Details
Content
Dependencies
Version History

Retrieve security events and threats from GravityZone and manage the incident response

GravityZone

Use the GravityZone integration to retrieve security events from GravityZone Cloud and manage incident response activities in Cortex XSOAR.

What does this pack do?

This pack lets you:

Retrieve security incidents and endpoint data from GravityZone Cloud.
Perform incident response and remediation actions on managed endpoints.
Mirror incident data between GravityZone Cloud and Cortex XSOAR.

This content pack includes:

An integration with more than 10 commands for endpoint and incident management.
A classifier and an incoming mapper to support incident data mirroring.

For more information about GravityZone Cloud, see the GravityZone documentation.

Classifiers

Name	Description
GravityZone - Classifier	Classifies incoming GravityZone incidents in Cortex XSOAR.
GravityZone - Incoming Mapper	Maps GravityZone incident fields to Cortex XSOAR incident fields.

Incident Fields

Name	Description
GravityZone Incident Priority	Specifies the priority assigned to the incident.
GravityZone Incident Severity Score	Specifies the severity score assigned to the incident.
GravityZone Company Name	Name of the company associated with the incident.
GravityZone Incident Number	Identifies the incident number, which is unique within the company and associated with a specific endpoint.
GravityZone Incident Type	Specifies the type of the incident.
GravityZone Incident Action Taken	Indicates the action taken when the incident was detected.
GravityZone Incident ID	Identifies the incident.
GravityZone Computer ID	Identifies the computer where the incident was detected.
GravityZone Computer IP	Specifies the IP address from which the incident was detected.
GravityZone Incident Assigned User ID	Identifies the user assigned to the incident.
GravityZone Computer FQDN	Specifies the FQDN of the computer where the incident was detected.
GravityZone Company ID	Identifies the company associated with the incident.
GravityZone Computer Name	Specifies the name of the computer where the incident was detected.
GravityZone Incident Link	Provides a direct link to the incident in the GravityZone console.

Incident Types

Name	Description
GravityZone XDR
GravityZone EDR

Integrations

Name	Description
GravityZone (Partner Contribution)	GravityZone provides secure access to incident and endpoint data and enables remediation actions through its APIs.

Layouts

Name	Description
GravityZone EDR Incident Layout
GravityZone XDR Incident Layout

Required Content Packs (2)

Pack Name	Pack By
Base	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (1)

Pack Name	Pack By
Common Types	By: Cortex XSOAR

All level dependencies (3)

Pack Name	Pack By
Base	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Aggregated Scripts	By: Cortex XSOAR

PUBLISHER

PLATFORMS

Cortex XSOAR

INFO

Certification	Certified	Read more
Supported By	Partner
Created	March 8, 2026
Last Release	March 8, 2026

Malware

Incident Response

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise.