }
|
|
incident_id: { type: string, description: "Optional incident ID" }
|
|
required: [hash_list]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── File quarantine / restore ─────────────────────────────────────────────
|
|
- id: quarantine_files
|
|
name: cortex-xdr-quarantine-files
|
|
description: "Quarantine a file by path + hash on the given endpoints."
|
|
inputs_schema:
|
|
properties:
|
|
endpoint_id_list: { type: string, description: "Comma-separated endpoint IDs" }
|
|
file_path: { type: string, description: "Full path of the file to quarantine" }
|
|
file_hash: { type: string, description: "SHA-256 of the file" }
|
|
incident_id: { type: string, description: "Optional incident ID" }
|
|
required: [endpoint_id_list, file_path, file_hash]
|
|
outputs_schema: { properties: {} }
|
|
- id: restore_file
|
|
name: cortex-xdr-restore-file
|
|
description: "Restore a quarantined file by hash."
|
|
inputs_schema:
|
|
properties:
|
|
file_hash: { type: string, description: "SHA-256 of the file to restore" }
|
|
endpoint_id: { type: string, description: "Optional endpoint ID" }
|
|
incident_id: { type: string, description: "Optional incident ID" }
|
|
required: [file_hash]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_quarantine_status
|
|
name: cortex-xdr-get-quarantine-status
|
|
description: "Check whether a file is quarantined on an endpoint."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
endpoint_id: { type: string, description: "Endpoint ID" }
|
|
file_path: { type: string, description: "File path" }
|
|
file_hash: { type: string, description: "SHA-256 of the file" }
|
|
required: [endpoint_id, file_path, file_hash]
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Real-time scripts ─────────────────────────────────────────────────────
|
|
- id: run_script
|
|
name: cortex-xdr-run-script
|
|
description: "Run a script (by UID) on endpoints with optional parameters."
|
|
inputs_schema:
|
|
properties:
|
|
script_uid: { type: string, description: "Script UID" }
|
|
endpoint_ids: { type: string, description: "Comma-separated endpoint IDs" }
|
|
parameters: { type: string, description: "JSON object of parameter values" }
|
|
timeout: { type: number, description: "Timeout in seconds (default 600)" }
|
|
incident_id: { type: string, description: "Optional incident ID" }
|
|
required: [script_uid, endpoint_ids]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_script_execution_results
|
|
name: cortex-xdr-get-script-execution-results
|
|
description: "Get the results of a script execution by action ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
action_id: { type: string, description: "Action ID returned by run_script" }
|
|
required: [action_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_scripts
|
|
name: cortex-xdr-get-scripts
|
|
description: "List available scripts, optionally filtered by name/description/OS support."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
name: { type: string, description: "Comma-separated script names" }
|
|
windows_supported: { type: boolean, description: "Filter scripts supporting Windows" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
# ── Actions / misc ────────────────────────────────────────────────────────
|
|
- id: action_status
|
|
name: cortex-xdr-action-status
|
|
description: "Get the status of a group action by action ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
action_id: { type: string, description: "Group action ID" }
|
|
required: [action_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_distribution_versions
|
|
name: cortex-xdr-get-distribution-versions
|
|
description: "List available agent installer versions."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: delete_endpoints
|
|
name: cortex-xdr-delete-endpoints
|
|
description: "Delete endpoints (agents) by ID."
|
|
inputs_schema:
|
|
properties:
|
|
endpoint_ids: { type: string, description: "Comma-separated endpoint IDs to delete" }
|
|
required: [endpoint_ids]
|
|
outputs_schema: { properties: {} }
|
|
- id: set_endpoint_alias
|
|
name: cortex-xdr-set-endpoint-alias
|
|
description: "Set the alias name on endpoints."
|
|
inputs_schema:
|
|
properties:
|
|
endpoint_ids: { type: string, description: "Comma-separated endpoint IDs" }
|
|
alias: { type: string, description: "New alias name (empty to clear)" }
|
|
required: [endpoint_ids]
|
|
outputs_schema: { properties: {} }
|
|
- id: abort_scan
|
|
name: cortex-xdr-abort-scan
|
|
description: "Abort a running malware scan on endpoints matching the filters (or all)."
|
|
inputs_schema:
|
|
properties:
|
|
endpoint_id_list: { type: string, description: "Comma-separated endpoint IDs (omit to abort all)" }
|
|
incident_id: { type: string, description: "Optional incident ID" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_original_alerts
|
|
name: cortex-xdr-get-original-alerts
|
|
description: "Get the original raw alert events by alert ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
alert_id_list: { type: string, description: "Comma-separated alert IDs" }
|
|
required: [alert_id_list]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_script_metadata
|
|
name: cortex-xdr-get-script-metadata
|
|
description: "Get metadata for a script by UID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
script_uid: { type: string, description: "Script UID" }
|
|
required: [script_uid]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_script_code
|
|
name: cortex-xdr-get-script-code
|
|
description: "Get the source code of a script by UID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
script_uid: { type: string, description: "Script UID" }
|
|
required: [script_uid]
|
|
outputs_schema: { properties: {} }
|
|
- id: run_snippet_code_script
|
|
name: cortex-xdr-run-snippet-code-script
|
|
description: "Run an arbitrary code snippet on endpoints."
|
|
inputs_schema:
|
|
properties:
|
|
snippet_code: { type: string, description: "Code snippet to run" }
|
|
endpoint_ids: { type: string, description: "Comma-separated endpoint IDs" }
|
|
incident_id: { type: string, description: "Optional incident ID" }
|
|
required: [snippet_code, endpoint_ids]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_script_execution_status
|
|
name: cortex-xdr-get-script-execution-status
|
|
description: "Get the status of a script execution by action ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
action_id: { type: string, description: "Action ID" }
|
|
required: [action_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: retrieve_file
|
|
name: cortex-xdr-retrieve-file
|
|
description: "Retrieve files from endpoints by OS-specific path lists."
|
|
inputs_schema:
|
|
properties:
|
|
endpoint_ids: { type: string, description: "Comma-separated endpoint IDs" }
|
|
windows: { type: string, description: "Comma-separated Windows file paths" }
|
|
linux: { type: string, description: "Comma-separated Linux file paths" }
|
|
macos: { type: string, description: "Comma-separated macOS file paths" }
|
|
incident_id: { type: string, description: "Optional incident ID" }
|
|
required: [endpoint_ids]
|
|
outputs_schema: { properties: {} }
|
|
- id: retrieve_file_details
|
|
name: cortex-xdr-retrieve-file-details
|
|
description: "Get the download details of a file-retrieval action."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
action_id: { type: string, description: "Group action ID from retrieve_file" }
|
|
required: [action_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: add_exclusion
|
|
name: cortex-xdr-add-exclusion
|
|
description: "Add an alert exclusion."
|
|
inputs_schema:
|
|
properties:
|
|
name: { type: string, description: "Exclusion name" }
|
|
indicator: { type: string, description: "JSON indicator object for the exclusion filter" }
|
|
status: { type: string, description: "ENABLED or DISABLED (default ENABLED)" }
|
|
required: [name, indicator]
|
|
outputs_schema: { properties: {} }
|
|
- id: delete_exclusion
|
|
name: cortex-xdr-delete-exclusion
|
|
description: "Delete an alert exclusion by ID."
|
|
inputs_schema:
|
|
properties:
|
|
alert_exclusion_id: { type: number, description: "Exclusion ID" }
|
|
required: [alert_exclusion_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_exclusion
|
|
name: cortex-xdr-get-exclusion
|
|
description: "List alert exclusions."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
tenant_id: { type: string, description: "Optional tenant ID" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: add_tag_endpoint
|
|
name: cortex-xdr-add-tag-endpoint
|
|
description: "Add a tag to endpoints."
|
|
inputs_schema:
|
|
properties:
|
|
endpoint_ids: { type: string, description: "Comma-separated endpoint IDs" }
|
|
tag: { type: string, description: "Tag to add" }
|
|
required: [endpoint_ids, tag]
|
|
outputs_schema: { properties: {} }
|
|
- id: remove_tag_endpoint
|
|
name: cortex-xdr-remove-tag-endpoint
|
|
description: "Remove a tag from endpoints."
|
|
inputs_schema:
|
|
properties:
|
|
endpoint_ids: { type: string, description: "Comma-separated endpoint IDs" }
|
|
tag: { type: string, description: "Tag to remove" }
|
|
required: [endpoint_ids, tag]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_device_control_violations
|
|
name: cortex-xdr-get-device-control-violations
|
|
description: "List device control (USB) violations."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
endpoint_ids: { type: string, description: "Comma-separated endpoint IDs" }
|
|
type: { type: string, description: "Comma-separated violation types" }
|
|
timestamp_gte: { type: string, description: "Lower bound timestamp (ISO8601 or epoch ms)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: list_users
|
|
name: cortex-xdr-list-users
|
|
description: "List Cortex XDR users."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_risk_score
|
|
name: cortex-xdr-get-risk-score
|
|
description: "Get the risk score of a user or host by ID."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
id: { type: string, description: "User or host identifier" }
|
|
required: [id]
|
|
outputs_schema: { properties: {} }
|
|
- id: list_risky_users
|
|
name: cortex-xdr-list-risky-users
|
|
description: "List risky users."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: list_risky_hosts
|
|
name: cortex-xdr-list-risky-hosts
|
|
description: "List risky hosts."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: list_user_groups
|
|
name: cortex-xdr-list-user-groups
|
|
description: "Get user groups by name."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
group_names: { type: string, description: "Comma-separated group names" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: list_roles
|
|
name: cortex-xdr-list-roles
|
|
description: "Get roles by name."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
role_names: { type: string, description: "Comma-separated role names" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: set_user_role
|
|
name: cortex-xdr-set-user-role
|
|
description: "Assign a role to users."
|
|
inputs_schema:
|
|
properties:
|
|
user_emails: { type: string, description: "Comma-separated user emails" }
|
|
role_name: { type: string, description: "Role name to assign" }
|
|
required: [user_emails, role_name]
|
|
outputs_schema: { properties: {} }
|
|
- id: remove_user_role
|
|
name: cortex-xdr-remove-user-role
|
|
description: "Remove the role assignment from users."
|
|
inputs_schema:
|
|
properties:
|
|
user_emails: { type: string, description: "Comma-separated user emails" }
|
|
required: [user_emails]
|
|
outputs_schema: { properties: {} }
|
|
- id: audit_management_logs
|
|
name: cortex-xdr-audit-management-logs
|
|
description: "Retrieve management audit logs."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
email: { type: string, description: "Comma-separated emails" }
|
|
type: { type: string, description: "Comma-separated log types" }
|
|
timestamp_gte: { type: string, description: "Lower bound timestamp (ISO8601 or epoch ms)" }
|
|
limit: { type: number, description: "Max records (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_audit_agent_reports
|
|
name: cortex-xdr-get-audit-agent-reports
|
|
description: "Retrieve agent audit reports."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
endpoint_ids: { type: string, description: "Comma-separated endpoint IDs" }
|
|
type: { type: string, description: "Comma-separated report types" }
|
|
timestamp_gte: { type: string, description: "Lower bound timestamp (ISO8601 or epoch ms)" }
|
|
limit: { type: number, description: "Max records (default 100)" }
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
- id: get_distribution_url
|
|
name: cortex-xdr-get-distribution-url
|
|
description: "Get the download URL of an agent installer distribution."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
distribution_id: { type: string, description: "Distribution ID" }
|
|
package_type: { type: string, description: "Package type (sh, rpm, deb, pkg, x86, x64, ...)" }
|
|
required: [distribution_id, package_type]
|
|
outputs_schema: { properties: {} }
|
|
- id: get_distribution_status
|
|
name: cortex-xdr-get-distribution-status
|
|
description: "Get the build status of an agent installer distribution."
|
|
risk: read
|
|
inputs_schema:
|
|
properties:
|
|
distribution_id: { type: string, description: "Distribution ID" }
|
|
required: [distribution_id]
|
|
outputs_schema: { properties: {} }
|
|
- id: create_distribution
|
|
name: cortex-xdr-create-distribution
|
|
description: "Create an agent installer distribution."
|
|
inputs_schema:
|
|
properties:
|
|
name: { type: string, description: "Distribution name" }
|
|
platform: { type: string, description: "Platform (windows, linux, macos, android)" }
|
|
package_type: { type: string, description: "standalone or upgrade (default standalone)" }
|
|
agent_version: { type: string, description: "Agent version" }
|
|
description: { type: string, description: "Optional description" }
|
|
required: [name, platform]
|
|
outputs_schema: { properties: {} }
|
|
|
|
- id: test_connection
|
|
name: cortex-xdr-test-connection
|
|
description: "Verify connectivity and credentials (used by the Test button)."
|
|
risk: read
|
|
inputs_schema:
|
|
properties: {}
|
|
required: []
|
|
outputs_schema: { properties: {} }
|
|
|
|
ingestion:
|
|
command: get_incidents
|
|
mapper: get_incidents
|
|
default_incident_type: "Cortex XDR Incident"
|