Cortex XDR is the world's first detection and response app that natively integrates network, endpoint and cloud data to stop sophisticated attacks.

To sync incidents between Demisto and Cortex XDR, you should use the XDRSyncScript script, which you can find in the automation page.

1. Fetch incidents from XDR
2. Get a list of incidents from XDR
3. Update incident in XDR

You need to collect several pieces of information in order to configure the integration on Demisto.

1. In your Cortex XDR platform, go to Settings.
2. Click the +New Key button in the top right corner
3. Generate a key of type Advanced.
4. Copy and paste the key.
5. From the ID column, copy the Key ID.

1. In your Cortex XDR platform, go to Settings.
2. Click the Copy URL button in the top right corner.

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for Palo Alto Networks Cortex XDR - Investigation and Response .
3. Click Add instance to create and configure a new integration instance.
   • Name: a textual name for the integration instance.
   • Fetch incidents
   • Incident type
   • Server URL (copy url from XDR - press ? to see more info)
   • API Key ID
   • API Key
   • Trust any certificate (insecure)
   • Use system proxy
   • First fetch timestamp ( , e.g., 12 hours, 7 days)
4. Click Test to validate the URLs, token, and connection.

incident_id:31
creation_time:1564594008755
modification_time:1566339537617
detection_time:null
status:new
severity:low
description:6 'Microsoft Windows RPC Fragment Evasion Attempt' alerts detected by PAN NGFW on 6 hosts
assigned_user_mail:null
assigned_user_pretty_name:null
alert_count:6
low_severity_alert_count:0
med_severity_alert_count:6
high_severity_alert_count:0
user_count:1
host_count:6
notes:null
resolve_comment:null
manual_severity:low
manual_description:null
xdr_url:https://1111.paloaltonetworks.com/incident-view/31

You can execute these commands from the Demisto CLI, as part of an automation, or in a playbook.
After you successfully execute a command, a DBot message appears in the War Room with the command details.

1. Get a list of incidents: xdr-get-incidents
2. Get extra data for an incident: xdr-get-incident-extra-data
3. Update an incident: xdr-update-incident

Returns a list of incidents, which you can filter by a list of incident IDs (max 100), the time the incident was last modified, and the time the incident was created. If you pass multiple filtering arguments, they will be concatenated using the AND condition. The OR condition is not supported.

xdr-get-incidents

!xdr-get-incidents incident_id_list="30,12,33"

!xdr-get-incidents since_creation_time="3 month" sort_by_creation_time="asc" page="0" limit="3"

{
    "PaloAltoNetworksXDR.Incident": [
        {
            "host_count": 6, 
            "incident_id": "1", 
            "manual_severity": null, 
            "description": "'SMB: User Password Brute Force Attempt' along with 8 other alerts generated by PAN NGFW detected on 6 hosts", 
            "severity": "high", 
            "modification_time": 1566994926897, 
            "assigned_user_pretty_name": "Michael Foo", 
            "notes": null, 
            "creation_time": 1564423080364, 
            "alert_count": 9, 
            "med_severity_alert_count": 5, 
            "detection_time": null, 
            "assigned_user_mail": "[email protected]", 
            "resolve_comment": "some comment", 
            "status": "resolved_false_positive", 
            "user_count": 1, 
            "xdr_url": "https://1111.paloaltonetworks.com/incident-view/1", 
            "low_severity_alert_count": 0, 
            "high_severity_alert_count": 4, 
            "manual_description": null
        }, 
        {
            "host_count": 1, 
            "incident_id": "2", 
            "manual_severity": null, 
            "description": "7 'SIP INVITE Method Request Flood Attempt' alerts detected by PAN NGFW on host 10.54.12.6 ", 
            "severity": "high", 
            "modification_time": 1565263085359, 
            "assigned_user_pretty_name": "Michael Foo", 
            "notes": null, 
            "creation_time": 1564424187325, 
            "alert_count": 7, 
            "med_severity_alert_count": 0, 
            "detection_time": null, 
            "assigned_user_mail": "[email protected]", 
            "resolve_comment": "Possible white list and FP", 
            "status": "resolved_other", 
            "user_count": 1, 
            "xdr_url": "https://1111.paloaltonetworks.com/incident-view/2", 
            "low_severity_alert_count": 0, 
            "high_severity_alert_count": 7, 
            "manual_description": null
        }, 
        {
            "host_count": 7, 
            "incident_id": "3", 
            "manual_severity": null, 
            "description": "'HTTP Unauthorized Brute Force Attack' along with 25 other alerts generated by PAN NGFW detected on 7 hosts", 
            "severity": "high", 
            "modification_time": 1566812108905, 
            "assigned_user_pretty_name": "Michael Foo", 
            "notes": null, 
            "creation_time": 1564424454867, 
            "alert_count": 26, 
            "med_severity_alert_count": 0, 
            "detection_time": null, 
            "assigned_user_mail": "[email protected]", 
            "resolve_comment": null, 
            "status": "new", 
            "user_count": 1, 
            "xdr_url": "https://1111.paloaltonetworks.com/incident-view/3", 
            "low_severity_alert_count": 0, 
            "high_severity_alert_count": 26, 
            "manual_description": null
        }
    ]
}

Returns additional data for the specified incident, for example, related alerts, file artifacts, network artifacts, and so on.

FILL IN REQUIRED PERMISSIONS HERE

xdr-get-incident-extra-data

!xdr-get-incident-extra-data incident_id="1" alerts_limit="10"

{
    "PaloAltoNetworksXDR.Incident": {
        "host_count": 6, 
        "manual_severity": null, 
        "xdr_url": "https://1111.paloaltonetworks.com/incident-view/1", 
        "assigned_user_pretty_name": "Michael Foo", 
        "alert_count": 9, 
        "med_severity_alert_count": 5, 
        "detection_time": null, 
        "user_count": 1, 
        "severity": "high", 
        "alerts": [
            {
                "category": "Vulnerability", 
                "action_pretty": "Detected (Raised An Alert)", 
                "description": "Vulnerability Exploit Detection", 
                "severity": "high", 
                "host_ip": "10.54.12.6", 
                "source": "PAN NGFW", 
                "alert_id": "1", 
                "host_name": "10.54.12.6", 
                "detection_timestamp": 1564408244000, 
                "action": "DETECTED_4", 
                "user_name": null, 
                "name": "SMB: User Password Brute Force Attempt"
            }, 
            {
                "category": "Vulnerability", 
                "action_pretty": "Detected (Raised An Alert)", 
                "description": "Vulnerability Exploit Detection (#BLVFILE3)", 
                "severity": "medium", 
                "host_ip": "10.54.12.6", 
                "source": "PAN NGFW", 
                "alert_id": "21", 
                "host_name": "10.54.12.6, 
                "detection_timestamp": 1564422346000, 
                "action": "DETECTED_4", 
                "user_name": null, 
                "name": "Microsoft Windows RPC Fragment Evasion Attempt"
            }, 
            {
                "category": "Vulnerability", 
                "action_pretty": "Detected (Raised An Alert)", 
                "description": "Vulnerability Exploit Detection", 
                "severity": "high", 
                "host_ip": "10.54.12.6", 
                "source": "PAN NGFW", 
                "alert_id": "26", 
                "host_name": "10.54.12.6", 
                "detection_timestamp": 1564431024000, 
                "action": "DETECTED_4", 
                "user_name": null, 
                "name": "SMB: User Password Brute Force Attempt"
            }, 
            {
                "category": "Vulnerability", 
                "action_pretty": "Detected (Raised An Alert)", 
                "description": "Vulnerability Exploit Detection", 
                "severity": "medium", 
                "host_ip": "10.54.12.6", 
                "source": "PAN NGFW", 
                "alert_id": "44", 
                "host_name": "10.54.12.6", 
                "detection_timestamp": 1564480944000, 
                "action": "DETECTED_4", 
                "user_name": null, 
                "name": "Microsoft Windows RPC Fragment Evasion Attempt"
            }, 
            {
                "category": "Vulnerability", 
                "action_pretty": "Detected (Raised An Alert)", 
                "description": "Vulnerability Exploit Detection", 
                "severity": "high", 
                "host_ip": "10.54.12.6", 
                "source": "PAN NGFW", 
                "alert_id": "83", 
                "host_name": "10.54.12.6", 
                "detection_timestamp": 1564681179000, 
                "action": "DETECTED_4", 
                "user_name": null, 
                "name": "SMB: User Password Brute Force Attempt"
            }, 
            {
                "category": "Vulnerability", 
                "action_pretty": "Detected (Raised An Alert)", 
                "description": "Vulnerability Exploit Detection (#BLVFILE3)", 
                "severity": "medium", 
                "host_ip": "10.54.12.6", 
                "source": "PAN NGFW", 
                "alert_id": "113", 
                "host_name": "10.54.12.6", 
                "detection_timestamp": 1564868791000, 
                "action": "DETECTED_4", 
                "user_name": null, 
                "name": "Microsoft Windows RPC Fragment Evasion Attempt"
            }, 
            {
                "category": "Vulnerability", 
                "action_pretty": "Detected (Raised An Alert)", 
                "description": "Vulnerability Exploit Detection", 
                "severity": "high", 
                "host_ip": "10.54.12.6", 
                "source": "PAN NGFW", 
                "alert_id": "121", 
                "host_name": "10.54.12.6", 
                "detection_timestamp": 1564943165000, 
                "action": "DETECTED_4", 
                "user_name": null, 
                "name": "SMB: User Password Brute Force Attempt"
            }, 
            {
                "category": "Vulnerability", 
                "action_pretty": "Detected (Raised An Alert)", 
                "description": "Vulnerability Exploit Detection", 
                "severity": "medium", 
                "host_ip": "10.54.12.6", 
                "source": "PAN NGFW", 
                "alert_id": "135", 
                "host_name": "10.54.12.6", 
                "detection_timestamp": 1565027542000, 
                "action": "DETECTED_4", 
                "user_name": null, 
                "name": "Microsoft Windows RPC Fragment Evasion Attempt"
            }, 
            {
                "category": "Vulnerability", 
                "action_pretty": "Detected (Raised An Alert)", 
                "description": "Vulnerability Exploit Detection", 
                "severity": "medium", 
                "host_ip": "10.54.12.6", 
                "source": "PAN NGFW", 
                "alert_id": "480", 
                "host_name": "10.54.12.6", 
                "detection_timestamp": 1565238356000, 
                "action": "DETECTED_4", 
                "user_name": null, 
                "name": "Microsoft Windows RPC Fragment Evasion Attempt"
            }
        ], 
        "low_severity_alert_count": 0, 
        "status": "resolved_false_positive", 
        "description": "'SMB: User Password Brute Force Attempt' along with 8 other alerts generated by PAN NGFW detected on 6 hosts", 
        "resolve_comment": "some comment", 
        "creation_time": 1564423080364, 
        "modification_time": 1566994926897, 
        "network_artifacts": [
            {
                "network_remote_port": 445, 
                "alert_count": 9, 
                "network_remote_ip": "10.54.12.6", 
                "is_manual": false, 
                "network_domain": null, 
                "type": "IP", 
                "network_country": null
            }
        ], 
        "file_artifacts": [], 
        "manual_description": null, 
        "incident_id": "1", 
        "notes": null, 
        "assigned_user_mail": "[email protected]", 
        "high_severity_alert_count": 4
    }
}

No entries.

Updates one or more fields of a specified incident. Missing fields will be ignored. To remove the assignment for an incident, pass a null value in assignee email argument.

FILL IN REQUIRED PERMISSIONS HERE

xdr-update-incident

There is no context output for this command.

!xdr-update-incident incident_id="1" status="RESOLVED_FALSE_POSITIVE" resolve_comment="some comment"

Incident 1 has been updated