IoT 3rd Party Integrations by Palo Alto Networks

Details
Content
Dependencies
Version History

Palo Alto Networks IoT 3rd Party Integrations

## Palo Alto Networks IoT 3rd Party Integrations Content Pack

The PANW IoT 3rd Party Integrations pack enables you to automate the management of your IoT Cloud devices, alerts, and vulnerabilities by using Cortex XSOAR playbooks to pull and push data between your PANW IoT Cloud environment and 3rd party services, such as SIEM, ServiceNow, and Cisco ISE.

### Palo Alto Networks IoT 3rd Party Integration

Wrap around the IoT Security Portal APIs for

Getting a list of assets or a single asset - devices, vulnerabilities and alerts.
Coverting an asset to external format.
Reporting a status back to Palo Alto Networks IoT cloud.

Incident Types

Name	Description
PANW IoT 3rd Party ServiceNow Alert
PANW IoT 3rd Party SIEM Alert
PANW IoT 3rd Party Cisco ISE Quarantine
PANW IoT 3rd Party SIEM Vulnerability
PANW IoT 3rd Party ServiceNow Vulnerability
PANW IoT 3rd Party Cisco ISE Un-quarantine

Integrations

Name	Description
Palo Alto Networks IoT 3rd Party	Base Integration for Palo Alto IoT third party integrations. This integration communicates with Palo Alto IoT Cloud to get alerts, vulnerabilities and devices.

Automations

Name	Description
SendPANWIoTDevicesToCiscoISE	This script takes (as a required argument) custom attributes from PANW IoT cloud and creates or updates endpoints in ISE with the input custom attributes. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html
SendAllPANWIoTDevicesToServiceNow	Gets all available devices from the IoT cloud and sends them to the ServiceNow. server
SendAllPANWIoTAssetsToSIEM	Retrieves all specified assets from the PANW IoT cloud and sends them to the SIEM server.
SendAllPANWIoTDevicesToCiscoISE	Gets all available devices from the IoT cloud and updates or creates them on Cisco ISE using the custom attributes.
GetCiscoISEActiveInstance	Determines which configured Cisco ISE instance is in active/primary state and returns the name of the instance.
GeneratePANWIoTDeviceTableQueryForServiceNow	Generates a single query or query list with which to query in ServiceNow.

Playbooks

Name	Description
Bulk Export to Cisco ISE - PANW IoT 3rd Party Integration	This playbook gets all available device inventory from PANW IoT Cloud and updates/create endpoints with custom attributes on Cisco ISE.
Bulk Export Devices to ServiceNow - PANW IoT 3rd Party Integration	This playbook gets all available devices from PANW IoT Cloud and updates/creates endpoints with custom attributes in ServiceNow.
Quarantine Device in Cisco ISE - PANW IoT 3rd Party Integration	Playbook to handle incident triggered from PANW Iot (Zingbox) UI to quarantine a device in Cisco ISE.
Un-quarantine Device in Cisco ISE - PANW IoT 3rd Party Integration	Handles incidents triggered from PANW Iot (Zingbox) UI to un-quarantine a device in Cisco ISE.
Export Single Vulnerability to ServiceNow - PANW IoT 3rd Party Integration	This playbook to handles incidents triggered in the PANW IoT (Zingbox) UI by sending the vulnerability to ServiceNow.
Export Single Asset to SIEM - PANW IoT 3rd Party Integration	This playbook handles incidents triggered in the PANW IoT (Zingbox) UI by sending the alert to your SIEM.
Bulk Export to SIEM - PANW IoT 3rd Party Integration	This playbook gets all available assets ( alerts, vulnerabilities and devices) and send then to configured PANW third-party integration SIEM server.
Incremental Export to SIEM - PANW IoT 3rd Party Integration	This playbook should be run as a job at an interval of every 15 minutes. Each run will get incremental updates for devices, alerts, and vulnerabilities and send CEF syslogs to the configured SIEM server.
Incremental Export Devices to ServiceNow - PANW IoT 3rd Party Integration	Playbook to be run every 15 minutes via a job. Each run will get incremental updates for devices to send to ServiceNow server.
Incremental Export to Cisco ISE - PANW IoT 3rd Party Integration	Playbook to be run every 15 minutes via a job. Each run will get incremental updates for devices, and will update or create new endpoints in Cisco ISE with PANW IOT discovered attributes (ISE custom attributes).
Export Single Alert to ServiceNow - PANW IoT 3rd Party Integration	This playbook handles incidents triggered in the PANW IoT (Zingbox) UI by sending the alert to ServiceNow.

Incident Types

Name	Description
PANW IoT 3rd Party ServiceNow Alert
PANW IoT 3rd Party SIEM Alert
PANW IoT 3rd Party Cisco ISE Quarantine
PANW IoT 3rd Party SIEM Vulnerability
PANW IoT 3rd Party ServiceNow Vulnerability
PANW IoT 3rd Party Cisco ISE Un-quarantine

Integrations

Name	Description
Palo Alto Networks IoT 3rd Party	Base Integration for Palo Alto IoT third party integrations. This integration communicates with Palo Alto IoT Cloud to get alerts, vulnerabilities and devices.

Automations

Name	Description
SendPANWIoTDevicesToCiscoISE	This script takes (as a required argument) custom attributes from PANW IoT cloud and creates or updates endpoints in ISE with the input custom attributes. This automation runs using the default Limited User role, unless you explicitly change the permissions. For more information, see the section about permissions here: https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-2/cortex-xsoar-admin/playbooks/automations.html
SendAllPANWIoTDevicesToServiceNow	Gets all available devices from the IoT cloud and sends them to the ServiceNow. server
SendAllPANWIoTAssetsToSIEM	Retrieves all specified assets from the PANW IoT cloud and sends them to the SIEM server.
SendAllPANWIoTDevicesToCiscoISE	Gets all available devices from the IoT cloud and updates or creates them on Cisco ISE using the custom attributes.
GetCiscoISEActiveInstance	Determines which configured Cisco ISE instance is in active/primary state and returns the name of the instance.
GeneratePANWIoTDeviceTableQueryForServiceNow	Generates a single query or query list with which to query in ServiceNow.

Playbooks

Name	Description
Bulk Export to Cisco ISE - PANW IoT 3rd Party Integration	This playbook gets all available device inventory from PANW IoT Cloud and updates/create endpoints with custom attributes on Cisco ISE.
Bulk Export Devices to ServiceNow - PANW IoT 3rd Party Integration	This playbook gets all available devices from PANW IoT Cloud and updates/creates endpoints with custom attributes in ServiceNow.
Quarantine Device in Cisco ISE - PANW IoT 3rd Party Integration	Playbook to handle incident triggered from PANW Iot (Zingbox) UI to quarantine a device in Cisco ISE.
Un-quarantine Device in Cisco ISE - PANW IoT 3rd Party Integration	Handles incidents triggered from PANW Iot (Zingbox) UI to un-quarantine a device in Cisco ISE.
Export Single Vulnerability to ServiceNow - PANW IoT 3rd Party Integration	This playbook to handles incidents triggered in the PANW IoT (Zingbox) UI by sending the vulnerability to ServiceNow.
Export Single Asset to SIEM - PANW IoT 3rd Party Integration	This playbook handles incidents triggered in the PANW IoT (Zingbox) UI by sending the alert to your SIEM.
Bulk Export to SIEM - PANW IoT 3rd Party Integration	This playbook gets all available assets ( alerts, vulnerabilities and devices) and send then to configured PANW third-party integration SIEM server.
Incremental Export to SIEM - PANW IoT 3rd Party Integration	This playbook should be run as a job at an interval of every 15 minutes. Each run will get incremental updates for devices, alerts, and vulnerabilities and send CEF syslogs to the configured SIEM server.
Incremental Export Devices to ServiceNow - PANW IoT 3rd Party Integration	Playbook to be run every 15 minutes via a job. Each run will get incremental updates for devices to send to ServiceNow server.
Incremental Export to Cisco ISE - PANW IoT 3rd Party Integration	Playbook to be run every 15 minutes via a job. Each run will get incremental updates for devices, and will update or create new endpoints in Cisco ISE with PANW IOT discovered attributes (ISE custom attributes).
Export Single Alert to ServiceNow - PANW IoT 3rd Party Integration	This playbook handles incidents triggered in the PANW IoT (Zingbox) UI by sending the alert to ServiceNow.

Required Content Packs (6)

Pack Name	Pack By
Syslog	By: Cortex XSOAR
ServiceNow	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Base	By: Cortex XSOAR
Cisco ISE	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR

Optional Content Packs (0)

Pack Name	Pack By

All level dependencies (34)

Pack Name	Pack By
Check Point Firewall	By: Cortex XSOAR
Cisco Umbrella Investigate	By: Cortex XSOAR
Image OCR	By: Cortex XSOAR
F5 Silverline	By: Cortex XSOAR
CrowdStrike Falcon Intelligence Sandbox	By: Cortex XSOAR
Cisco Firepower	By: Cortex XSOAR
Syslog	By: Cortex XSOAR
VulnDB	By: Cortex XSOAR
MITRE ATT&CK	By: Cortex XSOAR
Remote Access	By: Cortex XSOAR
Google Maps	By: Cortex XSOAR
Rapid7 InsightVM	By: Cortex XSOAR
Sophos XG Firewall	By: Cortex XSOAR
Active Directory Query	By: Cortex XSOAR
Cylance Protect	By: Cortex XSOAR
Slack	By: Cortex XSOAR
Cisco Secure Cloud Analytics (Stealthwatch Cloud)	By: Cortex XSOAR
VirusTotal - Private API (Deprecated)	By: VirusTotal
PAN-OS by Palo Alto Networks	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
ARIAPacketIntelligence	By: ARIA Cybersecurity Solutions
FortiGate	By: Cortex XSOAR
Signal Sciences WAF	By: Cortex XSOAR
Akamai WAF	By: Cortex XSOAR
Cisco ISE	By: Cortex XSOAR
Cisco ASA	By: Cortex XSOAR
Kenna	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
CVE Search	By: Cortex XSOAR
ThreatX	By: Cortex XSOAR
Zscaler Internet Access	By: Cortex XSOAR
ServiceNow	By: Cortex XSOAR

PUBLISHER

Cortex

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Cortex
Created	February 7, 2021
Last Release	October 23, 2022

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.

IoT 3rd Party Integrations by Palo Alto Networks

## Palo Alto Networks IoT 3rd Party Integrations Content Pack

### Palo Alto Networks IoT 3rd Party Integration

Integrations

Palo Alto Networks IoT 3rd Party

Integrations

Palo Alto Networks IoT 3rd Party

Scripts

SendPANWIoTDevicesToCiscoISE

Scripts

SendPANWIoTDevicesToCiscoISE

Playbooks

Export Single Vulnerability to ServiceNow - PANW IoT 3rd Party Integration

PUBLISHER

PLATFORMS

INFO

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER