Details
Content
Dependencies
Version History

Horizon3.ai NodeZero autonomous pentest platform. Fetches high/critical weaknesses as incidents.

NodeZero

NodeZero is an autonomous penetration testing platform that continuously identifies exploitable weaknesses across your infrastructure. By simulating real-world attack paths, NodeZero provides proof-based findings that help security teams prioritize remediation efforts.

This pack integrates NodeZero with Cortex XSOAR to automatically ingest discovered weaknesses as incidents for tracking, triage, and remediation workflows.

What Does This Pack Do?

Fetches HIGH and CRITICAL severity weaknesses from NodeZero pentest operations
Creates incidents with full weakness context including severity scores, attack paths, and proof status
Tracks CISA KEV (Known Exploited Vulnerabilities) and ransomware campaign associations
Enables automated remediation workflows based on weakness severity and exploitability

Configure NodeZero in Cortex

Parameter	Description	Required
Server URL	The NodeZero API server URL.	True
API Key	The API Key required to authenticate to the NodeZero service.	True
Trust any certificate (not secure)	When selected, certificates are not checked.	False
Use system proxy settings	Runs the integration instance using the proxy server defined in the server configuration.	False
Fetch incidents	When selected, the integration fetches incidents.	False
Incident type	The incident type to create for fetched incidents.	False
Maximum number of weaknesses to fetch	Maximum number of incidents to fetch per run.	False
First fetch time	How far back to fetch on first run (e.g., "7 days", "3 days").	False
Incidents Fetch Interval	How often to fetch new incidents (in minutes). Default is 10080 (7 days).	False

NodeZero

This pack integrates NodeZero with Cortex to automatically ingest discovered weaknesses as incidents for tracking, triage, and remediation workflows.

What Does This Pack Do?

Fetches HIGH and CRITICAL severity weaknesses from NodeZero pentest operations
Creates incidents with full weakness context including severity scores, attack paths, and proof status
Tracks CISA KEV (Known Exploited Vulnerabilities) and ransomware campaign associations
Enables automated remediation workflows based on weakness severity and exploitability

Configure NodeZero in Cortex

Parameter	Description	Required
Server URL	The NodeZero API server URL.	True
API Key	The API Key required to authenticate to the NodeZero service.	True
Trust any certificate (not secure)	When selected, certificates are not checked.	False
Use system proxy settings	Runs the integration instance using the proxy server defined in the server configuration.	False
Fetch incidents	When selected, the integration fetches incidents.	False
Incident type	The incident type to create for fetched incidents.	False
Maximum number of weaknesses to fetch	Maximum number of incidents to fetch per run.	False
First fetch time	How far back to fetch on first run (e.g., "7 days", "3 days").	False
Incidents Fetch Interval	How often to fetch new incidents (in minutes). Default is 10080 (7 days).	False

Classifiers

Name	Description
NodeZero - Classifier	Classifies NodeZero incidents.
NodeZero - Incoming Mapper	Maps incoming NodeZero Weakness fields.

Incident Fields

Name	Description
NodeZero Attack Paths Count	The number of attack paths associated with this weakness.
NodeZero Weakness Category	The category of the weakness from NodeZero.
NodeZero Weakness Score	The vulnerability score from NodeZero.
NodeZero Operation ID	The NodeZero pentest operation ID where this weakness was discovered.
NodeZero Ransomware Use	Whether this vulnerability is known to be used in ransomware campaigns.
NodeZero Weakness Proven	Whether NodeZero successfully exploited this weakness (proof-based).
NodeZero CISA KEV	Whether this vulnerability is in the CISA Known Exploited Vulnerabilities catalog.

Incident Types

Name	Description
NodeZero Weakness

Integrations

Name	Description
NodeZero (Partner Contribution)	Integrates with the NodeZero autonomous penetration testing platform to fetch weaknesses discovered during pentest operations. Automatically ingests HIGH and CRITICAL severity weaknesses as incidents for tracking and remediation.

Classifiers

Name	Description
NodeZero - Classifier	Classifies NodeZero incidents.
NodeZero - Incoming Mapper	Maps incoming NodeZero Weakness fields.

Incident Fields

Name	Description
NodeZero CISA KEV	Whether this vulnerability is in the CISA Known Exploited Vulnerabilities catalog.
NodeZero Operation ID	The NodeZero pentest operation ID where this weakness was discovered.
NodeZero Attack Paths Count	The number of attack paths associated with this weakness.
NodeZero Weakness Category	The category of the weakness from NodeZero.
NodeZero Ransomware Use	Whether this vulnerability is known to be used in ransomware campaigns.
NodeZero Weakness Proven	Whether NodeZero successfully exploited this weakness (proof-based).
NodeZero Weakness Score	The vulnerability score from NodeZero.

Incident Types

Name	Description
NodeZero Weakness

Integrations

Name	Description
NodeZero (Partner Contribution)	Integrates with the NodeZero autonomous penetration testing platform to fetch weaknesses discovered during pentest operations. Automatically ingests HIGH and CRITICAL severity weaknesses as incidents for tracking and remediation.

Required Content Packs (2)

Pack Name	Pack By
Base	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (1)

Pack Name	Pack By
Common Types	By: Cortex XSOAR

All level dependencies (2)

Pack Name	Pack By
Filters And Transformers	By: Cortex XSOAR
Base	By: Cortex XSOAR

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	August 11, 2026
Last Release	August 11, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.