Cyberhaven | Marketplace

Details
Content
Dependencies
Version History

Fetches DLP incidents from the Cyberhaven data security platform and enables investigation of events and data lineage.

The Cyberhaven pack enables security operations teams to fetch and investigate DLP (Data Loss Prevention) incidents from the Cyberhaven data security platform directly within Cortex XSOAR. By synchronizing Cyberhaven incidents with XSOAR in real time, analysts can manage DLP investigations, review event and data lineage details, and update incident status.

What does this pack do?

Fetch DLP incidents from Cyberhaven and create corresponding XSOAR incidents.
List and filter Cyberhaven DLP incidents by severity, status, assignee, user, and time range.
Update incident status, close reason, close note, and assignee.
Retrieve full event details for one or more Cyberhaven events by ID.
Retrieve data lineage chains between two Cyberhaven event IDs.
Mirror incident updates from XSOAR back to Cyberhaven (status, owner, close reason, close notes).
Automatically close XSOAR incidents when the corresponding Cyberhaven incident is closed (via the included playbook).

The Cyberhaven pack enables security operations teams to fetch and investigate DLP (Data Loss Prevention) incidents from the Cyberhaven data security platform directly within Cortex. By synchronizing Cyberhaven incidents with XSOAR in real time, analysts can manage DLP investigations, review event and data lineage details, and update incident status.

What does this pack do?

Fetch DLP incidents from Cyberhaven and create corresponding XSOAR incidents.
List and filter Cyberhaven DLP incidents by severity, status, assignee, user, and time range.
Update incident status, close reason, close note, and assignee.
Retrieve full event details for one or more Cyberhaven events by ID.
Retrieve data lineage chains between two Cyberhaven event IDs.
Mirror incident updates from XSOAR back to Cyberhaven (status, owner, close reason, close notes).
Automatically close XSOAR incidents when the corresponding Cyberhaven incident is closed (via the included playbook).

Automations

Name	Description
CyberhavenIncidentRefresh	Updates only Cyberhaven custom fields and never modifies the XSOAR-owned fields.

Classifiers

Name	Description
Cyberhaven - Incoming Mapper	Map incoming Cyberhaven DLP incident JSON data to XSOAR incident fields.

Incident Fields

Name	Description
Cyberhaven Reaction Time	When the end user dismissed the warning popup in Cyberhaven.
Cyberhaven Close Reason	Reason for closing the Cyberhaven incident.
Cyberhaven Dataset ID	Cyberhaven dataset identifier.
Cyberhaven Trigger Time	Timestamp when the Cyberhaven policy trigger occurred.
Cyberhaven Risk Score	Composite risk score from Cyberhaven. Higher score indicates greater risk.
Cyberhaven End Action Hostname	Endpoint hostname that performed the data exfiltration (end event).
Cyberhaven AI Summary	AI-generated incident summary from Cyberhaven. Also stored in the standard Details field.
Cyberhaven End Content Filename	Filename required for the evidence file content deep link.
Cyberhaven Status	Current status of the Cyberhaven incident.
Cyberhaven Incident Custom Data	Custom data on the incident record, serialized as JSON.
Cyberhaven Start Sensor Kind	Type of Cyberhaven sensor that captured the start event.
Cyberhaven Dataset Sensitivity	Sensitivity classification of the involved dataset.
Cyberhaven Lineage End ID	End event ID for the event lineage graph deep link.
Cyberhaven Start Content Filename	Filename in Cyberhaven content store at the classification origin.
Cyberhaven Created By	Indicates what originated the incident record in Cyberhaven.
Cyberhaven Blocked	Whether the triggering data transfer was blocked by policy.
Cyberhaven Last Modified	Timestamp when the Cyberhaven incident was last modified.
Cyberhaven Policy ID	Cyberhaven policy identifier that triggered this incident.
Cyberhaven Policy Severity	Severity level as defined by the triggering Cyberhaven policy.
Cyberhaven User Reactions	Reactions submitted by the end user in Cyberhaven.
Cyberhaven Start Event JSON	Full start event from Cyberhaven serialized as JSON, provided for investigation context.
Cyberhaven User ID	Cyberhaven internal user ID. Required for the user risk profile deep link.
Cyberhaven Start Action Hostname	Endpoint hostname where the incident originated (start event).
Cyberhaven User Local ID	Local directory ID of the offending user.
Cyberhaven User Reaction Message	Free-text explanation submitted by the end user when dismissing the warning popup.
Cyberhaven Warning Status	Status of the warning popup shown to the user in Cyberhaven.
Cyberhaven Username	Username of the employee who triggered the incident.
Cyberhaven Start Action Kind	Data action at the classification origin (start event).
Cyberhaven AI Severity	Severity level assessed by Cyberhaven AI analysis.
Cyberhaven Close Note	Analyst notes recorded when closing the Cyberhaven incident.
Cyberhaven Screenshot GUID	Screenshot identifier required for the evidence screenshot deep link.
Cyberhaven End Event JSON	Full end event from Cyberhaven serialized as JSON, provided for investigation context.
Cyberhaven End Sensor Kind	Type of Cyberhaven sensor that captured the end event.
Cyberhaven Dataset Custom Data	Custom data attached to the dataset, serialized as JSON.
Cyberhaven End Action Kind	Exfiltration action type at the end event.
Cyberhaven Resolution Time	Timestamp when the Cyberhaven incident was resolved.
Cyberhaven Event Time	When the underlying DLP event occurred. May precede the incident creation time if content inspection was delayed.
Cyberhaven Lineage Start ID	Start event ID for the event lineage graph deep link.
Cyberhaven Dataset Name	Human-readable dataset name from Cyberhaven.
Cyberhaven User Custom Data	Custom data attached to the user object, serialized as JSON.
Cyberhaven Policy Custom Data	Custom data attached to the triggering policy, serialized as JSON.
Cyberhaven Assigned To	The analyst or user the incident is assigned to in Cyberhaven.
Cyberhaven Policy Name	Human-readable name of the Cyberhaven policy that triggered this incident.
Cyberhaven Event Lineage Graph Link	The external link to show the Event Lineage Graph in Cyberhaven platform.
Cyberhaven Incident ID	Cyberhaven incident identifier used as the correlation key for this integration.
Cyberhaven User Risk Groups	Risk groups the user belongs to in Cyberhaven, with risk multipliers.

Incident Types

Name	Description
Cyberhaven Incident

Integrations

Name	Description
Cyberhaven (Partner Contribution)	Fetches DLP incidents from the Cyberhaven data security platform and enables investigation of events and data lineage.

Layouts

Name	Description
Cyberhaven Incident	Cyberhaven DLP Incident Layout.

Playbooks

Name	Description
Synchronize Incident Closure - Cyberhaven	Closes XSOAR incidents by synchronizing their status with the corresponding Cyberhaven incident.

Automations

Name	Description
CyberhavenIncidentRefresh	Updates only Cyberhaven custom fields and never modifies the XSOAR-owned fields.
CyberhavenAlertRefresh	Updates only Cyberhaven custom fields and never modifies the XSOAR-owned fields.

Classifiers

Name	Description
Cyberhaven - Incoming Mapper	Map incoming Cyberhaven DLP incident JSON data to XSOAR incident fields.

Incident Fields

Name	Description
Cyberhaven AI Summary	AI-generated incident summary from Cyberhaven. Also stored in the standard Details field.
Cyberhaven Risk Score	Composite risk score from Cyberhaven. Higher score indicates greater risk.
Cyberhaven End Action Hostname	Endpoint hostname that performed the data exfiltration (end event).
Cyberhaven User Reaction Message	Free-text explanation submitted by the end user when dismissing the warning popup.
Cyberhaven User Reactions	Reactions submitted by the end user in Cyberhaven.
Cyberhaven Created By	Indicates what originated the incident record in Cyberhaven.
Cyberhaven Reaction Time	When the end user dismissed the warning popup in Cyberhaven.
Cyberhaven Lineage End ID	End event ID for the event lineage graph deep link.
Cyberhaven Policy Name	Human-readable name of the Cyberhaven policy that triggered this incident.
Cyberhaven Policy ID	Cyberhaven policy identifier that triggered this incident.
Cyberhaven Dataset ID	Cyberhaven dataset identifier.
Cyberhaven Incident ID	Cyberhaven incident identifier used as the correlation key for this integration.
Cyberhaven Policy Custom Data	Custom data attached to the triggering policy, serialized as JSON.
Cyberhaven AI Severity	Severity level assessed by Cyberhaven AI analysis.
Cyberhaven Close Reason	Reason for closing the Cyberhaven incident.
Cyberhaven Start Event JSON	Full start event from Cyberhaven serialized as JSON, provided for investigation context.
Cyberhaven Incident Custom Data	Custom data on the incident record, serialized as JSON.
Cyberhaven Event Lineage Graph Link	The external link to show the Event Lineage Graph in Cyberhaven platform.
Cyberhaven End Sensor Kind	Type of Cyberhaven sensor that captured the end event.
Cyberhaven User Risk Groups	Risk groups the user belongs to in Cyberhaven, with risk multipliers.
Cyberhaven Event Time	When the underlying DLP event occurred. May precede the incident creation time if content inspection was delayed.
Cyberhaven Policy Severity	Severity level as defined by the triggering Cyberhaven policy.
Cyberhaven User Local ID	Local directory ID of the offending user.
Cyberhaven Resolution Time	Timestamp when the Cyberhaven incident was resolved.
Cyberhaven Start Action Kind	Data action at the classification origin (start event).
Cyberhaven Trigger Time	Timestamp when the Cyberhaven policy trigger occurred.
Cyberhaven End Event JSON	Full end event from Cyberhaven serialized as JSON, provided for investigation context.
Cyberhaven Last Modified	Timestamp when the Cyberhaven incident was last modified.
Cyberhaven Start Sensor Kind	Type of Cyberhaven sensor that captured the start event.
Cyberhaven Start Content Filename	Filename in Cyberhaven content store at the classification origin.
Cyberhaven Dataset Sensitivity	Sensitivity classification of the involved dataset.
Cyberhaven Close Note	Analyst notes recorded when closing the Cyberhaven incident.
Cyberhaven Username	Username of the employee who triggered the incident.
Cyberhaven Blocked	Whether the triggering data transfer was blocked by policy.
Cyberhaven Lineage Start ID	Start event ID for the event lineage graph deep link.
Cyberhaven Dataset Custom Data	Custom data attached to the dataset, serialized as JSON.
Cyberhaven Assigned To	The analyst or user the incident is assigned to in Cyberhaven.
Cyberhaven Dataset Name	Human-readable dataset name from Cyberhaven.
Cyberhaven Screenshot GUID	Screenshot identifier required for the evidence screenshot deep link.
Cyberhaven Start Action Hostname	Endpoint hostname where the incident originated (start event).
Cyberhaven Warning Status	Status of the warning popup shown to the user in Cyberhaven.
Cyberhaven User ID	Cyberhaven internal user ID. Required for the user risk profile deep link.
Cyberhaven End Content Filename	Filename required for the evidence file content deep link.
Cyberhaven End Action Kind	Exfiltration action type at the end event.
Cyberhaven User Custom Data	Custom data attached to the user object, serialized as JSON.
Cyberhaven Status	Current status of the Cyberhaven incident.

Incident Types

Name	Description
Cyberhaven Incident

Integrations

Name	Description
Cyberhaven (Partner Contribution)	Fetches DLP incidents from the Cyberhaven data security platform and enables investigation of events and data lineage.

Playbooks

Name	Description
Synchronize Alert Closure - Cyberhaven	Closes XSOAR alerts by synchronizing their status with the corresponding Cyberhaven alert.

Required Content Packs (4)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (0)

Pack Name	Pack By

All level dependencies (5)

Pack Name	Pack By
Cortex REST API	By: Cortex XSOAR
Common Types	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	August 16, 2026
Last Release	August 16, 2026

Incident Response

Case Management

Compliance

Hunting

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.