Skip to main content

Cortex XDR

cortex-xdr

Version: 1.3
Updated: Jul 11, 2023

Query data and utilize actions in Palo Alto Networks Cortex XDR.

Actions

  • List Endpoints (Enrichment) - Gets a list of endpoints.
  • Retrieve File (Enrichment) - Retrieve file from selected endpoints.
  • File Retrieval Details (Enrichment) - View the File retrieved by the Get File action according to the action ID.
  • Scan All Endpoints (Enrichment) - Run a scan on all endpoints.
  • Get Scan Status (Enrichment) - Get a status of the scan action ID.
  • Quarantine File (Containment) - Quarantine file on selected endpoint.
  • Quarantine Status (Enrichment) - Retrieve the quarantine status for a selected file.
  • Restore File (Containment) - Restore a quarantined file on a requested endpoints.
  • Isolate Endpoint (Containment) - Isolate one endpoint.
  • Isolate Endpoint Status (Enrichment) - Returns the status of the specified endpoint isolate operation.
  • List Alerts (Enrichment) - Get a list of alerts with multiple events.
  • Alerts Cortex XDR Daemon (Daemon) - Fetch alerts.
  • Incidents Cortex XDR Daemon (Daemon) - Fetch incidents.
  • List Incidents (Enrichment) - Get a list of incidents.
  • Get Incident (Enrichment) - Get extra data fields of a specific incident including alerts and key artifacts.
  • Update Incident (Containment) - Update one or more fields of a specific incident.

Category

XDR

Change Log

  • July 20, 2021 - First upload
  • July 19, 2022 - Incidents Cortex XDR Daemon action added
  • January 27, 2023 - Integration refactored
  • January 30, 2023 - Updated Daemon
    • Incidents Cortex XDR Daemon: refactored
    • Alerts Cortex XDR Daemon: refactored
  • July 11, 2023 (v1.3) - Removed leading/trailing spaces
Legal
Privacy Statement
Terms of Use

Copyright © 2024 by Sumo Logic, Inc.