capabilities.work

Cortex XSIAM Incident-Driven Asset and XQL Hunt

A 4-step recipe with Palo Alto Networks. We can help you get access.

Recipe · 4 steps

Cortex XSIAM Incident-Driven Asset and XQL Hunt

with Palo Alto Networks · Threat Detection & Response Management

Pivot from XSIAM incidents to assets and an XQL hunt with result polling.

  1. Return incidents matching the supplied filter, sorted by creation time.
  2. Enumerate assets matching the supplied asset filter for investigation context.
  3. Initiate the XQL query over the supplied relative timeframe and capture the query id.
  4. Retrieve the query results. Repeat while the query is still pending, and end once the status is SUCCESS, FAILED, or CANCELED.
What you'll need to have ready
  • filterField: Incident field to filter on (e.g. status, severity).
  • filterOperator: Comparison operator for the incident filter (e.g. eq, gte).
  • filterValue: Value the incident filter field is compared against.
  • assetFilterField: Asset field to filter on (e.g. asset_type, risk_score).
  • assetFilterValue: Value the asset filter field is compared against.
  • query: XQL query string to execute against the XSIAM data lake.
  • relativeTime: Relative time range for the XQL query (e.g. last_24_hours, last_7_days).
  • maxResults: Maximum number of XQL result rows to return.
For your developer

Arazzo workflow palo-alto-networks:incident-driven-hunt, 4 operations: postIncidentManagementGetIncidents → getApiAssets → startXqlQuery → getXqlQueryResults. Specs on APIs.io.

More recipes with Palo Alto Networks

Cortex XDR Endpoint Isolation and VerificationCortex XDR Incident Triage and ResolutionCortex XDR Script Remediation with Result PollingCortex XDR XQL Threat HuntCortex XSOAR Incident Response OrchestrationIoT Security Alert Investigation and ResolutionIoT Security Device Risk and Policy RecommendationPrisma Cloud Alert Triage and DismissalPrisma Cloud Policy Review and UpdatePrisma Cloud RQL Configuration and Asset Search