Automation of Reports

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Automation of Reports

L3 Networker

Hello Team,

 

  • We need to create automated XDR report to detect executions of “Python.exe” and “PowerShell.exe & PowerShell_ise.exe” in our environment.
  • Can we query a incident/alerts to make a report or suggest us how we can generate reports based on the above requirements.
  • Can we configure a scheduler in this report so that all the intended recipients would receive this report.

 

4 REPLIES 4

L4 Transporter

Hi @RamyashreeMada 

 

Thank you for writing to live community!

 

For your above use case, one approach could be by creating a new Report from scratch under the Report Template using XQL Query and under XQL query bolt query to search for actor/action process image name with  “Python.exe” , “PowerShell.exe" & "PowerShell_ise.exe”. However you may have to tweak this query to exclude administrative executions of this processes based on your Use Case. 

For Report creation you may refer to this 

Report_builder.png

Hope this helps!
Please mark the response as "Accept as Solution" if it answers your query.

Thanks

Hello @PiyushKohli,

 

We need to create a report for the alerts that are triggered for the above files. Is the possible to automate report based on alerts?

L2 Linker

You may try the below query and see if this results with your requirement. This did work for us.

 

dataset = xdr_data
|filter event_type = ENUM.PROCESS
|filter lowercase(actor_process_image_name ) ="python.exe" or lowercase(actor_process_image_name ) ="powershell.exe" or lowercase(actor_process_image_name ) ="powershell_ise.exe"
|fields causality_actor_process_image_path, actor_process_image_path, agent_hostname, action_file_path, action_file_name
|dedup causality_actor_process_image_path, actor_process_image_path, agent_hostname, action_file_path, action_file_name

 

Thank you

 

Venu

L4 Transporter

Hi @RamyashreeMada 

 

Thanks for clarifying. Since you need a report/notification for the alerts that are triggered for mentioned processes. You may configure the Notifications under Configuration for the same. 

Reference URL: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Configure-N...

Screenshot for Reference: 

notification.png

Note: Update the configuration scope according to your Use Case, so that all alerts corresponding to those processes for which you want to be notified are selected. 

 

Aside to @VenuK . Thanks for sharing the query! 

 

Hope this helps!

Please mark the response as "Accept as Solution" if it answers your query.

 

  • 1111 Views
  • 4 replies
  • 1 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!