McAfee Advanced Threat Defense

Details
Content
Dependencies
Version History

Integrated advanced threat detection: Enhancing protection from network edge to endpoint

Automations

Name	Description
ATDDetonate	Detonate File or URL through McAfee ATD.

Integrations

Name	Description
McAfee Advanced Threat Defense	Integrated advanced threat detection: Enhancing protection from network edge to endpoint.

Playbooks

Name	Description
Detonate URL - McAfee ATD	Detonates a URL using the McAfee Advanced Threat Defense sandbox integration.
ATD - Detonate File	Detonates a File using the McAfee Advanced Threat Defense sandbox. Advanced Threat Defense supports the following File Types: 32-bit Portable Executables (PE)files; 64-bit PE+files exe, sys, dll, com, scr, cpl, ocx, cgi Microsoft Office Suite documents doc,dotm, docx, dotx, xls, ppam, xlsx, pps, xlsb, ppsx, xlsm, ppsm, ppt, ppt, pptx, pptm, rtf, shs, xltm, sldm, xltx, sldx, xlam, thmx, docm, xar Just Systems Ichitaro documents jtd, jtdc Adobe pdf, swf Compressed files gz, 7z, tgz, msi, zip, lzh, cab, lzma, rar Android application package apk, Java, JAR, CLASS, Java Script, Java bin files Image files jpeg, png, gif Other file types cmd, ace, bat, arj, vbs, chm, xml, lnk, url, mof, htm, ocx, html, potm, eml, potx, msg, ps1, vb, reg, vba, wsc, vbe, wsf, vbs, wsh
Detonate Remote File from URL - McAfee ATD	Detonates a File from a URL using the McAfee Advanced Threat Defense sandbox integration.

Automations

Name	Description
ATDDetonate	Detonate File or URL through McAfee ATD.

Integrations

Name	Description
McAfee Advanced Threat Defense	Integrated advanced threat detection: Enhancing protection from network edge to endpoint.

Playbooks

Name	Description
Detonate Remote File from URL - McAfee ATD	Detonates a File from a URL using the McAfee Advanced Threat Defense sandbox integration.
Detonate URL - McAfee ATD	Detonates a URL using the McAfee Advanced Threat Defense sandbox integration.
ATD - Detonate File	Detonates a File using the McAfee Advanced Threat Defense sandbox. Advanced Threat Defense supports the following File Types: 32-bit Portable Executables (PE)files; 64-bit PE+files exe, sys, dll, com, scr, cpl, ocx, cgi Microsoft Office Suite documents doc,dotm, docx, dotx, xls, ppam, xlsx, pps, xlsb, ppsx, xlsm, ppsm, ppt, ppt, pptx, pptm, rtf, shs, xltm, sldm, xltx, sldx, xlam, thmx, docm, xar Just Systems Ichitaro documents jtd, jtdc Adobe pdf, swf Compressed files gz, 7z, tgz, msi, zip, lzh, cab, lzma, rar Android application package apk, Java, JAR, CLASS, Java Script, Java bin files Image files jpeg, png, gif Other file types cmd, ace, bat, arj, vbs, chm, xml, lnk, url, mof, htm, ocx, html, potm, eml, potx, msg, ps1, vb, reg, vba, wsc, vbe, wsf, vbs, wsh

Required Content Packs (3)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR

Optional Content Packs (0)

Pack Name	Pack By

All level dependencies (6)

Pack Name	Pack By
Rasterize	By: Cortex XSOAR
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

1.0.33 - 5636304 (October 29, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41629

Download

1.0.32 - 4096037 (July 8, 2025)

Integrations

McAfee Advanced Threat Defense

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Scripts

ATDDetonate

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 40498

Download

1.0.31 - R3392471 (May 13, 2025)

Integrations

McAfee Advanced Threat Defense

Metadata and documentation improvements.

Scripts

ATDDetonate

Metadata and documentation improvements.

Related pull requests:
- 39131

Download

1.0.30 - R2989425 (March 26, 2025)

Integrations

McAfee Advanced Threat Defense

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

Related pull requests:
- 38061

Download

1.0.29 - R1931958 (January 6, 2025)

Integrations

McAfee Advanced Threat Defense

Updated the Docker image to: demisto/python3:3.11.10.115186.

Scripts

ATDDetonate

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37407
- 37402
- 37403
- 37405
- 37406
- 37404

Download

1.0.28 - R1635715 (November 13, 2024)

Integrations

McAfee Advanced Threat Defense

Updated the Docker image to: demisto/python3:3.10.14.99865.

Related pull requests:
- 35045

Download

1.0.33 - 5636304 (October 29, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41629

Download

1.0.32 - 4096037 (July 8, 2025)

Integrations

McAfee Advanced Threat Defense

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Scripts

ATDDetonate

Updated the Docker image to: demisto/python3:3.12.8.3296088.

Related pull requests:
- 40498

Download

1.0.31 - R3392471 (May 13, 2025)

Integrations

McAfee Advanced Threat Defense

Metadata and documentation improvements.

Scripts

ATDDetonate

Metadata and documentation improvements.

Related pull requests:
- 39131

Download

1.0.30 - R2989425 (March 26, 2025)

Integrations

McAfee Advanced Threat Defense

Code functionality improvements.
Updated the Docker image to: demisto/python3:3.11.10.116949.

Related pull requests:
- 38061

Download

1.0.29 - R1931958 (January 6, 2025)

Integrations

McAfee Advanced Threat Defense

Updated the Docker image to: demisto/python3:3.11.10.115186.

Scripts

ATDDetonate

Updated the Docker image to: demisto/python3:3.11.10.115186.

Related pull requests:
- 37407
- 37402
- 37403
- 37405
- 37406
- 37404

Download

1.0.28 - R1635715 (November 13, 2024)

Integrations

McAfee Advanced Threat Defense

Updated the Docker image to: demisto/python3:3.10.14.99865.

Related pull requests:
- 35045

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	June 30, 2020
Last Release	October 29, 2025

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise.