IoT 3rd Party Integrations by Palo Alto Networks

Details
Content
Dependencies
Version History

Palo Alto Networks IoT 3rd Party Integrations

## Palo Alto Networks IoT 3rd Party Integrations Content Pack

The PANW IoT 3rd Party Integrations pack enables you to automate the management of your IoT Cloud devices, alerts, and vulnerabilities by using Cortex XSOAR playbooks to pull and push data between your PANW IoT Cloud environment and 3rd party services, such as SIEM, ServiceNow, and Cisco ISE.

### Palo Alto Networks IoT 3rd Party Integration

Wrap around the IoT Security Portal APIs for

Getting a list of assets or a single asset - devices, vulnerabilities and alerts.
Coverting an asset to external format.
Reporting a status back to Palo Alto Networks IoT cloud.

Incident Types

Name	Description
PANW IoT 3rd Party Cisco ISE Un-quarantine
PANW IoT 3rd Party SIEM Alert
PANW IoT 3rd Party SIEM Vulnerability
PANW IoT 3rd Party Cisco ISE Quarantine
PANW IoT 3rd Party ServiceNow Alert
PANW IoT 3rd Party ServiceNow Vulnerability

Playbooks

Name	Description
Incremental Export to Cisco ISE - PANW IoT 3rd Party Integration	Playbook to be run every 15 minutes via a job. Each run will get incremental updates for devices, and will update or create new endpoints in Cisco ISE with PANW IOT discovered attributes (ISE custom attributes).
Bulk Export to SIEM - PANW IoT 3rd Party Integration	This playbook gets all available assets ( alerts, vulnerabilities and devices) and send then to configured PANW third-party integration SIEM server.
Incremental Export Devices to ServiceNow - PANW IoT 3rd Party Integration	Playbook to be run every 15 minutes via a job. Each run will get incremental updates for devices to send to ServiceNow server.
Export Single Asset to SIEM - PANW IoT 3rd Party Integration	This playbook handles incidents triggered in the PANW IoT (Zingbox) UI by sending the alert to your SIEM.
Un-quarantine Device in Cisco ISE - PANW IoT 3rd Party Integration	Handles incidents triggered from PANW Iot (Zingbox) UI to un-quarantine a device in Cisco ISE.
Bulk Export Devices to ServiceNow - PANW IoT 3rd Party Integration	This playbook gets all available devices from PANW IoT Cloud and updates/creates endpoints with custom attributes in ServiceNow.
Incremental Export to SIEM - PANW IoT 3rd Party Integration	This playbook should be run as a job at an interval of every 15 minutes. Each run will get incremental updates for devices, alerts, and vulnerabilities and send CEF syslogs to the configured SIEM server.
Export Single Alert to ServiceNow - PANW IoT 3rd Party Integration	This playbook handles incidents triggered in the PANW IoT (Zingbox) UI by sending the alert to ServiceNow.
Bulk Export to Cisco ISE - PANW IoT 3rd Party Integration	This playbook gets all available device inventory from PANW IoT Cloud and updates/create endpoints with custom attributes on Cisco ISE.
Export Single Vulnerability to ServiceNow - PANW IoT 3rd Party Integration	This playbook to handles incidents triggered in the PANW IoT (Zingbox) UI by sending the vulnerability to ServiceNow.
Quarantine Device in Cisco ISE - PANW IoT 3rd Party Integration	Playbook to handle incident triggered from PANW Iot (Zingbox) UI to quarantine a device in Cisco ISE.

Automations

Name	Description
GeneratePANWIoTDeviceTableQueryForServiceNow	Generates a single query or query list with which to query in ServiceNow.
GetCiscoISEActiveInstance	Determines which configured Cisco ISE instance is in active/primary state and returns the name of the instance.
SendAllPANWIoTAssetsToSIEM	Retrieves all specified assets from the PANW IoT cloud and sends them to the SIEM server.
SendAllPANWIoTDevicesToCiscoISE	Gets all available devices from the IoT cloud and updates or creates them on Cisco ISE using the custom attributes.
SendPANWIoTDevicesToCiscoISE	This script takes (as a required argument) custom attributes from PANW IoT cloud and creates or updates endpoints in ISE with the input custom attributes. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html
SendAllPANWIoTDevicesToServiceNow	Gets all available devices from the IoT cloud and sends them to the ServiceNow. server

Integrations

Name	Description
Palo Alto Networks IoT 3rd Party	Base Integration for Palo Alto IoT third party integrations. This integration communicates with Palo Alto IoT Cloud to get alerts, vulnerabilities and devices.

Incident Types

Name	Description
PANW IoT 3rd Party Cisco ISE Un-quarantine
PANW IoT 3rd Party SIEM Alert
PANW IoT 3rd Party SIEM Vulnerability
PANW IoT 3rd Party Cisco ISE Quarantine
PANW IoT 3rd Party ServiceNow Alert
PANW IoT 3rd Party ServiceNow Vulnerability

Playbooks

Name	Description
Incremental Export to Cisco ISE - PANW IoT 3rd Party Integration	Playbook to be run every 15 minutes via a job. Each run will get incremental updates for devices, and will update or create new endpoints in Cisco ISE with PANW IOT discovered attributes (ISE custom attributes).
Bulk Export to SIEM - PANW IoT 3rd Party Integration	This playbook gets all available assets ( alerts, vulnerabilities and devices) and send then to configured PANW third-party integration SIEM server.
Incremental Export Devices to ServiceNow - PANW IoT 3rd Party Integration	Playbook to be run every 15 minutes via a job. Each run will get incremental updates for devices to send to ServiceNow server.
Export Single Asset to SIEM - PANW IoT 3rd Party Integration	This playbook handles incidents triggered in the PANW IoT (Zingbox) UI by sending the alert to your SIEM.
Un-quarantine Device in Cisco ISE - PANW IoT 3rd Party Integration	Handles incidents triggered from PANW Iot (Zingbox) UI to un-quarantine a device in Cisco ISE.
Bulk Export Devices to ServiceNow - PANW IoT 3rd Party Integration	This playbook gets all available devices from PANW IoT Cloud and updates/creates endpoints with custom attributes in ServiceNow.
Incremental Export to SIEM - PANW IoT 3rd Party Integration	This playbook should be run as a job at an interval of every 15 minutes. Each run will get incremental updates for devices, alerts, and vulnerabilities and send CEF syslogs to the configured SIEM server.
Export Single Alert to ServiceNow - PANW IoT 3rd Party Integration	This playbook handles incidents triggered in the PANW IoT (Zingbox) UI by sending the alert to ServiceNow.
Bulk Export to Cisco ISE - PANW IoT 3rd Party Integration	This playbook gets all available device inventory from PANW IoT Cloud and updates/create endpoints with custom attributes on Cisco ISE.
Export Single Vulnerability to ServiceNow - PANW IoT 3rd Party Integration	This playbook to handles incidents triggered in the PANW IoT (Zingbox) UI by sending the vulnerability to ServiceNow.
Quarantine Device in Cisco ISE - PANW IoT 3rd Party Integration	Playbook to handle incident triggered from PANW Iot (Zingbox) UI to quarantine a device in Cisco ISE.

Automations

Name	Description
GeneratePANWIoTDeviceTableQueryForServiceNow	Generates a single query or query list with which to query in ServiceNow.
GetCiscoISEActiveInstance	Determines which configured Cisco ISE instance is in active/primary state and returns the name of the instance.
SendAllPANWIoTAssetsToSIEM	Retrieves all specified assets from the PANW IoT cloud and sends them to the SIEM server.
SendAllPANWIoTDevicesToCiscoISE	Gets all available devices from the IoT cloud and updates or creates them on Cisco ISE using the custom attributes.
SendPANWIoTDevicesToCiscoISE	This script takes (as a required argument) custom attributes from PANW IoT cloud and creates or updates endpoints in ISE with the input custom attributes. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html
SendAllPANWIoTDevicesToServiceNow	Gets all available devices from the IoT cloud and sends them to the ServiceNow. server

Integrations

Name	Description
Palo Alto Networks IoT 3rd Party	Base Integration for Palo Alto IoT third party integrations. This integration communicates with Palo Alto IoT Cloud to get alerts, vulnerabilities and devices.

Required Content Packs (14)

Pack Name	Pack By
CommonScripts	By: Cortex XSOAR
ServiceNow	By: Cortex XSOAR
CommonPlaybooks	By: Cortex XSOAR
Base	By: Cortex XSOAR
Syslog	By: Cortex XSOAR
cisco-ise	By: Cortex XSOAR
DemistoRESTAPI	By: Cortex XSOAR
CoreAlertFields	By: Cortex XSOAR
CommonTypes	By: Cortex XSOAR
FiltersAndTransformers	By: Cortex XSOAR
rasterize	By: Cortex XSOAR
Core	By: Cortex XSOAR
Palo_Alto_Networks_WildFire	By: Cortex XSOAR
Active_Directory_Query	By: Cortex XSOAR

Optional Content Packs (0)

Pack Name	Pack By

1.1.3 - R3901212 (October 23, 2022)

Integrations

Palo Alto Networks IoT 3rd Party

Removed excessive error traceback printing.
Updated the Docker image to: demisto/python3:3.10.4.30607.

Related pull requests:
- 19584

Download

1.1.2 - R2146019 (December 21, 2021)

Integrations

Palo Alto Networks IoT 3rd Party

Updated the Docker image to: demisto/python3:3.9.8.24399.

Download

1.1.1 - 2020903 (November 28, 2021)

Scripts

SendPANWIoTDevicesToCiscoISE

Added reference to required permissions in automation's description and README.

Download

1.1.0 - 1882648 (November 2, 2021)

Scripts

SendPANWIoTDevicesToCiscoISE

Breaking Change: DBotRole has been removed from this automation.
This change will affect any playbook that is dependent on, or runs, this automation.
This automation will now run using the default Limited User role, unless you explicitly change the permissions.
For more information, see the section about permissions here:
https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html

Download

1.0.3 - 1790547 (October 13, 2021)

Playbooks

Export Single Vulnerability to ServiceNow - PANW IoT 3rd Party Integration

Fixed a typo in the description of Export_Single_Vulnerability_to_ServiceNow_-_PANW_IoT_3rd_Party_Integration.

Download

1.0.2 - 7772209 (September 25, 2021)

Scripts

GeneratePANWIoTDeviceTableQueryForServiceNow

Updated the Docker image to: demisto/python3:3.9.7.24076.

GetCiscoISEActiveInstance

Updated the Docker image to: demisto/python3:3.9.7.24076.

SendAllPANWIoTAssetsToSIEM

Updated the Docker image to: demisto/python3:3.9.7.24076.

SendAllPANWIoTDevicesToCiscoISE

Updated the Docker image to: demisto/python3:3.9.7.24076.

SendAllPANWIoTDevicesToServiceNow

Updated the Docker image to: demisto/python3:3.9.7.24076.

SendPANWIoTDevicesToCiscoISE

Updated the Docker image to: demisto/python3:3.9.7.24076.

Download

1.0.1 - 7561139 (September 12, 2021)

Integrations

Palo Alto Networks IoT 3rd Party

Updated the Docker image to: demisto/python3:3.9.7.24076.

Download

1.0.0 - 7535528 (February 7, 2021)

Palo Alto Networks IoT 3rd Party Integrations

Download

PUBLISHER

Cortex

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	February 7, 2021
Last Release	October 23, 2022

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.