capabilities.work

Cortex XDR Incident Triage and Resolution

A 3-step recipe with Palo Alto Networks. We can help you get access.

Recipe · 3 steps

Cortex XDR Incident Triage and Resolution

with Palo Alto Networks · Threat Detection & Response Management

Triage a Cortex XDR incident end to end, from listing through resolution.

  1. Return incidents matching the supplied filter, requesting the first page of results sorted by creation time.
  2. Retrieve the full investigation context for the first incident, including its associated alerts and artifacts.
  3. Update the incident with the target status, severity, assignee, and resolution comment. Only the supplied fields are modified.
What you'll need to have ready
  • filterField: Incident field to filter on (e.g. status, severity, creation_time).
  • filterOperator: Comparison operator for the filter (e.g. eq, gte, lte).
  • filterValue: Value the filter field is compared against.
  • newStatus: Target incident status (new, under_investigation, resolved_threat_handled, resolved_known_issue, resolved_duplicate, resolved_false_positive, resolved_other).
  • newSeverity: Target incident severity (high, medium, low).
  • assignedUserMail: Email of the analyst to assign the incident to.
  • resolveComment: Resolution comment recorded when closing the incident.
For your developer

Arazzo workflow palo-alto-networks:triage-incident, 3 operations: postIncidentManagementGetIncidents → getIncidentExtraData → putApiIncidentsById. Specs on APIs.io.

More recipes with Palo Alto Networks

Cortex XDR Endpoint Isolation and VerificationCortex XDR Script Remediation with Result PollingCortex XDR XQL Threat HuntCortex XSIAM Incident-Driven Asset and XQL HuntCortex XSOAR Incident Response OrchestrationIoT Security Alert Investigation and ResolutionIoT Security Device Risk and Policy RecommendationPrisma Cloud Alert Triage and DismissalPrisma Cloud Policy Review and UpdatePrisma Cloud RQL Configuration and Asset Search