topic Re: Help playbook XSOAR - XDR assest and vulnerability module in Cortex XSOAR Discussions

Help playbook XSOAR - XDR assest and vulnerability module

tlmarques — Fri, 17 May 2024 16:02:54 GMT

Hi,

I am creating a playbook with the objective of integrating and .

The idea is for to query , retrieve all the assets detected by the broker scanner, and verify which assets do or do not have the XDR agent.

Does anyone know if this is possible?

My idea is to use both solutions to achieve as much automation as possible.

Another playbook later on will involve XSOAR querying the XDR vulnerability section to identify machines with missing CVEs, listing the machines and CVEs, and then identifying the necessary KBs.

Can anyone help me? Does anyone know if this is possible, even with an XQL query?

Re: Help playbook XSOAR - XDR assest and vulnerability module

sramesh-7 — Thu, 06 Jun 2024 02:27:41 GMT

Hi @tlmarques ,

On this usecase, currently there seems to be no way to query the information on the IPs detected by Broker VM, However there is an option if you have cloud identity engine to get a list of assets added to the domain and validate if an agent is installed. This may be more accurate since it will ignore IP based devices which cannot have an engine setup.

Here is a sample XQL you can utilize for this

config case_sensitive = false | preset = ad_computers

| fields name, domain_name, sam_account_name, distinguished_name, OS

| filter name not in (dataset = endpoints | fields endpoint_name)

The next usecase, You can query the CVE for an endpoint from va_endpoints , Once you get this list of CVE for every asset, you can use the CVE integration in XSOAR to fetch details about CVE and fixing it.

Re: Help playbook XSOAR - XDR assest and vulnerability module

tlmarques — Tue, 18 Jun 2024 15:30:12 GMT

The XQL for devices without agent, works perfect thanks a lot.