Palo Alto Networks Cortex XSOAR V6
The Cortex XSOAR V6 connector facilitates interaction with Palo Alto Networks' security orchestration and automated response solution, enabling streamlined incident and indicator management.
Palo Alto Networks Cortex XSOAR V6 is a powerful security orchestration, automation, and response (SOAR) platform that enables security teams to streamline their operations. With this connector, users can automate the export, reanalysis, and management of indicators, as well as create and update incidents directly within Swimlane Turbine. This integration empowers organizations to enhance their incident response capabilities, leverage extensive telemetry, and take decisive action against threats without manual intervention.
Palo Alto Cortex XSOAR is a comprehensive security orchestration, automation and response (SOAR) platform that unifies case management, automation, real-time collaboration and threat intel management to serve security teams across the incident lifecycle.
Prerequisites
To integrate Palo Alto Networks Cortex XSOAR V6 with Swimlane Turbine, ensure you have the following:
- Cortex Custom Authentication with the following parameters:
- URL: The base URL of your Cortex XSOAR instance.
- API Key: Your unique API key to authenticate with Cortex XSOAR.
Capabilities
This connector provides the following capabilities:
- Batch Export Indicators to CSV
- Batch Export Indicators to STIX
- Batch Whitelist or Delete indicators
- Create Indicators
- Create or Update Incident
- Edit Indicator
- Search Incidents
- Search Indicators
- Whitelists or Deletes Indicator
Documentation
- This connector has been created using Cortex XSOAR V6.12
Configurations
Palo Alto Cortex XSOAR Authentication
Palo Alto Cortex XSOAR authenticates using API Key.
Configuration Parameters
Parameter | Description | Type | Required |
|---|---|---|---|
url | A URL to the target host. | string | Required |
api_key | The API Key is your unique identifier. | string | Required |
verify_ssl | Verify SSL certificate | boolean | Optional |
http_proxy | A proxy to route requests through. | string | Optional |
Actions
Batch Export Indicators to CSV
Exports a batch of indicators to a CSV file and provides the resulting file ID for download.
Endpoint
- URL: /indicators/batch/exportToCsv
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
all | boolean | Optional | All indicators. |
columns | array | Optional | Columns array. |
doNotWhitelist | boolean | Optional | Do not whitelist flag. |
filter | object | Optional | Parameter for Batch Export Indicators to CSV |
filter.Cache | object | Optional | Parameter for Batch Export Indicators to CSV |
filter.Cache.additionalProperties | array | Optional | Parameter for Batch Export Indicators to CSV |
filter.accounts | object | Optional | Parameter for Batch Export Indicators to CSV |
filter.accounts.additionalProperties | object | Optional | Parameter for Batch Export Indicators to CSV |
filter.earlyTimeInPage | string | Optional | Parameter for Batch Export Indicators to CSV |
filter.fields | array | Optional | Parameter for Batch Export Indicators to CSV |
filter.filterobjectquery | string | Optional | Parameter for Batch Export Indicators to CSV |
filter.firstSeen | object | Optional | Parameter for Batch Export Indicators to CSV |
filter.firstSeen.fromDate | string | Optional | Date value |
filter.firstSeen.fromDateLicense | string | Optional | Parameter for Batch Export Indicators to CSV |
filter.firstSeen.period | object | Optional | Parameter for Batch Export Indicators to CSV |
filter.firstSeen.period.by | string | Optional | Parameter for Batch Export Indicators to CSV |
filter.firstSeen.period.byFrom | string | Optional | Parameter for Batch Export Indicators to CSV |
filter.firstSeen.period.byTo | string | Optional | Parameter for Batch Export Indicators to CSV |
filter.firstSeen.period.field | string | Optional | Parameter for Batch Export Indicators to CSV |
filter.firstSeen.period.fromValue | string | Optional | Value for the parameter |
filter.firstSeen.period.toValue | string | Optional | Value for the parameter |
filter.firstSeen.timeFrame | number | Optional | Parameter for Batch Export Indicators to CSV |
filter.firstSeen.toDate | string | Optional | Date value |
filter.fromDate | string | Optional | Date value |
filter.fromDateLicense | string | Optional | Parameter for Batch Export Indicators to CSV |
Input Example
{"json_body":{"all":false,"columns":["example"],"doNotWhitelist":false,"filter":{"Cache":{"additionalProperties":["example"]},"accounts":{"additionalProperties":{}},"earlyTimeInPage":"2020-01-01T12:00:00Z","fields":["example"],"filterobjectquery":"example","firstSeen":{"fromDate":"2020-01-01T12:00:00Z","fromDateLicense":"2020-01-01T12:00:00Z","period":{"by":"example","byFrom":"example","byTo":"example","field":"example","fromValue":"duration string","toValue":"duration string"},"timeFrame":0,"toDate":"2020-01-01T12:00:00Z"},"fromDate":"2020-01-01T12:00:00Z","fromDateLicense":"2020-01-01T12:00:00Z","ignoreWorkers":false,"lastSeen":{"fromDate":"2020-01-01T12:00:00Z","fromDateLicense":"2020-01-01T12:00:00Z","period":{"by":"example","byFrom":"example","byTo":"example","field":"example","fromValue":"duration string","toValue":"duration string"},"timeFrame":0,"toDate":"2020-01-01T12:00:00Z"},"laterTimeInPage":"2020-01-01T12:00:00Z","page":0,"period":{"by":"example","byFrom":"example","byTo":"example","field":"example","fromValue":"duration string","toValue":"duration string"},"prevPage":false,"query":"example","searchAfter":["example"],"searchAfterElastic":["example"],"searchAfterMap":{"additionalProperties":["example"]},"searchAfterMapOrder":{"additionalProperties":0},"searchBefore":["example"],"searchBeforeElastic":["example"],"size":0,"sort":[{"asc":false,"field":"example","fieldType":"example"}],"timeFrame":0,"toDate":"2020-01-01T12:00:00Z","trim_events":0},"ids":["example"],"reason":"example","reputations":["example"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":"example file ID"}
Batch Export Indicators to STIX
Exports a batch of indicators from Palo Alto Networks Cortex XSOAR V6 to a STIX file and provides the resulting file ID.
Endpoint
- URL: /indicators/batch/export/stix
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
all | boolean | Optional | All indicators. |
columns | array | Optional | Columns array. |
doNotWhitelist | boolean | Optional | Do not whitelist flag. |
filter | object | Optional | IndicatorFilter is a general filter that fetches entities using a query string query using the Query value. |
filter.Cache | object | Optional | Cache of join functions. |
filter.Cache.additionalProperties | array | Optional | Additional properties array. |
filter.accounts | object | Optional | Accounts object. |
filter.accounts.additionalProperties | object | Optional | Additional properties object. |
filter.earlyTimeInPage | string | Optional | Early time in page. |
filter.fields | array | Optional | Fields array. |
filter.filterobjectquery | string | Optional | Query string. |
filter.firstSeen | object | Optional | DateRangeFilter provides common fields for date filtering. |
filter.firstSeen.fromDate | string | Optional | From date. |
filter.firstSeen.fromDateLicense | string | Optional | From date license. |
filter.firstSeen.period | object | Optional | Period object. |
filter.firstSeen.period.by | string | Optional | By is used for legacy, and if exists it will override ByTo and ByFrom. |
filter.firstSeen.period.byFrom | string | Optional | By from. |
filter.firstSeen.period.byTo | string | Optional | By to. |
filter.firstSeen.period.field | string | Optional | Field. |
filter.firstSeen.period.fromValue | string | Optional | From value duration. |
filter.firstSeen.period.toValue | string | Optional | To value duration. |
filter.firstSeen.timeFrame | number | Optional | A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years. |
filter.firstSeen.toDate | string | Optional | To date. |
filter.fromDate | string | Optional | From date. |
filter.fromDateLicense | string | Optional | From date license. |
Input Example
{"json_body":{"all":false,"columns":["example"],"doNotWhitelist":false,"filter":{"Cache":{"additionalProperties":["example"]},"accounts":{"additionalProperties":{}},"earlyTimeInPage":"2020-01-01T12:00:00Z","fields":["example"],"filterobjectquery":"example","firstSeen":{"fromDate":"2020-01-01T12:00:00Z","fromDateLicense":"2020-01-01T12:00:00Z","period":{"by":"example","byFrom":"example","byTo":"example","field":"example","fromValue":"duration string","toValue":"duration string"},"timeFrame":0,"toDate":"2020-01-01T12:00:00Z"},"fromDate":"2020-01-01T12:00:00Z","fromDateLicense":"2020-01-01T12:00:00Z","ignoreWorkers":false,"lastSeen":{"fromDate":"2020-01-01T12:00:00Z","fromDateLicense":"2020-01-01T12:00:00Z","period":{"by":"example","byFrom":"example","byTo":"example","field":"example","fromValue":"duration string","toValue":"duration string"},"timeFrame":0,"toDate":"2020-01-01T12:00:00Z"},"laterTimeInPage":"2020-01-01T12:00:00Z","page":0,"period":{"by":"example","byFrom":"example","byTo":"example","field":"example","fromValue":"duration string","toValue":"duration string"},"prevPage":false,"query":"example","searchAfter":["example"],"searchAfterElastic":["example"],"searchAfterMap":{"additionalProperties":["example"]},"searchAfterMapOrder":{"additionalProperties":0},"searchBefore":["example"],"searchBeforeElastic":["example"],"size":0,"sort":[{"asc":false,"field":"example","fieldType":"example"}],"timeFrame":0,"toDate":"2020-01-01T12:00:00Z","trim_events":0},"ids":["example"],"reason":"example","reputations":["example"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":"example stix file name"}
Batch Whitelist or Delete indicators
Allows batch whitelisting or deletion of indicators in Cortex XSOAR V6. Set 'doNotWhitelist' to true for deletion only.
Endpoint
- URL: /indicators/batchDelete
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
all | boolean | Optional | All indicators. |
columns | array | Optional | Columns array. |
doNotWhitelist | boolean | Optional | Do not whitelist flag. |
filter | object | Optional | IndicatorFilter is a general filter that fetches entities using a query string query using the Query value. |
filter.Cache | object | Optional | Cache of join functions. |
filter.Cache.additionalProperties | array | Optional | Additional properties array. |
filter.accounts | object | Optional | Accounts object. |
filter.accounts.additionalProperties | object | Optional | Additional properties object. |
filter.earlyTimeInPage | string | Optional | Early time in page. |
filter.fields | array | Optional | Fields array. |
filter.filterobjectquery | string | Optional | Query string. |
filter.firstSeen | object | Optional | DateRangeFilter provides common fields for date filtering. |
filter.firstSeen.fromDate | string | Optional | From date. |
filter.firstSeen.fromDateLicense | string | Optional | From date license. |
filter.firstSeen.period | object | Optional | Period object. |
filter.firstSeen.period.by | string | Optional | By is used for legacy, and if exists it will override ByTo and ByFrom. |
filter.firstSeen.period.byFrom | string | Optional | By from. |
filter.firstSeen.period.byTo | string | Optional | By to. |
filter.firstSeen.period.field | string | Optional | Field. |
filter.firstSeen.period.fromValue | string | Optional | From value duration. |
filter.firstSeen.period.toValue | string | Optional | To value duration. |
filter.firstSeen.timeFrame | number | Optional | A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years. |
filter.firstSeen.toDate | string | Optional | To date. |
filter.fromDate | string | Optional | From date. |
filter.fromDateLicense | string | Optional | From date license. |
Input Example
{"json_body":{"all":false,"columns":["example"],"doNotWhitelist":false,"filter":{"Cache":{"additionalProperties":["example"]},"accounts":{"additionalProperties":{}},"earlyTimeInPage":"2020-01-01T12:00:00Z","fields":["example"],"filterobjectquery":"example","firstSeen":{"fromDate":"2020-01-01T12:00:00Z","fromDateLicense":"2020-01-01T12:00:00Z","period":{"by":"example","byFrom":"example","byTo":"example","field":"example","fromValue":"duration string","toValue":"duration string"},"timeFrame":0,"toDate":"2020-01-01T12:00:00Z"},"fromDate":"2020-01-01T12:00:00Z","fromDateLicense":"2020-01-01T12:00:00Z","ignoreWorkers":false,"lastSeen":{"fromDate":"2020-01-01T12:00:00Z","fromDateLicense":"2020-01-01T12:00:00Z","period":{"by":"example","byFrom":"example","byTo":"example","field":"example","fromValue":"duration string","toValue":"duration string"},"timeFrame":0,"toDate":"2020-01-01T12:00:00Z"},"laterTimeInPage":"2020-01-01T12:00:00Z","page":0,"period":{"by":"example","byFrom":"example","byTo":"example","field":"example","fromValue":"duration string","toValue":"duration string"},"prevPage":false,"query":"example","searchAfter":["example"],"searchAfterElastic":["example"],"searchAfterMap":{"additionalProperties":["example"]},"searchAfterMapOrder":{"additionalProperties":0},"searchBefore":["example"],"searchBeforeElastic":["example"],"size":0,"sort":[{"asc":false,"field":"example","fieldType":"example"}],"timeFrame":0,"toDate":"2020-01-01T12:00:00Z","trim_events":0},"ids":["example"],"reason":"example","reputations":["example"]}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
notUpdated | number | Output field: notUpdated |
updatedIds | array | Unique identifier |
uppdated | number | Output field: uppdated |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"notUpdated":0,"updatedIds":["example"],"uppdated":0}}
Create Indicators
Create indicators in Palo Alto Networks Cortex XSOAR V6 from a specified file. A 'files' input is required.
Endpoint
- URL: /indicators/upload
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
files | object | Required | File to create indicators from. |
files.file_name | string | Optional | Name of the resource |
files.file | string | Optional | Parameter for Create Indicators |
Input Example
{"files":{"file_name":"Example Name","file":"string"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
Output Example
[]
Create or Update Incident
Create or update an incident in Palo Alto Networks Cortex XSOAR V6 using the provided JSON body details.
Endpoint
- URL: /incident
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
lastOpen | string | Optional | Parameter for Create or Update Incident |
dbotCreatedBy | string | Optional | Parameter for Create or Update Incident |
parent | string | Optional | Parameter for Create or Update Incident |
reason | string | Optional | The reason an incident was closed. |
sourceInstance | string | Optional | Parameter for Create or Update Incident |
sizeInBytes | number | Optional | Parameter for Create or Update Incident |
closeNotes | string | Optional | Notes for closing the incident. |
dbotMirrorTags | array | Optional | The entry tags I want to sync to remote system. |
dueDate | string | Optional | Date value |
linkedCount | number | Optional | Count value |
syncHash | string | Optional | Parameter for Create or Update Incident |
type | string | Optional | Type of the resource |
closingUserId | string | Optional | The user ID that closed this investigation. |
rawPhase | string | Optional | Parameter for Create or Update Incident |
modified | string | Optional | Parameter for Create or Update Incident |
xsoarReadOnlyRoles | array | Optional | Parameter for Create or Update Incident |
details | string | Optional | Parameter for Create or Update Incident |
closeReason | string | Optional | he reason for closing the incident (select from existing predefined values). |
dbotMirrorDirection | string | Optional | DBotMirrorDirection of how to mirror the incident (in/out/both). |
rawCategory | string | Optional | Parameter for Create or Update Incident |
phase | string | Optional | Parameter for Create or Update Incident |
allReadWrite | boolean | Optional | Parameter for Create or Update Incident |
numericId | number | Optional | Unique identifier |
sequenceNumber | number | Optional | Parameter for Create or Update Incident |
previousAllRead | boolean | Optional | Parameter for Create or Update Incident |
Input Example
{"lastOpen":"string","dbotCreatedBy":"string","parent":"string","sourceInstance":"string","sizeInBytes":123,"closeNotes":"string","dbotMirrorTags":["string"],"dueDate":"string","linkedCount":123,"syncHash":"string","type":"string","closingUserId":"string","rawPhase":"string","modified":"string","xsoarReadOnlyRoles":["string"],"details":"string","closeReason":"string","dbotMirrorDirection":"string","rawCategory":"string","phase":"string","allReadWrite":true,"numericId":123,"sequenceNumber":123,"previousAllRead":true,"investigationId":"string","todoTaskIds":["string"],"created":"2024-01-01T00:00:00Z","indexName":"Example Name","notifyTime":"string","xsoarHasReadOnlyRole":true,"sla":123,"autime":123,"rawJSON":"string","version":123,"labels":[{"type":"string","value":"string"}],"dbotMirrorLastSync":"string","rawCloseReason":"string","previousAllReadWrite":true,"canvases":["string"],"playbookId":"string","name":"Example Name","hasRole":true,"dbotCurrentDirtyFields":["string"],"status":123,"dbotDirtyFields":["string"],"rawType":"string","primaryTerm":123,"roles":["string"],"isPlayground":true}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
ShardID | number | Unique identifier |
account | string | Count value |
activated | string | Output field: activated |
activatingingUserId | string | Unique identifier |
allRead | boolean | Output field: allRead |
allReadWrite | boolean | Output field: allReadWrite |
attachment | array | Output field: attachment |
attachment.file_name | string | Name of the resource |
attachment.file | string | Output field: attachment.file |
autime | number | Time value |
cacheVersn | number | Output field: cacheVersn |
canvases | array | Output field: canvases |
category | string | Output field: category |
changeStatus | string | Status value |
closeNotes | string | Output field: closeNotes |
closeReason | string | Response reason phrase |
closed | string | Output field: closed |
closingUserId | string | Unique identifier |
created | string | Output field: created |
dbotCreatedBy | string | Output field: dbotCreatedBy |
dbotCurrentDirtyFields | array | Output field: dbotCurrentDirtyFields |
dbotDirtyFields | array | Output field: dbotDirtyFields |
dbotMirrorDirection | string | Output field: dbotMirrorDirection |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"ShardID":-9007199254740991,"account":"string","activated":"2019-08-24T14:15:22Z","activatingingUserId":"string","allRead":true,"allReadWrite":true,"attachment":[],"autime":-9007199254740991,"cacheVersn":-9007199254740991,"canvases":["string"],"category":"string","changeStatus":"string","closeNotes":"string","closeReason":"string","closed":"2019-08-24T14:15:22Z"}}
Edit Indicator
Modify an existing indicator entity in Palo Alto Networks Cortex XSOAR V6, including updates to custom fields by using lowercase and removing spaces.
Endpoint
- URL: /indicator/edit
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
CustomFields | object | Optional | The keys should be the field's display name all lower and without spaces. For example- Scan IP -> scanip. To get the actual key name you can also go to Cortex XSOAR CLI and run /incident_add and look for the key that you would like to update. |
CustomFields.additionalProperties | object | Optional | Additional properties object |
account | string | Optional | Account |
aggregatedReliability | string | Optional | Aggregated reliability |
cacheVersn | number | Optional | Cache version |
calculatedTime | string | Optional | Calculated time |
comment | string | Optional | Comment. |
comments | array | Optional | Comments array. |
comments.cacheVersn | number | Optional | Parameter for Edit Indicator |
comments.category | string | Optional | Parameter for Edit Indicator |
comments.content | string | Optional | Response content |
comments.created | string | Optional | Parameter for Edit Indicator |
comments.entryId | string | Optional | Unique identifier |
comments.highlight | object | Optional | Highlight object. |
comments.highlight.additionalProperties | array | Optional | Additional properties array. |
comments.id | string | Optional | Unique identifier |
comments.indexName | string | Optional | Name of the resource |
comments.modified | string | Optional | Parameter for Edit Indicator |
comments.numericId | number | Optional | Unique identifier |
comments.primaryTerm | number | Optional | Parameter for Edit Indicator |
comments.sequenceNumber | number | Optional | Parameter for Edit Indicator |
comments.sizeInBytes | number | Optional | Parameter for Edit Indicator |
comments.sortValues | array | Optional | Value for the parameter |
comments.source | string | Optional | Parameter for Edit Indicator |
comments.syncHash | string | Optional | Parameter for Edit Indicator |
Input Example
{"CustomFields":{"additionalProperties":{}},"account":"string","aggregatedReliability":"string","cacheVersn":123,"calculatedTime":"string","comment":"string","comments":[{"cacheVersn":123,"category":"string","content":"string","created":"2024-01-01T00:00:00Z","entryId":"string","highlight":{"additionalProperties":["string"]},"id":"12345678-1234-1234-1234-123456789abc","indexName":"Example Name","modified":"string","numericId":123,"primaryTerm":123,"sequenceNumber":123,"sizeInBytes":123,"sortValues":["string"],"source":"string","syncHash":"string","type":"string","user":"string","version":123}],"created":"2024-01-01T00:00:00Z","deletedFeedFetchTime":"string","expiration":"string","expirationSource":{"brand":"string","expirationInterval":123,"expirationPolicy":"string","instance":"string","moduleId":"string","setTime":"string","source":"string","user":"string"},"expirationStatus":"active","firstSeen":"string","firstSeenEntryID":"string","highlight":{"additionalProperties":["string"]},"id":"12345678-1234-1234-1234-123456789abc","indexName":"Example Name","indicator_type":"string","insightCache":{"cacheVersn":123,"created":"2024-01-01T00:00:00Z","highlight":{"additionalProperties":["string"]},"id":"12345678-1234-1234-1234-123456789abc","indexName":"Example Name","modified":"string","numericId":123,"primaryTerm":123,"scores":{"additionalProperties":{"content":"string","contentFormat":"string","context":{},"isTypedIndicator":true,"reliability":"string","score":123,"scoreChangeTimestamp":"string","timestamp":"2024-01-01T00:00:00Z","type":"string"}},"sequenceNumber":123,"sizeInBytes":123,"sortValues":["string"],"syncHash":"string","version":123},"investigationIDs":["string"],"isDetectable":true,"isPreventable":true,"isShared":true,"lastReputationRun":"string","lastSeen":"string","lastSeenEntryID":"string","manualExpirationTime":"string","manualScore":true,"manualSetTime":"string","manuallyEditedFields":["string"],"modified":"string","modifiedTime":"string","moduleToFeedMap":{"additionalProperties":{"ExpirationSource":{"brand":"string","expirationInterval":123,"expirationPolicy":"string","instance":"string","moduleId":"string","setTime":"string","source":"string","user":"string"},"bypassExclusionList":true,"classifierId":"string","classifierVersion":123,"comments":[{"content":"string","created":"2024-01-01T00:00:00Z","id":"12345678-1234-1234-1234-123456789abc","user":"string"}],"expirationInterval":123,"expirationPolicy":"string","fetchTime":"string","fields":{"additionalProperties":{}},"isEnrichment":true,"mapperId":"string","mapperVersion":123,"modifiedTime":"string","moduleId":"string","rawJSON":{"additionalProperties":{}},"relationships":[{"brand":"string","entityA":"string","entityAFamily":"string","entityAType":"string","entityB":"string","entityBFamily":"string","entityBType":"string","fields":{},"id":"12345678-1234-1234-1234-123456789abc","instance":"string","name":"Example Name","reliability":"string","reverseName":"Example Name","startTime":"string","type":"string"}],"reliability":"string","score":123,"sourceBrand":"string","sourceInstance":"string","timestamp":"2024-01-01T00:00:00Z","type":"string","value":"string"}},"numericId":123,"primaryTerm":123,"relatedIncCount":123,"score":123,"sequenceNumber":123,"setBy":"string","sizeInBytes":123,"sortValues":["string"],"source":"string","sourceBrands":["string"],"sourceInstances":["string"],"syncHash":"string","timestamp":"2024-01-01T00:00:00Z","value":"string","version":123}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
CustomFields | object | Output field: CustomFields |
CustomFields.additionalProperties | object | Output field: CustomFields.additionalProperties |
account | string | Count value |
aggregatedReliability | string | Output field: aggregatedReliability |
cacheVersn | number | Output field: cacheVersn |
calculatedTime | string | Time value |
comment | string | Output field: comment |
comments | array | Output field: comments |
comments.cacheVersn | number | Output field: comments.cacheVersn |
comments.category | string | Output field: comments.category |
comments.content | string | Response content |
comments.created | string | Output field: comments.created |
comments.entryId | string | Unique identifier |
comments.highlight | object | Output field: comments.highlight |
comments.highlight.additionalProperties | array | Output field: comments.highlight.additionalProperties |
comments.id | string | Unique identifier |
comments.indexName | string | Name of the resource |
comments.modified | string | Output field: comments.modified |
comments.numericId | number | Unique identifier |
comments.primaryTerm | number | Output field: comments.primaryTerm |
comments.sequenceNumber | number | Output field: comments.sequenceNumber |
comments.sizeInBytes | number | Output field: comments.sizeInBytes |
comments.sortValues | array | Value for the parameter |
Output Example
{"CustomFields":{"additionalProperties":{}},"account":"string","aggregatedReliability":"string","cacheVersn":123,"calculatedTime":"string","comment":"string","comments":[{"cacheVersn":123,"category":"string","content":"string","created":"2024-01-01T00:00:00Z","entryId":"string","highlight":{},"id":"12345678-1234-1234-1234-123456789abc","indexName":"Example Name","modified":"string","numericId":123,"primaryTerm":123,"sequenceNumber":123,"sizeInBytes":123,"sortValues":[],"source":"string"}],"creat...
Search Incidents
Performs a comprehensive search for incidents in Palo Alto Networks Cortex XSOAR V6, allowing filtering by various criteria.
Endpoint
- URL: /incidents/search
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
filter | object | Optional | Parameter for Search Incidents |
filter.parent | array | Optional | Parameter for Search Incidents |
filter.reason | array | Optional | Response reason phrase |
filter.notInvestigation | array | Optional | Parameter for Search Incidents |
filter.totalOnly | boolean | Optional | Parameter for Search Incidents |
filter.type | array | Optional | Type of the resource |
filter.fromActivatedDate | string | Optional | Date value |
filter.notCategory | array | Optional | Parameter for Search Incidents |
filter.fromDateLicense | string | Optional | Parameter for Search Incidents |
filter.andOp | boolean | Optional | Parameter for Search Incidents |
filter.searchAfterElastic | array | Optional | Efficient next page, pass max ES sort value from previous page. |
filter.searchBefore | array | Optional | Parameter for Search Incidents |
filter.details | string | Optional | Parameter for Search Incidents |
filter.id | array | Optional | Unique identifier |
filter.toActivatedDate | string | Optional | Date value |
filter.period | object | Optional | Parameter for Search Incidents |
filter.period.fromValue | string | Optional | Value for the parameter |
filter.period.toValue | string | Optional | Value for the parameter |
filter.period.byFrom | string | Optional | Parameter for Search Incidents |
filter.period.field | string | Optional | Parameter for Search Incidents |
filter.period.by | string | Optional | By is used for legacty, and if exists it will override ByTo and ByFrom. |
filter.period.byTo | string | Optional | Parameter for Search Incidents |
filter.searchAfterMapOrder | object | Optional | Efficient next page, pass max sort value from previous page. |
filter.level | array | Optional | Parameter for Search Incidents |
filter.query | string | Optional | Parameter for Search Incidents |
Input Example
{"json_body":{"filter":{"parent":["parent","parent"],"reason":["reason","reason"],"notInvestigation":["notInvestigation","notInvestigation"],"totalOnly":true,"type":["type","type"],"fromActivatedDate":"2000-01-23T04:56:07.000+00:00","notCategory":["notCategory","notCategory"],"fromDateLicense":"2000-01-23T04:56:07.000+00:00","andOp":true,"searchAfterElastic":["searchAfterElastic","searchAfterElastic"],"searchBefore":["searchBefore","searchBefore"],"details":"details","id":["id","id"],"toActivatedDate":"2000-01-23T04:56:07.000+00:00","period":{"fromValue":"fromValue","toValue":"toValue","byFrom":"byFrom","field":"field","by":"by","byTo":"byTo"},"searchAfterMapOrder":{},"level":[4,4],"query":"query","notStatus":[2,2],"sort":[{"asc":true,"field":"field","fieldType":"fieldType"}],"users":["users","users"],"fromDate":"2000-01-23T04:56:07.000+00:00","size":1,"fromReminder":"2000-01-23T04:56:07.000+00:00","name":["name","name"],"files":["files","files"],"searchAfter":["searchAfter","searchAfter"],"fromClosedDate":"2000-01-23T04:56:07.000+00:00","page":0,"fields":["fields","fields"],"Cache":{},"status":[2,2],"ignoreWorkers":true,"filterobjectquery":"filterobjectquery","urls":["urls","urls"],"systems":["systems","systems"],"includeTmp":true,"toClosedDate":"2000-01-23T04:56:07.000+00:00","searchAfterMap":{"key":["searchAfterMap","searchAfterMap"]},"toDueDate":"2000-01-23T04:56:07.000+00:00","fromDueDate":"2000-01-23T04:56:07.000+00:00","searchBeforeElastic":["searchBeforeElastic","searchBeforeElastic"],"toDate":"2000-01-23T04:56:07.000+00:00","trim_events":5,"toReminder":"2000-01-23T04:56:07.000+00:00","timeFrame":5,"investigation":["investigation","investigation"],"accounts":{},"category":["category","category"]},"userFilter":true}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
data | array | Response data |
data.account | string | Response data |
data.activated | string | Response data |
data.activatingingUserId | string | Response data |
data.allRead | boolean | Response data |
data.allReadWrite | boolean | Response data |
data.autime | number | Response data |
data.cacheVersn | number | Response data |
data.category | string | Response data |
data.closeNotes | string | Response data |
data.closeReason | string | Response data |
data.closed | string | Response data |
data.closingUserId | string | Response data |
data.created | string | Response data |
data.dbotCreatedBy | string | Response data |
data.dbotMirrorDirection | string | Response data |
data.dbotMirrorId | string | Response data |
data.dbotMirrorInstance | string | Response data |
total | number | Output field: total |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":[{}],"total":0}}
Search Indicators
Performs a search for indicators within Palo Alto Networks Cortex XSOAR V6 using specified filters.
Endpoint
- URL: indicators/search
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
Cache | object | Optional | Cache of join functions |
Cache.additionalProperties | array | Optional | Parameter for Search Indicators |
accounts | object | Optional | Accounts to search for |
accounts.additionalProperties | object | Optional | Parameter for Search Indicators |
earlyTimeInPage | string | Optional | Early time in page. |
fields | array | Optional | Fields to search for. |
filterobjectquery | string | Optional | Filter object query. |
firstSeen | object | Optional | Date Range Filter provides common fields for date filtering. |
firstSeen.fromDate | string | Optional | Start date for the date range filter. |
firstSeen.fromDateLicense | string | Optional | Start date for the date range filter. |
firstSeen.period | object | Optional | Period for the date range filter. |
firstSeen.period.by | string | Optional | By is used for legacy, and if exists it will override ByTo and ByFrom. |
firstSeen.period.byFrom | string | Optional | Start date for the date range filter. |
firstSeen.period.byTo | string | Optional | End date for the date range filter. |
firstSeen.period.field | string | Optional | Field to filter on. |
firstSeen.period.fromValue | string | Optional | From value for the date range filter. |
firstSeen.period.toValue | string | Optional | To value for the date range filter. |
firstSeen.timeFrame | number | Optional | A Duration represents the elapsed time between two instants as an int64 nanosecond count. The representation limits the largest representable duration to approximately 290 years. |
firstSeen.toDate | string | Optional | End date for the date range filter. |
fromDate | string | Optional | Start date for the date range filter. |
fromDateLicense | string | Optional | Start date for the date range filter. |
ignoreWorkers | boolean | Optional | Do not use workers mechanism while searching bleve. |
lastSeen | object | Optional | Date Range Filter provides common fields for date filtering. |
lastSeen.fromDate | string | Optional | Start date for the date range filter. |
lastSeen.fromDateLicense | string | Optional | Start date for the date range filter. |
Input Example
{"Cache":{"additionalProperties":["string"]},"accounts":{"additionalProperties":{}},"earlyTimeInPage":"string","fields":["string"],"filterobjectquery":"string","firstSeen":{"fromDate":"string","fromDateLicense":"string","period":{"by":"string","byFrom":"string","byTo":"string","field":"string","fromValue":"string","toValue":"string"},"timeFrame":123,"toDate":"string"},"fromDate":"string","fromDateLicense":"string","ignoreWorkers":true,"lastSeen":{"fromDate":"string","fromDateLicense":"string","period":{"by":"string","byFrom":"string","byTo":"string","field":"string","fromValue":"string","toValue":"string"},"timeFrame":123,"toDate":"string"},"laterTimeInPage":"string","page":123,"period":{"by":"string","byFrom":"string","byTo":"string","field":"string","fromValue":"string","toValue":"string"},"prevPage":true,"query":"string","searchAfter":["string"],"searchAfterElastic":["string"],"searchAfterMap":{"additionalProperties":["string"]},"searchAfterMapOrder":{"additionalProperties":123},"searchBefore":["string"],"searchBeforeElastic":["string"],"size":123,"sort":[{"asc":true,"field":"string","fieldType":"string"}],"timeFrame":123,"toDate":"string","trim_events":123}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
accountErrors | array | Error message if any |
iocObjects | array | Output field: iocObjects |
iocObjects.CustomFields | object | Output field: iocObjects.CustomFields |
iocObjects.CustomFields.additionalProperties | object | Output field: iocObjects.CustomFields.additionalProperties |
iocObjects.account | string | Count value |
iocObjects.aggregatedReliability | string | Output field: iocObjects.aggregatedReliability |
iocObjects.cacheVersn | number | Output field: iocObjects.cacheVersn |
iocObjects.calculatedTime | string | Time value |
iocObjects.comment | string | Output field: iocObjects.comment |
iocObjects.comments | array | Output field: iocObjects.comments |
iocObjects.comments.cacheVersn | number | Output field: iocObjects.comments.cacheVersn |
iocObjects.comments.category | string | Output field: iocObjects.comments.category |
iocObjects.comments.content | string | Response content |
iocObjects.comments.created | string | Output field: iocObjects.comments.created |
iocObjects.comments.entryId | string | Unique identifier |
iocObjects.comments.highlight | object | Output field: iocObjects.comments.highlight |
iocObjects.comments.highlight.additionalProperties | array | Output field: iocObjects.comments.highlight.additionalProperties |
iocObjects.comments.id | string | Unique identifier |
iocObjects.comments.indexName | string | Name of the resource |
iocObjects.comments.modified | string | Output field: iocObjects.comments.modified |
iocObjects.comments.numericId | number | Unique identifier |
iocObjects.comments.primaryTerm | number | Output field: iocObjects.comments.primaryTerm |
iocObjects.comments.sequenceNumber | number | Output field: iocObjects.comments.sequenceNumber |
Output Example
{"accountErrors":["string"],"iocObjects":[{"CustomFields":{},"account":"string","aggregatedReliability":"string","cacheVersn":123,"calculatedTime":"string","comment":"string","comments":[],"created":"2024-01-01T00:00:00Z","deletedFeedFetchTime":"string","expiration":"string","expirationSource":{},"expirationStatus":"active","firstSeen":"string","firstSeenEntryID":"string","highlight":{}}],"total":123,"totalAccounts":123}
Whitelists or Deletes Indicator
Whitelists or deletes an indicator in Cortex XSOAR V6. To delete without whitelisting, set the doNotWhitelist field to true.
Endpoint
- URL: /indicator/whitelist
- Method: POST
Input
Argument Name | Type | Required | Description |
|---|---|---|---|
InvestigationId | string | Optional | The investigation ID. |
doNotWhitelist | boolean | Optional | Do not whitelist the indicator. |
entryId | string | Optional | The entry ID. |
manualScore | boolean | Optional | Manual score the indicator. |
reason | string | Optional | The reason for the whitelist or delete. |
reputation | number | Optional | The reputation of the indicator. |
reputations | array | Optional | The reputations of the indicator. |
value | string | Optional | The value of the indicator. |
Input Example
{"json_body":{"InvestigationId":"example","doNotWhitelist":false,"entryId":"example","manualScore":false,"reason":"example","reputation":0,"reputations":["example"],"value":"example"}}
Output
Parameter | Type | Description |
|---|---|---|
status_code | number | HTTP status code of the response |
reason | string | Response reason phrase |
notUpdated | number | Output field: notUpdated |
updatedIds | array | Unique identifier |
uppdated | number | Output field: uppdated |
Output Example
{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"notUpdated":0,"updatedIds":["example"],"uppdated":0}}
Response Headers
Header | Description | Example |
|---|---|---|
Content-Type | The media type of the resource | application/json |
Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |