topic Re: IOC Upload through API - Security Level Advanced in Cortex XDR Discussions

IOC Upload through API - Security Level Advanced

RFeyertag — Sun, 30 Apr 2023 22:43:03 GMT

Hello dear community,

my ps script is ready to upload IOCs with least privilege.

But I want to know, what kind of security risks we have if we don't use the Advanced security level?

Has anybody of you a ps snippet where the api key is hased like it is required?

additionally I found this example, but not in ps, just only python 3:

from datetime import datetime, timezone import secrets import string import hashlib import requests def test_advanced_authentication(api_key_id, api_key): # Generate a 64 bytes random string nonce = "".join([secrets.choice(string.ascii_letters + string.digits) for _ in range(64)]) # Get the current timestamp as milliseconds. timestamp = int(datetime.now(timezone.utc).timestamp()) * 1000 # Generate the auth key: auth_key = "%s%s%s" % (api_key, nonce, timestamp) # Convert to bytes object auth_key = auth_key.encode("utf-8") # Calculate sha256: api_key_hash = hashlib.sha256(auth_key).hexdigest() # Generate HTTP call headers headers = { "x-xdr-timestamp": str(timestamp), "x-xdr-nonce": nonce, "x-xdr-auth-id": str(api_key_id), "Authorization": api_key_hash } parameters = {} res = requests.post(url="https://api-xdr.xdr.de.paloaltonetworks.com/api_keys/validate/", headers=headers, json=parameters) return res

Rob

Re: IOC Upload through API - Security Level Advanced

anlynch — Mon, 01 May 2023 16:24:34 GMT

Hi @RFeyertag,

Thank for reaching out through LIVEcommunity!

If I understand correctly you're wanting to know the security risks for not using the advanced security level and looking for an example of hashing the API as required with powershell.

First, one of the biggest reasons for hashing the API Key is to prevent replay and similar attacks while using the API.

As for how to properly encrypt the API key using powershell this may be a good resource to get you started.

I hope this helps.

Re: IOC Upload through API - Security Level Advanced

RFeyertag — Fri, 29 Dec 2023 18:33:15 GMT

Thank you! I already have the answer to my question. The PS script got all the functions to communicate through advanced.

Rob