Help playbook XSOAR - XDR assest and vulnerability module

cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 

Help playbook XSOAR - XDR assest and vulnerability module

L4 Transporter

Hi,

I am creating a playbook with the objective of integrating Cortex XSOAR and Cortex XDR

The idea is for Cortex XSOAR to query Cortex XDR , retrieve all the assets detected by the broker scanner, and verify which assets do or do not have the XDR agent.

 

Does anyone know if this is possible?


My idea is to use both solutions to achieve as much automation as possible.


Another playbook later on will involve XSOAR querying the XDR vulnerability section to identify machines with missing CVEs, listing the machines and CVEs, and then identifying the necessary KBs.


Can anyone help me? Does anyone know if this is possible, even with an XQL query?

Best regards
Tiago Marques
2 REPLIES 2

L2 Linker

Hi @tlmarques , 

 

On this usecase, currently there seems to be no way to query the information on the IPs detected by Broker VM, However there is an option if you have cloud identity engine to get a list of assets added to the domain and validate if an agent is installed. This may be more accurate since it will ignore IP based devices which cannot have an engine setup.

Here is a sample XQL you can utilize for this

config case_sensitive = false | preset = ad_computers

| fields name, domain_name, sam_account_name, distinguished_name, OS

| filter name not in (dataset = endpoints | fields endpoint_name)

 

The next usecase, You can query the CVE for an endpoint from va_endpoints , Once you get this list of CVE for every asset, you can use the CVE integration in XSOAR to fetch details about CVE and fixing it.

 

The XQL for devices without agent, works perfect thanks a lot.

Best regards
Tiago Marques
  • 1061 Views
  • 2 replies
  • 0 Likes
Like what you see?

Show your appreciation!

Click Like if a post is helpful to you or if you just want to show your support.

Click Accept as Solution to acknowledge that the answer to your question has been provided.

The button appears next to the replies on topics you’ve started. The member who gave the solution and all future visitors to this topic will appreciate it!

These simple actions take just seconds of your time, but go a long way in showing appreciation for community members and the LIVEcommunity as a whole!

The LIVEcommunity thanks you for your participation!