Palo Alto Networks Cortex XDR Plugin for Risk Exchange

This document explains how to configure the Palo Alto Networks Cortex XDR v1.0.0 plugin with the Risk Exchange module of the Netskope Cloud Exchange platform. This plugin fetches Endpoints and Users data from Palo Alto Networks Cortex XDR platform. This plugin retrieves the endpoints from the Endpoint > All Endpoints page. This plugin also supports Isolate Endpoint, Un-Isolate Endpoint, Run Scan on Endpoint, Cancel Running Scan on Endpoint actions in the Palo Alto Networks Cortex XDR platform.

Netskope normalization score calculation for Endpoints and Users => 1000 * (1 – RiskScore/100)

Prerequisites

To complete this integration, you need:

• A Netskope tenant (or multiple, for example, production and development/test instances).
• A Netskope Cloud Exchange tenant with the Tenant plugin and Risk Exchange plugin already configured.
• Connectivity to Palo Alto Networks Cortex XDR platform.
• Subscriptions for these licenses with respective purposes:

• Access to generate API Base URL, API Key ID, API Key and pull Users, Endpoints and Hosts.
• Connectivity to the following host: https://api-**.xdr.**.paloaltonetworks.com.

Palo Alto Networks Cortex XDR Plugin Support

This plugin fetches Endpoints and Users data from Palo Alto Networks Cortex XDR platform. It retrieves the Endpoints from the Endpoint > All Endpoints page. This plugin also supports Isolate Endpoint, Un-Isolate Endpoint, Run Scan on Endpoint, Cancel Running Scan on Endpoint actions on Palo Alto Networks Cortex XDR platform.

Mappings

Mappings are used to view the pulled Users and Endpoints and their respective details. Fields mapped during plugin configuration will be visible on the Records page after the data is pulled. Here are the suggested mappings to use while configuring the plugin.

Pull Mappings for Users

Pull Mappings for Endpoints

Permissions

For fetching Users and Endpoints and performing actions using the plugin the user will need is role: Privileged Responder Role.

true

{
    "reply": [
        {
            "type": "user",
            "id": "xyz\\abc",
            "score": 0,
            "norm_risk_score": 0,
            "risk_level": "LOW",
            "reasons": [],
            "email": "string"
        }
    ]
}

{
  "request_data": {
    "search_from": 0,
    "search_to": 100
  }
}

{
    "reply": {
        "total_count": 4,
        "result_count": 1,
        "endpoints": [
            {
                "endpoint_id": "9713c1f5e2f8487e8d6783ee9e0987b8",
                "endpoint_name": "Win2k16-7-148",
                "endpoint_type": "AGENT_TYPE_SERVER",
                "endpoint_status": "CONNECTED",
                "os_type": "AGENT_OS_WINDOWS",
                "os_version": "10.0.14393",
                "ip": [
                    "10.50.7.148"
                ],
                "ipv6": [
                    "fda7:e6ee:2e09:0:809c:1627:e7e4:adcb"
                ],
                "public_ip": "140.246.76.125",
                "users": [
                    "xyz\\abc"
                ],
                "domain": "xyz.com",
                "alias": "",
                "first_seen": 1743498903224,
                "last_seen": 1743507983054,
                "content_version": "1730-14274",
                "installation_package": "",
                "active_directory": [],
                "install_date": 1743498903234,
                "endpoint_version": "8.7.0.7735",
                "is_isolated": "AGENT_UNISOLATED",
                "isolated_date": null,
                "group_name": [],
                "operational_status": "PROTECTED",
                "operational_status_description": "[]",
                "operational_status_details": [],
                "scan_status": "SCAN_STATUS_NONE",
                "content_release_timestamp": 1743502658000,
                "last_content_update_time": 1743503174008,
                "operating_system": "Windows Server 2016",
                "mac_address": [
                    "00:50:56:81:fc:fc"
                ],
                "assigned_prevention_policy": "Windows Default",
                "assigned_extensions_policy": "Windows Default",
                "token_hash": "",
                "tags": {
                    "server_tags": [],
                    "endpoint_tags": []
                },
                "content_status": "UP_TO_DATE"
            }
        ]
    }
}

{
    "reply": [
        {
            "type": "host",
            "id": "Win2k16-7-148",
            "score": 0,
            "norm_risk_score": 0,
            "risk_level": "LOW",
            "reasons": []
        }
    ]
}

{
            "request_data": {
                "filters": [
                    {
                        "field": "endpoint_id_list",
                        "operator": "in",
                        "value": endpoint_id_list,
                    }
                ],
                "incident_id": incident_id,
            }
        }

{
            "request_data": {
                "filters": [
                    {
                        "field": "endpoint_id_list",
                        "operator": "in",
                        "value": endpoint_id_list,
                    }
                ],
                "incident_id": incident_id,
            }
        }

{
            "request_data": {
                "filters": [
                    {
                        "field": "endpoint_id_list",
                        "operator": "in",
                        "value": endpoint_id_list,
                    }
                ],
                "incident_id": incident_id,
            }
        }

{
            "request_data": {
                "filters": [
                    {
                        "field": "endpoint_id_list",
                        "operator": "in",
                        "value": endpoint_id_list,
                    }
                ],
                "incident_id": incident_id,
            }
        }

Performance Matrix

Here are the performance readings conducted on a Large CE Stack with these VM specifications by pulling 500K Users and Endpoints from the Palo Alto Networks Cortex XDR plugin.

User Agent

netskope-ce-5.1.1-cre-palo-alto-networks-cortex-xdr-v1.0.0

Workflow

1. Get your API Base URL, API Key ID and API Key
2. Configure the Palo Alto Networks Cortex XDR plugin
3. Add a Business Rule
4. Add Actions.
5. Validate the plugin

Watch a Video

Click play to watch a video:

Get your API Base URL, API Key ID, and API Key

To add permissions to a role:

1. Log in to your Palo Alto Networks Cortex XDR account.
2. Go to Settings > Configuration.
3. Go to Roles under Access Management.
4. Click + New Role, and enter a Role Name, Description, and select the required permissions. For the minimum requirement of the API Key Role, refer to Permissions.
5. Click Save.

To get your API Base URL, API Key ID, and API Key:

1. Go to API Keys under Integrations.
2. Click Copy API URL to get the API Base URL.
3. Click + New Key and add the Security level, Role, and Expiration Date fields.
4. Clicking Generate and copy the API Key and API Key ID.

Configure the Palo Alto Networks Cortex XDR Plugin

1. In Cloud Exchange, go to Settings > Plugins. Search for and select the Palo Alto Networks Cortex XDR v1.0.0 (CRE) plugin box.
2. Add a plugin configuration name, and change the sync interval if needed. 
3. Click Next and enter the configuration parameters:
   • API Base URL: The API Base URL of your Palo Alto Networks Cortex XDR tenant. For example: https://api-<tenant-name>.xdr.<region>.paloaltonetworks.com.
   • API Key ID: The API Key ID you copied previously.
   • API Key: The API Key you copied previously.
   • Authentication Method: Select the authentication method chosen while creating the API Key.

   

4. Click Next. Select the Entity from the Entity dropdown. The Entity fields can be created from the Schema Editor page, or click + Add Field from the field dropdown. Provide the field mapping. For the suggested mappings, refer to Mappings.
5. Click Save.

Add a Risk Exchange Business Rule for Palo Alto Networks Cortex XDR

1. In Risk Exchange, go to Business Rules.
2. Click Create New Rule in the top right corner.
3. Enter a Rule Name. Select the Entity Fields use to configure for the Palo Alto Networks Cortex XDR plugin, and configure the query based on your requirements. Click Save.

Add Risk Exchange Actions for Palo Alto Networks Cortex XDR

The Palo Alto Networks Cortex XDR plugin supports these actions for Endpoints:

• Isolate Endpoint will isolate the endpoint on Palo Alto Networks Cortex XDR.
• Un-isolate Endpoint will un-isolate the endpoint on Palo Alto Networks Cortex XDR.
• Run Scan on Endpoint will start scanning the endpoint on Palo Alto Networks Cortex XDR.
• Cancel Running Scan on Endpoint will stop running scans on the endpoint on Palo Alto Networks Cortex XDR.
• No Action will not perform any action on Users/Endpoints.

Note that you can perform the Netskope related actions on the Users and Endpoints pulled from Palo Alto Networks Cortex XDR. Refer to Risk Exchange in order to configure the actions and their validations.

To configure these actions, follow the steps in the appropriate section.

Isolate Endpoint

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select a Business Rule, and for Target Plugin Configuration, select your configured plugin.
3. In the Actions dropdown, select Isolate Endpoint.
4. For Action Parameters, select the option for Endpoint ID, if users need to filter out endpoints using business rules.
5. Provide a static Incident ID, which can be created for an Incident on Palo Alto Networks Cortex XDR Incident ViewTimeline tab.
6. Enable the Require Approval toggle if Approval is needed before performing action on the users.
7. Click Save.

Un-isolate Endpoint

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select a Business Rule, and for Target Plugin Configuration, select your configured plugin.
3. In the Actions dropdown, select Un-isolate Endpoint.
4. For Action Parameters, select the option for Endpoint ID, if users need to filter out endpoints using business rules.
5. Provide a static Incident ID, which can be created for an Incident on Palo Alto Networks Cortex XDR Incident ViewTimeline tab.
6. Enable the Require Approval toggle if Approval is needed before performing action on the users.
7. Click Save.

Run a Scan on an Endpoint

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select a Business Rule, and for Target Plugin Configuration, select your configured plugin.
3. In the Actions dropdown, select Run Scan on Endpoint.
4. For Action Parameters, select the option for Endpoint ID, if users need to filter out endpoints using business rules.
5. Provide a static Incident ID, which can be created for an Incident on Palo Alto Networks Cortex XDR Incident ViewTimeline tab.
6. Enable the Require Approval toggle if Approval is needed before performing action on the users.
7. Click Save.

Cancel Running a Scan on an Endpoint

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select a Business Rule, and for Target Plugin Configuration, select your configured plugin.
3. In the Actions dropdown, select Cancel Running Scan on Endpoint.
4. For Action Parameters, select the option for Endpoint ID, if users need to filter out endpoints using business rules.
5. Provide a static Incident ID, which can be created for an Incident on Palo Alto Networks Cortex XDR Incident ViewTimeline tab.
6. Enable the Require Approval toggle if Approval is needed before performing action on the users.
7. Click Save.

No Action

1. In Risk Exchange, go to Actions and click Add Action Configuration.
2. Select a Business Rule, and for Target Plugin Configuration, select your configured plugin.
3. In the Actions dropdown, select No Actions and enable the “Generate Alert” toggle button to generate alerts in the Ticket Orchestrator.
4. Enable the Require Approval toggle if Approval is needed before performing action on the users.
5. Click Save.

The Palo Alto Networks Cortex XDR plugin supports following actions for Users: No Action will not perform any action on Users.

Validate the Palo Alto Networks Cortex XDR Plugin

Validate in Palo Alto Networks Cortex XDR

We pull Users and Endpoints from Palo Alto Networks Cortex XDR. The Endpoints are pulled from the Endpoint > All Endpoints page.

The logs for all the performed actions can be seen in the Incident Response > Response > Action Center page.

Note for Un-isolate endpoint, Run scan on endpoint, and Cancel Run scan on endpoint actions, Cancel Isolation, Malware scan, and Abort Malware scan, are the respective labels on the Palo Alto Networks Cortex XDR platform.

Validate in Cloud Exchange

To verify the Users and Endpoints pulled from Palo Alto Networks Cortex XDR, go to Logging and search for the logs from the Palo Alto Networks Cortex XDR plugin. You can search with a query like message Like “CRE Palo Alto Networks Cortex XDR”

To check the execution of actions, check the logs.

To check the records pulled and stored in Risk Exchange, go to Records. Select the entity that you used while adding the mappings in the plugin configuration.

Also, you can verify the Action logs for performed actions.

Troubleshooting the Palo Alto Networks Cortex XDR Plugin

Receiving error in the plugin workflow

CRE Palo Alto Networks Cortex XDR [configuration_name]: Validation error occurred, Received exit code 401, Unauthorized, Verify API Key and API Key ID provided in the configuration parameters.

What to do: Verify the API Key and API Key ID for Palo Alto Networks Cortex XDR. 

Endpoints are not pulled from Palo Alto Networks Cortex XDR

If no data for the Endpoints are pulled, it might be due to one of these reasons:

• No Endpoint data is available on the platform to pull
• Mapping is not added in the plugin

What to do:

1. Go to Palo Alto Networks Cortex XDR and check if the Endpoints are available to pull from the Endpoint > All Endpoints page.
2. Edit the plugin configuration and check the Entity Source page, there should be some fields mapped in order to pull the same.

Unable to perform action on Palo Alto Networks Cortex XDR

If the Endpoint fails to perform any of the actions, it might be due to one of these reasons:

• The Endpoint does not exist on Palo Alto Networks Cortex XDR
• Due to an API Limitation in Palo Alto Cortex XDR. If one of the following scenarios occur, you will not be able to perform these actions:
  • If endpoint is already isolated and we perform Isolate Endpoint action on the same endpoint
  • If endpoint is already un-isolated and we perform Un-isolate Endpoint action on the same endpoint
  • If scan is already running and we perform Run Scan on Endpoint action on the same endpoint
  • If scan in not running on endpoint and we perform Cancel Running Scan on Endpoint action on the same endpoint

Netskope Normalized Score is not calculated

If the Netskope Normalized Score is not calculated for any of the records, it might be due to the record not having any of the required fields. If so, tt will not calculate the Netskope Normalized Score for that record.

Known Behavior

It has been noticed that, if any of the actions performed twice on the same endpoint, the API is giving error code 500, and we will not be able to perform the action a second time.