Device Security by Palo Alto Networks

Details
Content
Dependencies
Version History

Collects Palo Alto Networks Device Security alerts and vulnerabilities in Cortex XSOAR, applies RACI-based triage guidance, and supports ServiceNow ticket creation and status-based incident closure workflows.

Palo Alto Networks Device Security Content Pack

This content pack enables Cortex XSOAR to integrate with Palo Alto Networks Device Security. It includes an integration, incident workflows, and a dynamic vulnerability history section.

The vulnerability layout groups asset identification, vulnerability details, ticket and remediation data, site and network context, asset risk, and detection timestamps. The Detection & Resolution History section renders the Reason History field populated by the incoming mapper. The layout uses the exported custom field definitions alongside additional Device Security fields.

Palo Alto Networks Device Security Integration

A wrapper around the Device Security Portal APIs for:

getting device details by ID
listing devices
listing alerts and vulnerabilities
resolving alerts and vulnerabilities

This integration can be used for incident response.

RACI Model Calculation Script

Based on a mapping defined in Settings > Advanced > Lists, device attributes, and alert/vulnerability fields, this automation script can evaluate the "R" and "I" in RACI (Responsible and Informed). This is useful when incidents must be assigned to different departments in a large company.

ServiceNow Ticket Check Script

This pack works with ServiceNow by persisting the new ticket ID in the custom field "Device Security ServiceNow Record ID". This automation script loops through all open Device Security alerts and vulnerabilities in XSOAR and queries ServiceNow for ticket status. If the status is "CLOSED", the corresponding XSOAR incident is closed.

Alert and Vulnerability Resolution Post-Processing Script

Resolves Device Security portal incidents in the XSOAR post-processing stage.

Palo Alto Networks Device Security Content Pack

This content pack enables Cortex to integrate with Palo Alto Networks Device Security. It includes an integration, incident workflows, and a dynamic vulnerability history section.

Palo Alto Networks Device Security Integration

A wrapper around the Device Security Portal APIs for:

getting device details by ID
listing devices
listing alerts and vulnerabilities
resolving alerts and vulnerabilities

This integration can be used for incident response.

RACI Model Calculation Script

ServiceNow Ticket Check Script

Alert and Vulnerability Resolution Post-Processing Script

Resolves Device Security portal incidents in the XSOAR post-processing stage.

Automations

Name	Description
device-security-get-raci	Calculates the responsible and informed parties for a Device Security incident by matching incident and device details against the Device Security configuration list.
DeviceSecurityHistorySection	Displays the detection and resolution history for the current Device Security vulnerability incident.
FormatDeviceSecurityDestinationPort	Formats destination ports and protocols into a comma-separated string for an incident field.
device-security-vuln-post-processing	Resolves the vulnerability incident in the Device Security portal via the API. Designed to run as a post-processing script.
device-security-check-servicenow	Closes the Cortex XSOAR incident if the Device Security ServiceNow ticket was closed. This command should be run in a Job.
device-security-alert-post-processing	Resolves the alert in the Device Security portal via the API. Designed to run as a post-processing script.
DeviceSecurityThreatFrameworkMappings	Displays MITRE ATT&CK Enterprise and ICS technique mappings and IEC 62443 references in a dynamic layout section.
CombineSeverity	Combines raw and display severity values into a single plain-text incident field.

Classifiers

Name	Description
Palo Alto Networks Device Security Classifier	Classifies Palo Alto Networks Device Security incidents.
Palo Alto Networks Device Security Incoming Mapper	Maps Palo Alto Networks Device Security incidents.

Incident Fields

Name	Description
Firewall Name	Firewall Name from a Device Security alert.
Source Labels	Source Labels from a Device Security alert.
Firewall Action	Firewall Action from a Device Security alert.
Asset Tag	Asset Tag reported by Palo Alto Networks Device Security.
Profile	Profile from a Device Security alert.
Network	Network from a Device Security alert.
Vulnerability Status	Vulnerability Status reported by Palo Alto Networks Device Security.
APT List	APT List reported by Palo Alto Networks Device Security.
Threat ID	Threat ID from a Device Security alert.
Forensic Search Timestamp	Forensic Search Timestamp from a Device Security alert.
Device Labels	Device Labels from a Device Security alert.
Severity Number	Severity Number from a Device Security alert.
Site ID	Site ID from a Device Security alert.
SBOM	SBOM reported by Palo Alto Networks Device Security.
Device Security ServiceNow Record ID	The ServiceNow record system ID
Asset Criticality	Asset Criticality reported by Palo Alto Networks Device Security.
OS Detail	OS Detail reported by Palo Alto Networks Device Security.
Remote Host MAC	Remote Host MAC from a Device Security alert.
Date	Date from a Device Security alert.
Device Security Site Names	Site names reported by Palo Alto Networks Device Security.
Recommended Actions	Recommended Actions from a Device Security alert.
Subnets	Subnets reported by Palo Alto Networks Device Security.
Traffic Restricted	Traffic Restricted reported by Palo Alto Networks Device Security.
Reason History	Reason History reported by Palo Alto Networks Device Security.
Severity (raw / display)	Severity (raw / display) from a Device Security alert.
Updated Date	Updated Date reported by Palo Alto Networks Device Security.
Device Security ServiceNow Table Name	The name of the ServiceNow Table
Alert Type	Alert Type from a Device Security alert.
Profile Vertical	Profile Vertical from a Device Security alert.
Detected Date	Detected Date reported by Palo Alto Networks Device Security.
Device Security Source	Source reported by Palo Alto Networks Device Security.
Ticket State	Ticket State reported by Palo Alto Networks Device Security.
Threat Category	Threat Category from a Device Security alert.
Remediation Instructions	Remediation Instructions reported by Palo Alto Networks Device Security.
Vendor	Vendor from a Device Security alert.
Risk Level	Risk Level reported by Palo Alto Networks Device Security.
Device Security Incident URL	The url to Palo Alto Networks Device Security incident
Device Last Activity	Device Last Activity reported by Palo Alto Networks Device Security.
Alert Unique ID	Alert Unique ID from a Device Security alert.
Outbound Interface	Outbound Interface from a Device Security alert.
Serial Number	Serial Number reported by Palo Alto Networks Device Security.
Last Detected Date	Last Detected Date reported by Palo Alto Networks Device Security.
Alert Title	Alert Title from a Device Security alert.
App Name	App Name from a Device Security alert.
Remediation Confirmed	Remediation Confirmed reported by Palo Alto Networks Device Security.
Ticket ID	Ticket ID reported by Palo Alto Networks Device Security.
Message ID	Message ID from a Device Security alert.
Assignees	Assignees reported by Palo Alto Networks Device Security.
ICS-CERT	ICS-CERT reported by Palo Alto Networks Device Security.
Firewall Serial Number	Firewall Serial Number from a Device Security alert.
Inbound Interface	Inbound Interface from a Device Security alert.
Profile Category	Profile Category from a Device Security alert.
Device Security MITRE Mappings Raw	Device Security MITRE Mappings Raw from a Device Security alert.
Work Order	Work Order reported by Palo Alto Networks Device Security.
Profile Confidence Level	Profile Confidence Level from a Device Security alert.
Device Security IEC References	Device Security IEC References from a Device Security alert.
Vulnerability Name	Vulnerability Name reported by Palo Alto Networks Device Security.
Vulnerability Priority	Vulnerability Priority reported by Palo Alto Networks Device Security.
Client Port	Client Port from a Device Security alert.
Remote Host Category	Remote Host Category from a Device Security alert.
Device Role	Device Role from a Device Security alert.
CVSS Score	CVSS Score reported by Palo Alto Networks Device Security.
Created At	Created At from a Device Security alert.

Incident Types

Name	Description
Device Security Alert
Device Security Vulnerability

Integrations

Name	Description
Palo Alto Networks Device Security	Use the Palo Alto Networks Device Security integration to fetch alerts and vulnerabilities, retrieve device details, and resolve security incidents (previously Zingbox).

Layouts

Name	Description
Device Security Vulnerability Layout	Layout for Device Security Vulnerability incidents.
Device Security Alert Layout	Layout for Device Security Alert incidents.

Playbooks

Name	Description
PANW Device Security ServiceNow Tickets Check	This playbook checks the ServiceNow ticket status for Palo Alto Networks Device Security (previously Zingbox) alerts or vulnerabilities and automatically closes the Cortex XSOAR incident when the related ServiceNow ticket is closed. Designed to run as a recurring job.
PANW Device Security Incident Handling with ServiceNow	This playbook creates a ServiceNow ticket after the incident is enriched by Palo Alto Networks Device Security portal (previously Zingbox Cloud).

Automations

Name	Description
device-security-vuln-post-processing	Resolves the vulnerability incident in the Device Security portal via the API. Designed to run as a post-processing script.
device-security-alert-post-processing	Resolves the alert in the Device Security portal via the API. Designed to run as a post-processing script.
device-security-check-servicenow	Closes the Cortex incident if the Device Security ServiceNow ticket was closed. This command should be run in a Job.
DeviceSecurityThreatFrameworkMappings	Displays MITRE ATT&CK Enterprise and ICS technique mappings and IEC 62443 references in a dynamic layout section.
CombineSeverity	Combines raw and display severity values into a single plain-text incident field.
DeviceSecurityHistorySection	Displays the detection and resolution history for the current Device Security vulnerability incident.
device-security-get-raci	Calculates the responsible and informed parties for a Device Security incident by matching incident and device details against the Device Security configuration list.
FormatDeviceSecurityDestinationPort	Formats destination ports and protocols into a comma-separated string for an incident field.

Classifiers

Name	Description
Palo Alto Networks Device Security Classifier	Classifies Palo Alto Networks Device Security incidents.
Palo Alto Networks Device Security Incoming Mapper	Maps Palo Alto Networks Device Security incidents.

Incident Fields

Name	Description
Recommended Actions	Recommended Actions from a Device Security alert.
Forensic Search Timestamp	Forensic Search Timestamp from a Device Security alert.
OS Detail	OS Detail reported by Palo Alto Networks Device Security.
Severity (raw / display)	Severity (raw / display) from a Device Security alert.
Device Security Incident URL	The url to Palo Alto Networks Device Security incident
Threat ID	Threat ID from a Device Security alert.
Vulnerability Priority	Vulnerability Priority reported by Palo Alto Networks Device Security.
Work Order	Work Order reported by Palo Alto Networks Device Security.
Remediation Confirmed	Remediation Confirmed reported by Palo Alto Networks Device Security.
Traffic Restricted	Traffic Restricted reported by Palo Alto Networks Device Security.
Remediation Instructions	Remediation Instructions reported by Palo Alto Networks Device Security.
Remote Host Category	Remote Host Category from a Device Security alert.
Device Last Activity	Device Last Activity reported by Palo Alto Networks Device Security.
Firewall Name	Firewall Name from a Device Security alert.
Firewall Action	Firewall Action from a Device Security alert.
Client Port	Client Port from a Device Security alert.
Subnets	Subnets reported by Palo Alto Networks Device Security.
Threat Category	Threat Category from a Device Security alert.
Asset Criticality	Asset Criticality reported by Palo Alto Networks Device Security.
Device Security ServiceNow Table Name	The name of the ServiceNow Table
Reason History	Reason History reported by Palo Alto Networks Device Security.
App Name	App Name from a Device Security alert.
Ticket State	Ticket State reported by Palo Alto Networks Device Security.
Profile Confidence Level	Profile Confidence Level from a Device Security alert.
Device Role	Device Role from a Device Security alert.
Profile	Profile from a Device Security alert.
Site ID	Site ID from a Device Security alert.
Ticket ID	Ticket ID reported by Palo Alto Networks Device Security.
Device Security Site Names	Site names reported by Palo Alto Networks Device Security.
Alert Unique ID	Alert Unique ID from a Device Security alert.
APT List	APT List reported by Palo Alto Networks Device Security.
Severity Number	Severity Number from a Device Security alert.
Profile Vertical	Profile Vertical from a Device Security alert.
Alert Title	Alert Title from a Device Security alert.
Firewall Serial Number	Firewall Serial Number from a Device Security alert.
ICS-CERT	ICS-CERT reported by Palo Alto Networks Device Security.
Network	Network from a Device Security alert.
Message ID	Message ID from a Device Security alert.
Date	Date from a Device Security alert.
Vulnerability Status	Vulnerability Status reported by Palo Alto Networks Device Security.
Serial Number	Serial Number reported by Palo Alto Networks Device Security.
Remote Host MAC	Remote Host MAC from a Device Security alert.
Detected Date	Detected Date reported by Palo Alto Networks Device Security.
Created At	Created At from a Device Security alert.
Device Security Source	Source reported by Palo Alto Networks Device Security.
Updated Date	Updated Date reported by Palo Alto Networks Device Security.
Alert Type	Alert Type from a Device Security alert.
Outbound Interface	Outbound Interface from a Device Security alert.
Profile Category	Profile Category from a Device Security alert.
Inbound Interface	Inbound Interface from a Device Security alert.
Device Security IEC References	Device Security IEC References from a Device Security alert.
Last Detected Date	Last Detected Date reported by Palo Alto Networks Device Security.
Vulnerability Name	Vulnerability Name reported by Palo Alto Networks Device Security.
Asset Tag	Asset Tag reported by Palo Alto Networks Device Security.
Device Security MITRE Mappings Raw	Device Security MITRE Mappings Raw from a Device Security alert.
Source Labels	Source Labels from a Device Security alert.
Vendor	Vendor from a Device Security alert.
CVSS Score	CVSS Score reported by Palo Alto Networks Device Security.
Device Labels	Device Labels from a Device Security alert.
Device Security ServiceNow Record ID	The ServiceNow record system ID
Assignees	Assignees reported by Palo Alto Networks Device Security.
SBOM	SBOM reported by Palo Alto Networks Device Security.
Risk Level	Risk Level reported by Palo Alto Networks Device Security.

Incident Types

Name	Description
Device Security Alert
Device Security Vulnerability

Integrations

Name	Description
Palo Alto Networks Device Security	Use the Palo Alto Networks Device Security integration to fetch alerts and vulnerabilities, retrieve device details, and resolve security incidents (previously Zingbox).

Layouts

Name	Description
Device Security Vulnerability Layout	Layout for Device Security Vulnerability incidents.
Device Security Alert Layout	Layout for Device Security Alert incidents.

Playbooks

Name	Description
PANW Device Security Alert Handling with ServiceNow	This playbook creates a ServiceNow ticket after the alert is enriched by Palo Alto Networks Device Security portal (previously Zingbox Cloud).
PANW Device Security ServiceNow Tickets Check	This playbook checks the ServiceNow ticket status for Palo Alto Networks Device Security (previously Zingbox) alerts or vulnerabilities and automatically closes the Cortex alert when the related ServiceNow ticket is closed. Designed to run as a recurring job.

Required Content Packs (3)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
ServiceNow	By: Cortex XSOAR

Optional Content Packs (1)

Pack Name	Pack By
Common Types	By: Cortex XSOAR

All level dependencies (6)

Pack Name	Pack By
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Base	By: Cortex XSOAR
ServiceNow	By: Cortex XSOAR

1.1.0 - 13994690 (October 21, 2026)

Incident Fields

New: APT List
Added the APT List incident field for Palo Alto Networks Device Security data.
New: Asset Criticality
Added the Asset Criticality incident field for Palo Alto Networks Device Security data.
New: Asset Tag
Added the Asset Tag incident field for Palo Alto Networks Device Security data.
New: Assignees
Added the Assignees incident field for Palo Alto Networks Device Security data.
New: CVSS Score
Added the CVSS Score incident field for Palo Alto Networks Device Security data.
New: Detected Date
Added the Detected Date incident field for Palo Alto Networks Device Security data.
New: Device Last Activity
Added the Device Last Activity incident field for Palo Alto Networks Device Security data.
New: Device Security Site Names
Added the Device Security Site Names incident field for Palo Alto Networks Device Security data.
New: Device Security Source
Added the Device Security Source incident field for Palo Alto Networks Device Security data.
New: ICS-CERT
Added the ICS-CERT incident field for Palo Alto Networks Device Security data.
New: Last Detected Date
Added the Last Detected Date incident field for Palo Alto Networks Device Security data.
New: OS Detail
Added the OS Detail incident field for Palo Alto Networks Device Security data.
New: Reason History
Added the Reason History incident field for Palo Alto Networks Device Security data.
New: Remediation Confirmed
Added the Remediation Confirmed incident field for Palo Alto Networks Device Security data.
New: Remediation Instructions
Added the Remediation Instructions incident field for Palo Alto Networks Device Security data.
New: Risk Level
Added the Risk Level incident field for Palo Alto Networks Device Security data.
New: SBOM
Added the SBOM incident field for Palo Alto Networks Device Security data.
New: Serial Number
Added the Serial Number incident field for Palo Alto Networks Device Security data.
New: Subnets
Added the Subnets incident field for Palo Alto Networks Device Security data.
New: Ticket ID
Added the Ticket ID incident field for Palo Alto Networks Device Security data.
New: Ticket State
Added the Ticket State incident field for Palo Alto Networks Device Security data.
New: Traffic Restricted
Added the Traffic Restricted incident field for Palo Alto Networks Device Security data.
New: Updated Date
Added the Updated Date incident field for Palo Alto Networks Device Security data.
New: Vulnerability Name
Added the Vulnerability Name incident field for Palo Alto Networks Device Security data.
New: Vulnerability Priority
Added the Vulnerability Priority incident field for Palo Alto Networks Device Security data.
New: Vulnerability Status
Added the Vulnerability Status incident field for Palo Alto Networks Device Security data.
New: Work Order
Added the Work Order incident field for Palo Alto Networks Device Security data.
Alert Title
Added the Alert Title incident field for Palo Alto Networks Device Security data.
Alert Type
Added the Alert Type incident field for Palo Alto Networks Device Security data.
Alert Unique ID
Added the Alert Unique ID incident field for Palo Alto Networks Device Security data.
App Name
Added the App Name incident field for Palo Alto Networks Device Security data.
Client Port
Added the Client Port incident field for Palo Alto Networks Device Security data.
Created At
Added the Created At incident field for Palo Alto Networks Device Security data.
Date
Added the Date incident field for Palo Alto Networks Device Security data.
Device Labels
Added the Device Labels incident field for Palo Alto Networks Device Security data.
Device Role
Added the Device Role incident field for Palo Alto Networks Device Security data.
Device Security IEC References
Added the Device Security IEC References incident field for Palo Alto Networks Device Security data.
Device Security MITRE Mappings Raw
Added the Device Security MITRE Mappings Raw incident field for Palo Alto Networks Device Security data.
Firewall Action
Added the Firewall Action incident field for Palo Alto Networks Device Security data.
Firewall Name
Added the Firewall Name incident field for Palo Alto Networks Device Security data.
Firewall Serial Number
Added the Firewall Serial Number incident field for Palo Alto Networks Device Security data.
Forensic Search Timestamp
Added the Forensic Search Timestamp incident field for Palo Alto Networks Device Security data.
Inbound Interface
Added the Inbound Interface incident field for Palo Alto Networks Device Security data.
Message ID
Added the Message ID incident field for Palo Alto Networks Device Security data.
Network
Added the Network incident field for Palo Alto Networks Device Security data.
Outbound Interface
Added the Outbound Interface incident field for Palo Alto Networks Device Security data.
Profile
Added the Profile incident field for Palo Alto Networks Device Security data.
Profile Category
Added the Profile Category incident field for Palo Alto Networks Device Security data.
Profile Confidence Level
Added the Profile Confidence Level incident field for Palo Alto Networks Device Security data.
Profile Vertical
Added the Profile Vertical incident field for Palo Alto Networks Device Security data.
Recommended Actions
Added the Recommended Actions incident field for Palo Alto Networks Device Security data.
Remote Host Category
Added the Remote Host Category incident field for Palo Alto Networks Device Security data.
Remote Host MAC
Added the Remote Host MAC incident field for Palo Alto Networks Device Security data.
Severity Number
Added the Severity Number incident field for Palo Alto Networks Device Security data.
Severity (raw / display)
Added the Severity (raw / display) incident field for Palo Alto Networks Device Security data.
Site ID
Added the Site ID incident field for Palo Alto Networks Device Security data.
Source Labels
Added the Source Labels incident field for Palo Alto Networks Device Security data.
Threat Category
Added the Threat Category incident field for Palo Alto Networks Device Security data.
Threat ID
Added the Threat ID incident field for Palo Alto Networks Device Security data.
Vendor
Added the Vendor incident field for Palo Alto Networks Device Security data.

Integrations

Palo Alto Networks Device Security

Fixed an issue where repeated vulnerability fetch cycles could create duplicate incidents and fail to progress through vulnerability results.
Added support for resumable vulnerability pagination. The integration continues across short or empty intermediate pages and commits the fetch timestamp after it completes the scan, without depending on the API sort order.
Updated the vulnerability deduplication to retain IDs throughout the scan and at the fetch timestamp without trimming them. The integration excludes records detected before the scan start time.
Fixed an issue with detection date handling. The integration now uses the earliest valid date in list-valued responses, regardless of list order or timestamp format.
Added support for validation and migration of vulnerability fetch checkpoints, validation of API page responses, and debug logging for fetch progress.
Updated the SCM authentication to refresh cached tokens when the authentication URL changes and to report missing client secrets.
Updated the Docker image to: demisto/fastapi:0.142.2.13587997.

Layouts

Device Security Vulnerability Layout
Updated the vulnerability layout with device, vulnerability, remediation, and ticket details, including the detection and resolution history.
Device Security Alert Layout
Updated the layout with additional alert information and threat framework mappings.

Mappers

Palo Alto Networks Device Security Incoming Mapper

Updated the alert and vulnerability field mappings to populate the updated layouts, including severity, device details, threat framework mappings, remediation details, and vulnerability history.

Scripts

New: DeviceSecurityHistorySection

Added a script that displays the detection and resolution history for the current Device Security vulnerability incident.

CombineSeverity

Added a transformer that combines raw and display severity values into a single incident field.

DeviceSecurityThreatFrameworkMappings

Added a dynamic layout section that displays MITRE ATT&CK Enterprise and ICS mappings and IEC 62443 references.

FormatDeviceSecurityDestinationPort

Added a transformer that formats destination ports and protocols for display in an incident field.

Related pull requests:
- 46343
- 46225

Download

1.0.1 - 13620815 (October 7, 2026)

Integrations

Palo Alto Networks Device Security

Documentation and metadata improvements.

Related pull requests:
- 45950

Download

1.0.0 - 11215107 (July 21, 2026)

Download

1.1.0 - 13994690 (October 21, 2026)

Incident Fields

New: APT List
Added the APT List incident field for Palo Alto Networks Device Security data.
New: Asset Criticality
Added the Asset Criticality incident field for Palo Alto Networks Device Security data.
New: Asset Tag
Added the Asset Tag incident field for Palo Alto Networks Device Security data.
New: Assignees
Added the Assignees incident field for Palo Alto Networks Device Security data.
New: CVSS Score
Added the CVSS Score incident field for Palo Alto Networks Device Security data.
New: Detected Date
Added the Detected Date incident field for Palo Alto Networks Device Security data.
New: Device Last Activity
Added the Device Last Activity incident field for Palo Alto Networks Device Security data.
New: Device Security Site Names
Added the Device Security Site Names incident field for Palo Alto Networks Device Security data.
New: Device Security Source
Added the Device Security Source incident field for Palo Alto Networks Device Security data.
New: ICS-CERT
Added the ICS-CERT incident field for Palo Alto Networks Device Security data.
New: Last Detected Date
Added the Last Detected Date incident field for Palo Alto Networks Device Security data.
New: OS Detail
Added the OS Detail incident field for Palo Alto Networks Device Security data.
New: Reason History
Added the Reason History incident field for Palo Alto Networks Device Security data.
New: Remediation Confirmed
Added the Remediation Confirmed incident field for Palo Alto Networks Device Security data.
New: Remediation Instructions
Added the Remediation Instructions incident field for Palo Alto Networks Device Security data.
New: Risk Level
Added the Risk Level incident field for Palo Alto Networks Device Security data.
New: SBOM
Added the SBOM incident field for Palo Alto Networks Device Security data.
New: Serial Number
Added the Serial Number incident field for Palo Alto Networks Device Security data.
New: Subnets
Added the Subnets incident field for Palo Alto Networks Device Security data.
New: Ticket ID
Added the Ticket ID incident field for Palo Alto Networks Device Security data.
New: Ticket State
Added the Ticket State incident field for Palo Alto Networks Device Security data.
New: Traffic Restricted
Added the Traffic Restricted incident field for Palo Alto Networks Device Security data.
New: Updated Date
Added the Updated Date incident field for Palo Alto Networks Device Security data.
New: Vulnerability Name
Added the Vulnerability Name incident field for Palo Alto Networks Device Security data.
New: Vulnerability Priority
Added the Vulnerability Priority incident field for Palo Alto Networks Device Security data.
New: Vulnerability Status
Added the Vulnerability Status incident field for Palo Alto Networks Device Security data.
New: Work Order
Added the Work Order incident field for Palo Alto Networks Device Security data.
Alert Title
Added the Alert Title incident field for Palo Alto Networks Device Security data.
Alert Type
Added the Alert Type incident field for Palo Alto Networks Device Security data.
Alert Unique ID
Added the Alert Unique ID incident field for Palo Alto Networks Device Security data.
App Name
Added the App Name incident field for Palo Alto Networks Device Security data.
Client Port
Added the Client Port incident field for Palo Alto Networks Device Security data.
Created At
Added the Created At incident field for Palo Alto Networks Device Security data.
Date
Added the Date incident field for Palo Alto Networks Device Security data.
Device Labels
Added the Device Labels incident field for Palo Alto Networks Device Security data.
Device Role
Added the Device Role incident field for Palo Alto Networks Device Security data.
Device Security IEC References
Added the Device Security IEC References incident field for Palo Alto Networks Device Security data.
Device Security MITRE Mappings Raw
Added the Device Security MITRE Mappings Raw incident field for Palo Alto Networks Device Security data.
Firewall Action
Added the Firewall Action incident field for Palo Alto Networks Device Security data.
Firewall Name
Added the Firewall Name incident field for Palo Alto Networks Device Security data.
Firewall Serial Number
Added the Firewall Serial Number incident field for Palo Alto Networks Device Security data.
Forensic Search Timestamp
Added the Forensic Search Timestamp incident field for Palo Alto Networks Device Security data.
Inbound Interface
Added the Inbound Interface incident field for Palo Alto Networks Device Security data.
Message ID
Added the Message ID incident field for Palo Alto Networks Device Security data.
Network
Added the Network incident field for Palo Alto Networks Device Security data.
Outbound Interface
Added the Outbound Interface incident field for Palo Alto Networks Device Security data.
Profile
Added the Profile incident field for Palo Alto Networks Device Security data.
Profile Category
Added the Profile Category incident field for Palo Alto Networks Device Security data.
Profile Confidence Level
Added the Profile Confidence Level incident field for Palo Alto Networks Device Security data.
Profile Vertical
Added the Profile Vertical incident field for Palo Alto Networks Device Security data.
Recommended Actions
Added the Recommended Actions incident field for Palo Alto Networks Device Security data.
Remote Host Category
Added the Remote Host Category incident field for Palo Alto Networks Device Security data.
Remote Host MAC
Added the Remote Host MAC incident field for Palo Alto Networks Device Security data.
Severity Number
Added the Severity Number incident field for Palo Alto Networks Device Security data.
Severity (raw / display)
Added the Severity (raw / display) incident field for Palo Alto Networks Device Security data.
Site ID
Added the Site ID incident field for Palo Alto Networks Device Security data.
Source Labels
Added the Source Labels incident field for Palo Alto Networks Device Security data.
Threat Category
Added the Threat Category incident field for Palo Alto Networks Device Security data.
Threat ID
Added the Threat ID incident field for Palo Alto Networks Device Security data.
Vendor
Added the Vendor incident field for Palo Alto Networks Device Security data.

Integrations

Palo Alto Networks Device Security

Fixed an issue where repeated vulnerability fetch cycles could create duplicate incidents and fail to progress through vulnerability results.
Added support for resumable vulnerability pagination. The integration continues across short or empty intermediate pages and commits the fetch timestamp after it completes the scan, without depending on the API sort order.
Updated the vulnerability deduplication to retain IDs throughout the scan and at the fetch timestamp without trimming them. The integration excludes records detected before the scan start time.
Fixed an issue with detection date handling. The integration now uses the earliest valid date in list-valued responses, regardless of list order or timestamp format.
Added support for validation and migration of vulnerability fetch checkpoints, validation of API page responses, and debug logging for fetch progress.
Updated the SCM authentication to refresh cached tokens when the authentication URL changes and to report missing client secrets.
Updated the Docker image to: demisto/fastapi:0.142.2.13587997.

Layouts

Device Security Vulnerability Layout
Updated the vulnerability layout with device, vulnerability, remediation, and ticket details, including the detection and resolution history.
Device Security Alert Layout
Updated the layout with additional alert information and threat framework mappings.

Mappers

Palo Alto Networks Device Security Incoming Mapper

Updated the alert and vulnerability field mappings to populate the updated layouts, including severity, device details, threat framework mappings, remediation details, and vulnerability history.

Scripts

New: DeviceSecurityHistorySection

Added a script that displays the detection and resolution history for the current Device Security vulnerability incident.

CombineSeverity

Added a transformer that combines raw and display severity values into a single incident field.

DeviceSecurityThreatFrameworkMappings

Added a dynamic layout section that displays MITRE ATT&CK Enterprise and ICS mappings and IEC 62443 references.

FormatDeviceSecurityDestinationPort

Added a transformer that formats destination ports and protocols for display in an incident field.

Related pull requests:
- 46343
- 46225

Download

1.0.1 - R13620815 (October 7, 2026)

Integrations

Palo Alto Networks Device Security

Documentation and metadata improvements.

Related pull requests:
- 45950

Download

1.0.0 - 11215107 (July 21, 2026)

Collects Palo Alto Networks Device Security alerts and vulnerabilities in Cortex, applies RACI-based triage guidance, and supports ServiceNow ticket creation and status-based incident closure workflows.

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	July 21, 2026
Last Release	October 21, 2026

Incident Response

Network Security

Vulnerability Management

Asset Management

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.