DOCSEARCHbyAlgolia
Submit Docs

Cortex XSOAR Documentation

website·Indexed 35 days ago

https://xsoar.pan.dev/

Reference documentation for Cortex XSOAR scripts and integration packs, including the Common Scripts Pack, ServiceNow Pack, SekoiaXDR Pack, and Cortex REST API Pack. Provides details on supported versions and script functionality for security orchestration, automation, and response across Cortex XSOAR, Cortex XSIAM, and Cortex XPANSE.

Tokens
4.3M
Snippets
20.4K
Records
31.4K
Agent score
71%

What's inside Cortex XSOAR

  4. Overview of the TIM - Process Domain Registrant With Whois playbook

    The 'TIM - Process Domain Registrant With Whois' playbook is part of the Whois Pack. It is used to compare a domain registrant (the company or entity that owns the domain) against a provided Cortex XSOAR list of approved registrants. It is supported on Cortex XSOAR versions 5.5.0 and later, as well as Cortex XSIAM.

  5. Overview of Google Vertex AI integration for XSOAR

    The Google Vertex AI integration for Cortex XSOAR and Cortex XSIAM allows users to conduct natural conversations using the Generative AI model (PaLM) via Chat prediction. Note that this integration uses an early version of the Generative AI API from Google, and users may encounter some challenges.

  6. Overview of the PAN-OS Policy Optimizer content pack

    The PAN-OS Policy Optimizer content pack is available on Cortex XSOAR, Cortex XSIAM, and Cortex XPANSE. It is designed to work with Palo Alto Networks Next-Generation Firewalls or Panorama to automate AppID adoption and reduce the attack surface by:

    • Converting port-based rules to application-based rules.
    • Identifying and removing unused applications from security policy rules.
    • Identifying and removing unused rules that do not pass traffic.
    • Prioritizing rules for migration or cleanup based on characteristics.

  7. Overview of Panorama integration for Cortex XSOAR

    The Panorama integration is part of the PAN-OS by Palo Alto Networks Pack and is available on Cortex XSOAR, Cortex XSIAM, and Cortex XPANSE. It supports both Palo Alto Networks Panorama and Palo Alto Networks Firewall (versions 8.xx, 9.xx, 10.xx, and 11.xx). Users can create separate instances for Firewall and Panorama as they are not dependent on one another.

  8. Overview of DeCYFIR Event Collector for Cortex XSIAM

    The DeCYFIR Event Collector integration is available on Cortex XSIAM. It periodically fetches event logs from DeCYFIR APIs for ingestion and analysis. The integration supports three event types: Access Logs, Assets Logs, and Digital Risk Keywords Logs. It fetches events in real time from the moment it is enabled and automatically tracks timestamps and event IDs to prevent duplication.

  10. Overview of the ServiceNow Change Management Playbook

    The ServiceNow Change Management playbook is designed for users employing PAN-OS/Panorama firewalls and ServiceNow as a ticketing system. It automates the firewall change management process and is triggered by a fetch from ServiceNow. It is supported on Cortex XSOAR versions 6.1.0 and later and is part of the Change Management Pack.

  11. Overview of OProxy for OAuth2 authentication

    OProxy is a service maintained by Cortex XSOAR on Google Cloud that facilitates OAuth2 authentication flows with 3rd-party vendors (e.g., Microsoft). It provides integrations with a dedicated Application for the OAuth2 process and a well-known redirect URI for the authorization flow.

  12. Overview of EasyVista integration for Cortex XSOAR

    The EasyVista integration allows users to search for incidents and requests and retrieve their status and associated information. It is available on Cortex XSOAR and Cortex XSIAM and was tested with EasyVista v2016.1.300.2.