Help playbook XSOAR - XDR assest and vulnerability module

[tlmarques]

Hi,

I am creating a playbook with the objective of integrating Cortex XSOAR and Cortex XDR. 

The idea is for Cortex XSOAR to query Cortex XDR , retrieve all the assets detected by the broker scanner, and verify which assets do or do not have the XDR agent.

Does anyone know if this is possible?

My idea is to use both solutions to achieve as much automation as possible.

Another playbook later on will involve XSOAR querying the XDR vulnerability section to identify machines with missing CVEs, listing the machines and CVEs, and then identifying the necessary KBs.

Can anyone help me? Does anyone know if this is possible, even with an XQL query?

[sramesh-7]

Hi @tlmarques , 

On this usecase, currently there seems to be no way to query the information on the IPs detected by Broker VM, However there is an option if you have cloud identity engine to get a list of assets added to the domain and validate if an agent is installed. This may be more accurate since it will ignore IP based devices which cannot have an engine setup.

Here is a sample XQL you can utilize for this

config case_sensitive = false | preset = ad_computers

| fields name, domain_name, sam_account_name, distinguished_name, OS

| filter name not in (dataset = endpoints | fields endpoint_name)

The next usecase, You can query the CVE for an endpoint from va_endpoints , Once you get this list of CVE for every asset, you can use the CVE integration in XSOAR to fetch details about CVE and fixing it.

[tlmarques]

The XQL for devices without agent, works perfect thanks a lot.