Skip to content

Commit ca83ca7

Browse files
nusantara-selfnusantara-self
authored
Merge pull request #1446 from TheHive-Project/add-paloaltocortexxdr-responders
Cortex XDR - new responder flavors
2 parents 01c1888 + d9aa8e5 commit ca83ca7

8 files changed

+649
-7
lines changed

‎responders/PaloAltoCortexXDR/PaloAltoCortexXDR_allow_list.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"name": "PaloAltoCortexXDR_allow_list",
3+
"version": "1.0",
4+
"author": "Joe Lazaro; Fabien Bloume, StrangeBee",
5+
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
6+
"license": "AGPL-V3",
7+
"description": "Add a file hash to the Cortex XDR allow list",
8+
"dataTypeList": [
9+
"thehive:case_artifact"
10+
],
11+
"command": "PaloAltoCortexXDR/cortex_xdr.py",
12+
"baseConfig": "PaloAltoCortexXDR",
13+
"config": {
14+
"service": "allow_list"
15+
},
16+
"registration_required": true,
17+
"subscription_required": true,
18+
"free_subscription": false,
19+
"service_homepage": "https://www.paloaltonetworks.com/cortex/cortex-xdr",
20+
"service_logo": {
21+
"path": "assets/cortex_logo.png",
22+
"caption": "logo"
23+
},
24+
"screenshots": [],
25+
"configurationItems": [
26+
{
27+
"name": "api_key",
28+
"description": "API key",
29+
"type": "string",
30+
"multi": false,
31+
"required": true
32+
},
33+
{
34+
"name": "api_key_id",
35+
"description": "API key ID",
36+
"type": "string",
37+
"multi": false,
38+
"required": true
39+
},
40+
{
41+
"name": "advanced_security",
42+
"description": "Set True if the API key was generated with Advanced security level. False for a Standard security key.",
43+
"type": "boolean",
44+
"multi": false,
45+
"required": true
46+
},
47+
{
48+
"name": "api_host",
49+
"description": "Fully qualified domain name for the API host. Example: api-example.xdr.us.paloaltonetworks.com",
50+
"type": "string",
51+
"multi": false,
52+
"required": true
53+
},
54+
{
55+
"name": "comment",
56+
"description": "Optional comment added to the allow list entry for audit purposes.",
57+
"type": "string",
58+
"multi": false,
59+
"required": false,
60+
"defaultValue": "Allowed via TheHive"
61+
}
62+
]
63+
}

‎responders/PaloAltoCortexXDR/PaloAltoCortexXDR_block_list.json‎

Lines changed: 63 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,63 @@
1+
{
2+
"name": "PaloAltoCortexXDR_block_list",
3+
"version": "1.0",
4+
"author": "Joe Lazaro; Fabien Bloume, StrangeBee",
5+
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
6+
"license": "AGPL-V3",
7+
"description": "Add a file hash to the Cortex XDR block list",
8+
"dataTypeList": [
9+
"thehive:case_artifact"
10+
],
11+
"command": "PaloAltoCortexXDR/cortex_xdr.py",
12+
"baseConfig": "PaloAltoCortexXDR",
13+
"config": {
14+
"service": "block_list"
15+
},
16+
"registration_required": true,
17+
"subscription_required": true,
18+
"free_subscription": false,
19+
"service_homepage": "https://www.paloaltonetworks.com/cortex/cortex-xdr",
20+
"service_logo": {
21+
"path": "assets/cortex_logo.png",
22+
"caption": "logo"
23+
},
24+
"screenshots": [],
25+
"configurationItems": [
26+
{
27+
"name": "api_key",
28+
"description": "API key",
29+
"type": "string",
30+
"multi": false,
31+
"required": true
32+
},
33+
{
34+
"name": "api_key_id",
35+
"description": "API key ID",
36+
"type": "string",
37+
"multi": false,
38+
"required": true
39+
},
40+
{
41+
"name": "advanced_security",
42+
"description": "Set True if the API key was generated with Advanced security level. False for a Standard security key.",
43+
"type": "boolean",
44+
"multi": false,
45+
"required": true
46+
},
47+
{
48+
"name": "api_host",
49+
"description": "Fully qualified domain name for the API host. Example: api-example.xdr.us.paloaltonetworks.com",
50+
"type": "string",
51+
"multi": false,
52+
"required": true
53+
},
54+
{
55+
"name": "comment",
56+
"description": "Optional comment added to the block list entry for audit purposes.",
57+
"type": "string",
58+
"multi": false,
59+
"required": false,
60+
"defaultValue": "Blocked via TheHive"
61+
}
62+
]
63+
}

‎responders/PaloAltoCortexXDR/PaloAltoCortexXDR_cancel_scan.json‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
{
2+
"name": "PaloAltoCortexXDR_cancel_scan",
3+
"version": "1.0",
4+
"author": "Joe Lazaro; Fabien Bloume, StrangeBee",
5+
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
6+
"license": "AGPL-V3",
7+
"description": "Cancel a running scan on endpoints identified by hostname or IP list",
8+
"dataTypeList": [
9+
"thehive:case_artifact"
10+
],
11+
"command": "PaloAltoCortexXDR/cortex_xdr.py",
12+
"baseConfig": "PaloAltoCortexXDR",
13+
"config": {
14+
"service": "cancel_scan"
15+
},
16+
"registration_required": true,
17+
"subscription_required": true,
18+
"free_subscription": false,
19+
"service_homepage": "https://www.paloaltonetworks.com/cortex/cortex-xdr",
20+
"service_logo": {
21+
"path": "assets/cortex_logo.png",
22+
"caption": "logo"
23+
},
24+
"screenshots": [],
25+
"configurationItems": [
26+
{
27+
"name": "api_key",
28+
"description": "API key",
29+
"type": "string",
30+
"multi": false,
31+
"required": true
32+
},
33+
{
34+
"name": "api_key_id",
35+
"description": "API key ID",
36+
"type": "string",
37+
"multi": false,
38+
"required": true
39+
},
40+
{
41+
"name": "advanced_security",
42+
"description": "Set True if the API key was generated with Advanced security level. False for a Standard security key.",
43+
"type": "boolean",
44+
"multi": false,
45+
"required": true
46+
},
47+
{
48+
"name": "api_host",
49+
"description": "Fully qualified domain name for the API host. Example: api-example.xdr.us.paloaltonetworks.com",
50+
"type": "string",
51+
"multi": false,
52+
"required": true
53+
},
54+
{
55+
"name": "scan_polling_interval",
56+
"description": "Interval, in seconds between requests for scan actions.",
57+
"type": "number",
58+
"multi": false,
59+
"required": false,
60+
"defaultValue": 30
61+
},
62+
{
63+
"name": "scan_max_polling_retries",
64+
"description": "Maximum number of time to retry action status when a cancel scan action is still in progress.",
65+
"type": "number",
66+
"multi": false,
67+
"required": false,
68+
"defaultValue": 30
69+
}
70+
]
71+
}

‎responders/PaloAltoCortexXDR/PaloAltoCortexXDR_initiate_forensics.json‎

Lines changed: 62 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,62 @@
1+
{
2+
"name": "PaloAltoCortexXDR_initiate_forensics",
3+
"version": "1.0",
4+
"author": "Joe Lazaro; Fabien Bloume, StrangeBee",
5+
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
6+
"license": "AGPL-V3",
7+
"description": "Initiate forensics triage collection on endpoints identified by hostname or IP list",
8+
"dataTypeList": [
9+
"thehive:case_artifact"
10+
],
11+
"command": "PaloAltoCortexXDR/cortex_xdr.py",
12+
"baseConfig": "PaloAltoCortexXDR",
13+
"config": {
14+
"service": "initiate_forensics"
15+
},
16+
"registration_required": true,
17+
"subscription_required": true,
18+
"free_subscription": false,
19+
"service_homepage": "https://www.paloaltonetworks.com/cortex/cortex-xdr",
20+
"service_logo": {
21+
"path": "assets/cortex_logo.png",
22+
"caption": "logo"
23+
},
24+
"screenshots": [],
25+
"configurationItems": [
26+
{
27+
"name": "api_key",
28+
"description": "API key",
29+
"type": "string",
30+
"multi": false,
31+
"required": true
32+
},
33+
{
34+
"name": "api_key_id",
35+
"description": "API key ID",
36+
"type": "string",
37+
"multi": false,
38+
"required": true
39+
},
40+
{
41+
"name": "advanced_security",
42+
"description": "Set True if the API key was generated with Advanced security level. False for a Standard security key.",
43+
"type": "boolean",
44+
"multi": false,
45+
"required": true
46+
},
47+
{
48+
"name": "api_host",
49+
"description": "Fully qualified domain name for the API host. Example: api-example.xdr.us.paloaltonetworks.com",
50+
"type": "string",
51+
"multi": false,
52+
"required": true
53+
},
54+
{
55+
"name": "collector_uuid",
56+
"description": "Optional UUID of the triage configuration preset to use. If not specified, the XDR default configuration is used.",
57+
"type": "string",
58+
"multi": false,
59+
"required": false
60+
}
61+
]
62+
}

‎responders/PaloAltoCortexXDR/PaloAltoCortexXDR_quarantine.json.disabled‎

Lines changed: 85 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,85 @@
1+
{
2+
"name": "PaloAltoCortexXDR_quarantine",
3+
"version": "1.0",
4+
"author": "Joe Lazaro",
5+
"url": "https://github.com/TheHive-Project/Cortex-Analyzers",
6+
"license": "AGPL-V3",
7+
"description": "Quarantine a file on endpoints identified by hostname or IP list. The file hash (SHA256) must be set in the responder configuration.",
8+
"dataTypeList": [
9+
"thehive:case_artifact"
10+
],
11+
"command": "PaloAltoCortexXDR/cortex_xdr.py",
12+
"baseConfig": "PaloAltoCortexXDR",
13+
"config": {
14+
"service": "quarantine"
15+
},
16+
"registration_required": true,
17+
"subscription_required": true,
18+
"free_subscription": false,
19+
"service_homepage": "https://www.paloaltonetworks.com/cortex/cortex-xdr",
20+
"service_logo": {
21+
"path": "assets/cortex_logo.png",
22+
"caption": "logo"
23+
},
24+
"screenshots": [],
25+
"configurationItems": [
26+
{
27+
"name": "api_key",
28+
"description": "API key",
29+
"type": "string",
30+
"multi": false,
31+
"required": true
32+
},
33+
{
34+
"name": "api_key_id",
35+
"description": "API key ID",
36+
"type": "string",
37+
"multi": false,
38+
"required": true
39+
},
40+
{
41+
"name": "advanced_security",
42+
"description": "Set True if the API key was generated with Advanced security level. False for a Standard security key.",
43+
"type": "boolean",
44+
"multi": false,
45+
"required": true
46+
},
47+
{
48+
"name": "api_host",
49+
"description": "Fully qualified domain name for the API host. Example: api-example.xdr.us.paloaltonetworks.com",
50+
"type": "string",
51+
"multi": false,
52+
"required": true
53+
},
54+
{
55+
"name": "file_hash",
56+
"description": "SHA256 hash of the file to quarantine.",
57+
"type": "string",
58+
"multi": false,
59+
"required": true
60+
},
61+
{
62+
"name": "file_path",
63+
"description": "Optional full path of the file to quarantine (e.g. C:\\path\\to\\file.exe). Do not use symbolic links.",
64+
"type": "string",
65+
"multi": false,
66+
"required": false
67+
},
68+
{
69+
"name": "scan_polling_interval",
70+
"description": "Interval, in seconds between requests for quarantine actions.",
71+
"type": "number",
72+
"multi": false,
73+
"required": false,
74+
"defaultValue": 30
75+
},
76+
{
77+
"name": "scan_max_polling_retries",
78+
"description": "Maximum number of time to retry action status when a quarantine action is still in progress.",
79+
"type": "number",
80+
"multi": false,
81+
"required": false,
82+
"defaultValue": 30
83+
}
84+
]
85+
}

0 commit comments

Comments
 (0)