capabilities.work

Cortex XDR Script Remediation with Result Polling

A 3-step recipe with Palo Alto Networks. We can help you get access.

Recipe · 3 steps

Cortex XDR Script Remediation with Result Polling

with Palo Alto Networks · Threat Detection & Response Management

Execute a Cortex XDR script on matched endpoints and collect the results.

  1. Return endpoints matching the filter so they can be targeted by the script run.
  2. Execute the supplied script against the resolved endpoint and capture the action id.
  3. Retrieve execution results for the action. Repeat while the action is still pending or in progress, and end once a terminal status is reached.
What you'll need to have ready
  • scriptUid: Unique identifier of the script from the Cortex XDR script library.
  • filterField: Endpoint field to filter on (e.g. endpoint_name, ip).
  • filterOperator: Comparison operator for the filter (e.g. eq, in).
  • filterValue: Value the filter field is compared against.
  • timeout: Script execution timeout in seconds.
For your developer

Arazzo workflow palo-alto-networks:run-script-and-collect-results, 3 operations: getEndpoints → runScript → getScriptExecutionResults. Specs on APIs.io.

More recipes with Palo Alto Networks

Cortex XDR Endpoint Isolation and VerificationCortex XDR Incident Triage and ResolutionCortex XDR XQL Threat HuntCortex XSIAM Incident-Driven Asset and XQL HuntCortex XSOAR Incident Response OrchestrationIoT Security Alert Investigation and ResolutionIoT Security Device Risk and Policy RecommendationPrisma Cloud Alert Triage and DismissalPrisma Cloud Policy Review and UpdatePrisma Cloud RQL Configuration and Asset Search