Device Security by Palo Alto Networks

Details
Content
Dependencies
Version History

Collects Palo Alto Networks Device Security alerts and vulnerabilities in Cortex XSOAR, applies RACI-based triage guidance, and supports ServiceNow ticket creation and status-based incident closure workflows.

Palo Alto Networks Device Security Content Pack

This content pack enables Cortex XSOAR to integrate with Palo Alto Networks Device Security. It includes one integration and four automation scripts.

Palo Alto Networks Device Security Integration

A wrapper around the Device Security Portal APIs for:

getting device details by ID
listing devices
listing alerts and vulnerabilities
resolving alerts and vulnerabilities

This integration can be used for incident response.

RACI Model Calculation Script

Based on a mapping defined in Settings > Advanced > Lists, device attributes, and alert/vulnerability fields, this automation script can evaluate the "R" and "I" in RACI (Responsible and Informed). This is useful when incidents must be assigned to different departments in a large company.

ServiceNow Ticket Check Script

This pack works with ServiceNow by persisting the new ticket ID in the custom field "Device Security ServiceNow Record ID". This automation script loops through all open Device Security alerts and vulnerabilities in XSOAR and queries ServiceNow for ticket status. If the status is "CLOSED", the corresponding XSOAR incident is closed.

Alert and Vulnerability Resolution Post-Processing Script

Resolves Device Security portal incidents in the XSOAR post-processing stage.

Palo Alto Networks Device Security Content Pack

This content pack enables Cortex to integrate with Palo Alto Networks Device Security. It includes one integration and four automation scripts.

Palo Alto Networks Device Security Integration

A wrapper around the Device Security Portal APIs for:

getting device details by ID
listing devices
listing alerts and vulnerabilities
resolving alerts and vulnerabilities

This integration can be used for incident response.

RACI Model Calculation Script

ServiceNow Ticket Check Script

Alert and Vulnerability Resolution Post-Processing Script

Resolves Device Security portal incidents in the XSOAR post-processing stage.

Automations

Name	Description
device-security-check-servicenow	Closes the Cortex XSOAR incident if the Device Security ServiceNow ticket was closed. This command should be run in a Job.
device-security-alert-post-processing	Resolves the alert in the Device Security portal via the API. Designed to run as a post-processing script.
device-security-get-raci	Calculates the responsible and informed parties for a Device Security incident by matching incident and device details against the Device Security configuration list.
device-security-vuln-post-processing	Resolves the vulnerability incident in the Device Security portal via the API. Designed to run as a post-processing script.

Classifiers

Name	Description
Palo Alto Networks Device Security Classifier	Classifies Palo Alto Networks Device Security incidents.
Palo Alto Networks Device Security Incoming Mapper	Maps Palo Alto Networks Device Security incidents.

Incident Fields

Name	Description
Device Security ServiceNow Record ID	The ServiceNow record system ID
Device Security ServiceNow Table Name	The name of the ServiceNow Table
Device Security Incident URL	The url to Palo Alto Networks Device Security incident

Incident Types

Name	Description
Device Security Vulnerability
Device Security Alert

Integrations

Name	Description
Palo Alto Networks Device Security	Use the Palo Alto Networks Device Security integration to fetch alerts and vulnerabilities, retrieve device details, and resolve security incidents (previously Zingbox).

Layouts

Name	Description
Device Security Alert Layout	Layout for Device Security Alert incidents.
Device Security Vulnerability Layout	Layout for Device Security Vulnerability incidents.

Playbooks

Name	Description
PANW Device Security Incident Handling with ServiceNow	This playbook creates a ServiceNow ticket after the incident is enriched by Palo Alto Networks Device Security portal (previously Zingbox Cloud).
PANW Device Security ServiceNow Tickets Check	This playbook checks the ServiceNow ticket status for Palo Alto Networks Device Security (previously Zingbox) alerts or vulnerabilities and automatically closes the Cortex XSOAR incident when the related ServiceNow ticket is closed. Designed to run as a recurring job.

Automations

Name	Description
device-security-vuln-post-processing	Resolves the vulnerability incident in the Device Security portal via the API. Designed to run as a post-processing script.
device-security-alert-post-processing	Resolves the alert in the Device Security portal via the API. Designed to run as a post-processing script.
device-security-get-raci	Calculates the responsible and informed parties for a Device Security incident by matching incident and device details against the Device Security configuration list.
device-security-check-servicenow	Closes the Cortex incident if the Device Security ServiceNow ticket was closed. This command should be run in a Job.

Classifiers

Name	Description
Palo Alto Networks Device Security Classifier	Classifies Palo Alto Networks Device Security incidents.
Palo Alto Networks Device Security Incoming Mapper	Maps Palo Alto Networks Device Security incidents.

Incident Fields

Name	Description
Device Security ServiceNow Table Name	The name of the ServiceNow Table
Device Security ServiceNow Record ID	The ServiceNow record system ID
Device Security Incident URL	The url to Palo Alto Networks Device Security incident

Incident Types

Name	Description
Device Security Alert
Device Security Vulnerability

Integrations

Name	Description
Palo Alto Networks Device Security	Use the Palo Alto Networks Device Security integration to fetch alerts and vulnerabilities, retrieve device details, and resolve security incidents (previously Zingbox).

Layouts

Name	Description
Device Security Alert Layout	Layout for Device Security Alert incidents.
Device Security Vulnerability Layout	Layout for Device Security Vulnerability incidents.

Playbooks

Name	Description
PANW Device Security Alert Handling with ServiceNow	This playbook creates a ServiceNow ticket after the alert is enriched by Palo Alto Networks Device Security portal (previously Zingbox Cloud).
PANW Device Security ServiceNow Tickets Check	This playbook checks the ServiceNow ticket status for Palo Alto Networks Device Security (previously Zingbox) alerts or vulnerabilities and automatically closes the Cortex alert when the related ServiceNow ticket is closed. Designed to run as a recurring job.

Required Content Packs (3)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
ServiceNow	By: Cortex XSOAR

Optional Content Packs (0)

Pack Name	Pack By

All level dependencies (6)

Pack Name	Pack By
ServiceNow	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	July 21, 2026
Last Release	July 21, 2026

Incident Response

Network Security

Vulnerability Management

Asset Management

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.