Which malware protection module is effective in the post-execution cycle?

This Integration is part of the Cortex XDR by Palo Alto Networks Pack.#

Cortex XDR is the world's first detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks. This integration was integrated and tested with version 2.6.5 of Cortex XDR - IR

Configure Palo Alto Networks Cortex XDR - Investigation and Response on Cortex XSOAR#

1. Navigate to Settings > Integrations > Servers & Services.

2. Search for Palo Alto Networks Cortex XDR - Investigation and Response.

3. Click Add instance to create and configure a new integration instance.

   Parameter	Description	Required
   Fetch incidents		False
   Incident type		False
   Incident Mirroring Direction		False
   Server URL (copy URL from XDR - click ? to see more info.)		True
   API Key ID		True
   API Key		True
   Only fetch starred incidents		False
   Starred incidents fetch window ( , e.g., 12 hours, 7 days)		False
   HTTP Timeout	The timeout of the HTTP requests sent to Cortex XDR API (in seconds).	False
   Maximum number of incidents per fetch	The maximum number of incidents per fetch. Cannot exceed 100.	False
   First fetch timestamp ( , e.g., 12 hours, 7 days)		False
   Sync Incident Owners	For Cortex XSOAR version 6.0.0 and above. If selected, for every incident fetched from Cortex XDR to Cortex XSOAR, the incident owners will be synced. Note that once this value is changed and synchronized between the systems, additional changes will not be reflected. For example, if you change the owner in Cortex XSOAR, the new owner will also be changed in Cortex XDR. However, if you now change the owner back in Cortex XDR, this additional change will not be reflected in Cortex XSOAR. In addition, for this change to be reflected, the owners must exist in both Cortex XSOAR and Cortex XDR.	False
   Trust any certificate (not secure)		False
   Use system proxy settings		False
   Incident Statuses to Fetch	The statuses of the incidents that will be fetched. If no status is provided then incidents of all the statuses will be fetched. Note: An incident whose status was changed to a filtered status after its creation time will not be fetched.	False

4. Click Test to validate the URLs, token, and connection.

Configuration#

You need to collect several pieces of information in order to configure the integration on Cortex XSOAR.

Generate an API Key and API Key ID#

1. In your Cortex XDR platform, go to Settings.
2. Click the +New Key button in the top right corner.
3. Generate a key of type Advanced.
4. Copy and paste the key.
5. From the ID column, copy the Key ID.

URL#

1. In your Cortex XDR platform, go to Settings.
2. Click the Copy URL button in the top right corner.

Playbooks#

Cortex XDR Incident Handling#

The playbook syncs and updates new XDR alerts that construct the incident. It enriches indicators using Threat Intelligence integrations and Palo Alto Networks AutoFocus. The incident's severity is then updated based on the indicators reputation and an analyst is assigned for manual investigation. If chosen, automated remediation with Palo Alto Networks FireWall is initiated. After a manual review by the SOC analyst, the XDR incident is closed automatically.

Use Cases#

• Fetch incidents from XDR
• Enrich incident with alerts and incident from XDR
• Update incident in XDR
• Search for endpoints
• Isolate/unisolate endpoints
• Insert parsed alerts into XDR
• Insert CEF alerts into XDR
• Query for agent audit reports
• Query for audit management logs
• Create distribution
• Get distribution download URL
• Get distribution versions

Automation#

To sync incidents between Cortex XSOAR and Cortex XDR, you should use the XDRSyncScript script, which you can find in the automation page.

Fetched Incidents Data#

• Note: By checking the Fetch incident alerts and artifacts integration configuration parameter, fetched incidents will include additional data.

XDR Incident Mirroring#

Note this feature is available from Cortex XSOAR version 6.0.0

You can enable incident mirroring between Cortex XSOAR incidents and Cortex XDR incidents. To setup the mirroring follow these instructions:

1. Navigate to Settings > Integrations > Servers & Services.
2. Search for Cortex XDR - IR and select your integration instance.
3. Enable Fetches incidents.
4. Under Mapper (incoming), select XDR - Incoming Mapper.
5. Under Mapper (outgoing), select Cortex XDR - Outgoing Mapper.
6. In the Incident Mirroring Direction integration parameter, select in which direction the incidents should be mirrored:

• Incoming - Any changes in XDR incidents will be reflected in XSOAR incidents.
• Outgoing - Any changes in XSOAR incidents will be reflected in XDR incidents.
• Both - Changes in XSOAR and XDR incidents will be reflected in both directions.
• None - Choose this to turn off incident mirroring.

1. Optional: Check the Sync Incident Owners integration parameter to sync the incident owners in both XDR and XSOAR.

• Note: This feature will only work if the same users are registered in both Cortex XSOAR and Cortex XDR.

1. Newly fetched incidents will be mirrored in the chosen direction.

• Note: This will not effect existing incidents.

XDR Mirroring Notes, limitations and Troubleshooting#

• While you can mirror changes in incident fields both in and out in each incident, you can only mirror in a single direction at a time. For example: If we have an incident with two fields (A and B) in XDR and XSOAR while Incoming And Outgoing mirroring is selected:

  • I can mirror field A from XDR to XSOAR and field B from XSOAR to XDR.
  • I cannot mirror changes from field A in both directions.

  Initially all fields are mirrored in from XDR to XSOAR. Once they are changed in XSOAR, they can only be mirrored out.

• Do not use the XDRSyncScript automation nor any playbook that uses this automation (e.g Cortex XDR Incident Sync or Cortex XDR incident handling v2), as it impairs the mirroring functionality.

• When migrating an existing instance to the mirroring feature, or in case the mirroring does not work as expected, make sure that:

  • The default playbook of the Cortex XDR Incident incident type is not Cortex XDR Incident Sync, change it to a different playbook that does not use XDRSyncScript.
  • The XDR integration instance incoming mapper is set to Cortex XDR - Incoming Mapper and the outgoing mapper is set to Cortex XDR - Outgoing Mapper.

• The API includes a limit rate of 10 API requests per minute. Therefore, in a case of a limit rate exception, the sync loop will stop and will resume from the last incident.

Commands#

You can execute these commands from the Cortex XSOAR CLI, as part of an automation, or in a playbook. After you successfully execute a command, a DBot message appears in the War Room with the command details.

xdr-get-incidents#

Returns a list of incidents, which you can filter by a list of incident IDs (max. 100), the time the incident was last modified, and the time the incident was created. If you pass multiple filtering arguments, they will be concatenated using the AND condition. The OR condition is not supported.

Base Command#

xdr-get-incidents

Input#

Context Output#

"low","medium","high" | | PaloAltoNetworksXDR.Incident.low_severity_alert_count | String | Number of alerts with the severity LOW. | | PaloAltoNetworksXDR.Incident.status | String | Current status of the incident. Valid values are: "new","under_investigation","resolved_known_issue","resolved_duplicate","resolved_false_positive","resolved_true_positive","resolved_security_testing" or "resolved_other". | | PaloAltoNetworksXDR.Incident.starred | Boolean | Incident starred. | | PaloAltoNetworksXDR.Incident.description | String | Dynamic calculated description of the incident. | | PaloAltoNetworksXDR.Incident.resolve_comment | String | Comments entered by the user when the incident was resolved. | | PaloAltoNetworksXDR.Incident.notes | String | Comments entered by the user regarding the incident. | | PaloAltoNetworksXDR.Incident.creation_time | date | Date and time the incident was created on XDR. | | PaloAltoNetworksXDR.Incident.detection_time | date | Date and time that the first alert occurred in the incident. | | PaloAltoNetworksXDR.Incident.modification_time | date | Date and time that the incident was last modified. |

Command Example#

!xdr-get-incidents gte_creation_time=2010-10-10T00:00:00 limit=3 sort_by_creation_time=desc

Context Example#

Human Readable Output#

Incidents#

alert_count	assigned_user_mail	assigned_user_pretty_name	creation_time	description	detection_time	high_severity_alert_count	host_count	incident_id	low_severity_alert_count	manual_description	manual_severity	med_severity_alert_count	modification_time	notes	resolve_comment	severity	starred	status	user_count	xdr_url
5			1577276587937	5 'This alert from content TestXDRPlaybook' alerts detected by Checkpoint - SandBlast		4	1	4	0		medium	1	1579290004178		This issue was solved in Incident number 192304	medium	false	new	1	https://some.xdr.url.com/incident-view/4
1			1576100096594	'test 1' generated by Virus Total - Firewall		1	1	3	0		medium	0	1579237974014			medium	false	new	1	https://some.xdr.url.com/incident-view/3
2			1576062816474	'Alert Name Example 333' along with 1 other alert generated by Virus Total - VPN & Firewall-3 and Checkpoint - SandBlast		2	1	2	0		high	0	1579288790259			high	false	under_investigation	1	https://some.xdr.url.com/incident-view/2

xdr-get-incident-extra-data#

Returns additional data for the specified incident, for example, related alerts, file artifacts, network artifacts, and so on.

Base Command#

xdr-get-incident-extra-data

Input#

Context Output#

Command Example#

!xdr-get-incident-extra-data incident_id=4 alerts_limit=10

Context Example#

Human Readable Output#

Incident 4#

alert_count	assigned_user_mail	assigned_user_pretty_name	creation_time	description	detection_time	high_severity_alert_count	host_count	incident_id	low_severity_alert_count	manual_description	manual_severity	med_severity_alert_count	modification_time	notes	resolve_comment	severity	starred	status	user_count	xdr_url
5			1577276587937	5 'This alert from content TestXDRPlaybook' alerts detected by Checkpoint - SandBlast		4	1	4	0		medium	1	1579290004178		This issue was solved in Incident number 192304	medium	false	new	1	https://some.xdr.url.com/incident-view/4

Alerts#

action	action_external_hostname	action_file_md5	action_file_path	action_file_sha256	action_local_ip	action_local_port	action_pretty	action_process_image_command_line	action_process_image_name	action_process_image_sha256	action_process_signature_status	action_process_signature_vendor	action_registry_data	action_registry_full_key	action_remote_ip	action_remote_port	actor_process_command_line	actor_process_image_name	actor_process_signature_status	actor_process_signature_vendor	alert_id	category	causality_actor_causality_id	causality_actor_process_command_line	causality_actor_process_image_name	causality_actor_process_signature_status	causality_actor_process_signature_vendor	description	detection_timestamp	event_type	fw_app_id	host_ip_list	host_name	is_whitelisted	name	severity	source	starred	user_name
VALUE_NA, N/A					196.168.0.1	7000	VALUE_NA, N/A				N/A	N/A			2.2.2.2	8000			N/A	N/A	6					N/A	N/A	Test - alert generated by Test XDR Playbook	1577276586921	Network Event				No	Test - alert generated by Test XDR Playbook	medium	Cisco - Sandblast	false
VALUE_NA, N/A					196.168.0.111	2000	VALUE_NA, N/A				N/A	N/A			2.2.2.2	6000			N/A	N/A	7					N/A	N/A	This alert from content TestXDRPlaybook description	1577776701589	Network Event				No	This alert from content TestXDRPlaybook	high	Checkpoint - SandBlast	false
VALUE_NA, N/A					196.168.0.111	2000	VALUE_NA, N/A				N/A	N/A			2.2.2.2	6000			N/A	N/A	8					N/A	N/A	This alert from content TestXDRPlaybook description	1577958479843	Network Event				No	This alert from content TestXDRPlaybook	high	Checkpoint - SandBlast	false
VALUE_NA, N/A					196.168.0.111	2000	VALUE_NA, N/A				N/A	N/A			2.2.2.2	6000			N/A	N/A	9					N/A	N/A	This alert from content TestXDRPlaybook description	1578123895414	Network Event				No	This alert from content TestXDRPlaybook	high	Checkpoint - SandBlast	false
VALUE_NA, N/A					196.168.0.111	2000	VALUE_NA, N/A				N/A	N/A			2.2.2.2	6000			N/A	N/A	10					N/A	N/A	This alert from content TestXDRPlaybook description	1578927443615	Network Event				No	This alert from content TestXDRPlaybook	high	Checkpoint - SandBlast	false

Network Artifacts#

alert_count	is_manual	network_country	network_domain	network_remote_ip	network_remote_port	type
5	false			2.2.2.2	8000	IP

File Artifacts#

No entries.

Base Command#

xdr-update-incident

Input#

Context Output#

There is no context output for this command.

xdr-insert-parsed-alert#

Upload alert from external alert sources in Cortex XDR format. Cortex XDR displays alerts that are parsed successfully in related incidents and views. You can send 600 alerts per minute. Each request can contain a maximum of 60 alerts.

Base Command#

xdr-insert-parsed-alert

Input#

Context Output#

There is no context output for this command.

xdr-insert-cef-alerts#

Upload alerts in CEF format from external alert sources. After you map CEF alert fields to Cortex XDR fields, Cortex XDR displays the alerts in related incidents and views. You can send 600 requests per minute. Each request can contain a maximum of 60 alerts.

Base Command#

xdr-insert-cef-alerts

Input#

Context Output#

There is no context output for this command.

xdr-endpoint-isolate#

Isolates the specified endpoint.

Base Command#

xdr-endpoint-isolate

Input#

Context Output#

xdr-endpoint-unisolate#

Reverses the isolation of an endpoint.

Base Command#

xdr-endpoint-unisolate

Input#

Context Output#

xdr-get-endpoints#

Gets a list of endpoints, according to the passed filters. If there are no filters, all endpoints are returned. Filtering by multiple fields will be concatenated using AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of endpoint from the start of the result set (start by counting from 0).

Base Command#

xdr-get-endpoints

Input#

Context Output#

Command Example#

!xdr-get-endpoints isolate="unisolated" first_seen_gte="3 month" page="0" limit="30" sort_order="asc"

Context Example#

Human Readable Output#

Endpoints#

active_directory	alias	content_version	domain	endpoint_id	endpoint_name	endpoint_status	endpoint_type	endpoint_version	first_seen	group_name	install_date	installation_package	ip	is_isolated	last_seen	os_type	users
		111-17757		ea303670c76e4ad09600c8b346f7c804	aaaaa.compute.internal	CONNECTED	AGENT_TYPE_SERVER	7.0.0.1915	1575795969644		1575795969644	linux	172.31.11.11	AGENT_UNISOLATED	1579290023629	AGENT_OS_LINUX	ec2-user
		111-17757	WORKGROUP	f8a2f58846b542579c12090652e79f3d	EC2AMAZ-P7PPOI4	CONNECTED	AGENT_TYPE_SERVER	7.0.0.27797	1575796381739		1575796381739	Windows Server 2016	2.2.2.2	AGENT_UNISOLATED	1579289957412	AGENT_OS_WINDOWS	Administrator

xdr-get-distribution-versions#

Gets a list of all the agent versions to use for creating a distribution list.

Base Command#

xdr-get-distribution-versions

Input#

There are no input arguments for this command.

Context Output#

Command Example#

!xdr-get-distribution-versions

Context Example#

Human Readable Output#

windows#

versions
5.0.8.29673
5.0.9.30963
6.1.4.28751
7.0.0.28644

linux#

versions
6.1.4.1680
7.0.0.1916

macos#

versions
6.1.4.1681
7.0.0.1914

xdr-create-distribution#

Creates an installation package. This is an asynchronous call that returns the distribution ID. This does not mean that the creation succeeded. To confirm that the package has been created, check the status of the distribution by running the Get Distribution Status API.

Base Command#

xdr-create-distribution

Input#

Context Output#

Command Example#

!xdr-create-distribution agent_version=6.1.4.1680 name="dist_1" package_type=standalone platform=linux description="some description"

Context Example#

Human Readable Output#

Distribution 43aede7f846846fa92b50149663fbb25 created successfully

xdr-get-distribution-url#

Gets the distribution URL for downloading the installation package.

Base Command#

xdr-get-distribution-url

Input#

Context Output#

Command Example#

!xdr-get-distribution-url distribution_id=2c74c11b63074653aa01d575a82bf52a package_type=sh

xdr-get-create-distribution-status#

Gets the status of the installation package.

Base Command#

xdr-get-create-distribution-status

Input#

Context Output#

Command Example#

!xdr-get-create-distribution-status distribution_ids=2c74c11b63074653aa01d575a82bf52a

xdr-get-audit-management-logs#

Gets management logs. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of management logs from the start of the result set (start by counting from 0).

Context Example#

Human Readable Output#

Distribution Status#

id	status
2c74c11b63074653aa01d575a82bf52a	Completed

Base Command#

xdr-get-audit-management-logs

Input#

Context Output#

xdr-get-audit-agent-reports#

Gets agent event reports. You can filter by multiple fields, which will be concatenated using the AND condition (OR is not supported). Maximum result set size is 100. Offset is the zero-based number of reports from the start of the result set (start by counting from 0).

Base Command#

xdr-get-audit-agent-reports

Input#

Context Output#

xdr-blocklist-files#

Block lists requested files which have not already been block listed or added to allow lists.

Base Command#

xdr-blocklist-files

Input#

Context Output#

xdr-allowlist-files#

Adds requested files to allow list if they are not already on block list or allow list.

Base Command#

xdr-allowlist-files

Input#

Context Output#

xdr-file-quarantine#

Quarantines a file on selected endpoints. You can select up to 1000 endpoints.

Base Command#

xdr-file-quarantine

Input#

Context Output#

There is no context output for this command.

xdr-get-quarantine-status#

Retrieves the quarantine status for a selected file.

Base Command#

xdr-get-quarantine-status

Input#

Context Output#

There is no context output for this command.

xdr-file-restore#

Restores a quarantined file on requested endpoints.

Base Command#

xdr-file-restore

Input#

Context Output#

There is no context output for this command.

xdr-endpoint-scan-execute#

Runs a scan on a selected endpoint. To scan all endpoints, run this command with argument all=true. Do note that scanning all the endpoints may cause performance issues and latency.

Base Command#

xdr-endpoint-scan-execute

Input#

Context Output#

xdr-endpoint-scan-abort#

Cancel the scan of selected endpoints. A scan can only be aborted if the selected endpoints are Pending or In Progress. To scan all endpoints, run the command with the argument all=true. Note that scanning all of the endpoints may cause performance issues and latency.

Base Command#

xdr-endpoint-scan-abort

Input#

Context Output#

get-mapping-fields#

Get mapping fields from remote incident. Please note that this method will not update the current incident, it's here for debugging purposes.

Base Command#

get-mapping-fields

Input#

There are no input arguments for this command.

Context Output#

There is no context output for this command.

get-remote-data#

Get remote data from a remote incident. Please note that this method will not update the current incident, it's here for debugging purposes.

Base Command#

get-remote-data

Input#

Context Output#

There is no context output for this command.

get-modified-remote-data#

Get the list of incidents that were modified since the last update. Please note that this method is here for debugging purposes. get-modified-remote-data is used as part of a Mirroring feature, which is available since version 6.1.

Base Command#

get-modified-remote-data

Input#

Context Output#

There is no context output for this command.

xdr-get-policy#

Gets the policy name for a specific endpoint.

Base Command#

xdr-get-policy

Input#

Context Output#

xdr-get-scripts#

Gets a list of scripts available in the scripts library.

Base Command#

xdr-get-scripts

Input#

Context Output#

xdr-delete-endpoints#

Deletes selected endpoints in the Cortex XDR app. You can delete up to 1000 endpoints.

Base Command#

xdr-delete-endpoints

Input#

Context Output#

There is no context output for this command.

xdr-get-endpoint-device-control-violations#

Gets a list of device control violations filtered by selected fields. You can retrieve up to 100 violations.

Base Command#

xdr-get-endpoint-device-control-violations

Input#

Context Output#

xdr-file-retrieve#

Retrieves files from selected endpoints. You can retrieve up to 20 files, from no more than 10 endpoints. At least one endpoint ID and one file path are necessary in order to run the command. After running this command, you can use the xdr-action-status-get command with returned action_id, to check the action status.

Base Command#

xdr-file-retrieve

Input#

Context Output#

xdr-retrieve-file-details#

View the file retrieved by the xdr-retrieve-files command according to the action ID. Before running this command, you can use the xdr-action-status-get command to check if this action completed successfully.

Base Command#

xdr-retrieve-file-details

Input#

Context Output#

xdr-get-script-metadata#

Gets the full definition of a specific script in the scripts library.

Base Command#

xdr-get-script-metadata

Input#

Context Output#

xdr-get-script-code#

Gets the code of a specific script in the script library.

Base Command#

xdr-get-script-code

Input#

Context Output#

xdr-action-status-get#

Retrieves the status of the requested actions according to the action ID.

Base Command#

xdr-action-status-get

Input#

Context Output#

xdr-run-script#

Initiates a new endpoint script execution action using a script from the script library.

Base Command#

xdr-run-script

Input#

Context Output#

xdr-snippet-code-script-execute#

Initiates a new endpoint script execution action using the provided snippet code.

Base Command#

xdr-snippet-code-script-execute

Input#

Context Output#

xdr-get-script-execution-status#

Retrieves the status of a script execution action.

Base Command#

xdr-get-script-execution-status

Input#

Context Output#

xdr-get-script-execution-results#

Retrieve the results of a script execution action.

Base Command#

xdr-get-script-execution-results

Input#

Context Output#

xdr-get-script-execution-result-files#

Gets the files retrieved from a specific endpoint during a script execution.

Base Command#

xdr-get-script-execution-result-files

Input#

Context Output#

xdr-script-commands-execute#

Initiate a new endpoint script execution of shell commands.

Base Command#

xdr-script-commands-execute

Input#

Context Output#

xdr-file-delete-script-execute#

Initiates a new endpoint script execution to delete the specified file.

Base Command#

xdr-file-delete-script-execute

Input#

Context Output#

xdr-file-exist-script-execute#

Initiates a new endpoint script execution to check if file exists.

Base Command#

xdr-file-exist-script-execute

Input#

Context Output#

xdr-kill-process-script-execute#

Initiates a new endpoint script execution kill process.

Base Command#

xdr-kill-process-script-execute

Input#

Context Output#

endpoint#

Returns information about an endpoint.

Base Command#

endpoint

Input#

Context Output#

xdr-get-endpoints-by-status#

Returns the number of the connected\disconnected endpoints.

Base Command#

xdr-get-endpoints-by-status

Input#

Context Output#

xdr-get-cloud-original-alerts#

Returns information about each alert ID.

Base Command#

xdr-get-cloud-original-alerts

Input#

Context Output#

xdr-remove-allowlist-files#

Removes requested files from allow list.

Base Command#

xdr-remove-allowlist-files

Input#

Context Output#

xdr-remove-blocklist-files#

Removes requested files from block list.

Base Command#

xdr-remove-blocklist-files

Input#

Context Output#

There is no context output for this command.

xdr-get-alerts#

Returns a list of alerts and their meta-data, which you can filter by built-in arguments or use the custom_filter to input a JSON filter object. Multiple filter arguments will be concatenated using AND operator, while arguments that support a comma-separated list of values will use an OR operator between each value.

Base Command#

xdr-get-alerts

Input#

Context Output#

xdr-get-contributing-event#

Retrieves contributing events for a specific alert.

Base Command#

xdr-get-contributing-event

Input#

Context Output#

Command example#

``!xdr-get-contributing-event alert_ids=[123456 , 123457]````

Context Example#

Human Readable Output#

Contributing events#

Alert _ Id	Events
123456	- Logon_Type: 7 User_Name: xsoar Domain: WIN10X64 Source_IP: 1.1.1.1 Process_Name: C:\Windows\System32\svchost.exe Host_Name: WIN10X64 Raw_Message: An account was successfully logged on. _time: 165298280000 555555: a1b2c3d4 222222: 165298280000 333333: abcdef 111111: 15 444444: 1 insert_timestamp: 165298280001 _vendor: PANW _product: XDR agent _is_cardable: true
123457	- Logon_Type: 7 User_Name: xsoar Domain: WIN10X64 Source_IP: 1.1.1.1 Process_Name: C:\Windows\System32\svchost.exe Host_Name: WIN10X64 Raw_Message: An account was successfully logged on. _time: 165298280000 555555: ghijk 222222: 165298280000 333333: abcdef 111111: 15 444444: 1 insert_timestamp: 165298280001 _vendor: PANW _product: XDR agent _is_cardable: true

xdr-replace-featured-field#

Replace the featured hosts\users\ip addresses\active directory groups listed in your environment.

Base Command#

xdr-replace-featured-field

Input#

Context Output#

Command example#

``!xdr-replace-featured-field field_type=ip_addresses values=["1.1.1.1"] comments=new ip address````

Context Example#

Human Readable Output#

Replaced featured: ip_addresses#

Comment	Value
new ip address	1.1.1.1

xdr-script-run#

This command will soon be deprecated; prefer xdr-script-run instead. Initiates a new endpoint script execution action using a script from the script library.

Base Command#

xdr-script-run

Input#

Context Output#

Command example#

!xdr-script-run endpoint_ids=1 script_uid=123

Human Readable Output#

Waiting for the script to finish running on the following endpoints: ['1']...

Script Execution Results - 10368#

_return_value	domain	endpoint_id	endpoint_ip_address	endpoint_name	endpoint_status	execution_status	failed_files	retention_date	retrieved_files	standard_output
Name: return value	WORKGROUP	1	1.1.1.1	WIN10X64	STATUS_010_CONNECTED	COMPLETED_SUCCESSFULLY	0		0

Context Example#

Which malware protection module uses a machine learning technique to detect malware?

What is difference between XDR and EDR?

Which endpoint protection technique is commonly used to prevent end users from running Unauthorised applications including malware on their endpoints?

What does cortex XDR prevent do for endpoints?