Cortex XSOAR Incident Response Orchestration
A 3-step recipe with Palo Alto Networks. We can help you get access.
Recipe · 3 steps
Cortex XSOAR Incident Response Orchestration
with Palo Alto Networks · Threat Detection & Response Management
Create an XSOAR incident, run a playbook, and add a war room entry.
- Create a new incident with an investigation so a playbook and war room entries can be attached to it.
- Execute the supplied playbook against the newly created incident.
- Record a work note in the incident's war room investigation.
What you'll need to have ready
- apiKey: Cortex XSOAR API key passed as the Authorization header.
- incidentName: Name for the new incident.
- incidentType: Incident type as defined in the XSOAR instance.
- severity: Incident severity (numeric XSOAR severity level).
- details: Free-text details describing the incident.
- playbookId: Identifier of the playbook to run against the incident.
- note: Work note to record in the investigation war room.
For your developer
Arazzo workflow palo-alto-networks:create-incident-and-run-playbook, 3 operations: createIncident → runPlaybook → addEntry. Specs on APIs.io.