Palo Alto Networks - Strata Cloud Manager

Integrate with Prisma Access to monitor the status of the Service, alert and take actions.

Provides commands for interaction with Prisma SASE API.

Dynamically retrieve and add to allow list IPs Prisma Access uses to egress traffic to the internet and SaaS apps.

This playbook helps to create a security rule to block indicators from an EDL. This playbook should run only once to setup the EDL object and its rule.

This playbook assists in blocking communication with the provided IPs in the Prisma SASE policy.
If a group name is provided, the IPs will be added to the mentioned static address group (there should be a rule associated with the group name to block communication with that group).
And if the group name is not provided, a new group will be created with a dedicated rule to block communication with those IPs.

Goal

This playbook is designed to automatically quarantine a SentinelOne host in response to a new threat incident trigger using Prisma SASE.

Playbook Flow

• Trigger: The playbook activates upon the creation of a new SentinelOne Threat incident.
• Process:
  1. Retrieves the Host ID from Cortex Data Lake.
  2. Loads detailed information about the agent.
  3. If the Host ID is found and the agent is not decommissioned, it initiates quarantine through Prisma SASE.

Dependencies and Configuration

• This playbook requires being set as the default in the SentinelOne instance configuration.
• It specifically responds to events categorized as 'Threats'.
• Ensure that the Prisma SASE, Cortex Data Lake and SentinelOne integrations are properly configured and operational for seamless execution of this playbook.

This playbook handles the creation or editing of the Security Policy Rule for Prisma SASE integration.

This playbook appends a Static Address Group with provided IPs.

This playbook helps to create an EDL object within the Prisma SASE Objects section.

Use the Prisma Access integration to run SSH CLI commands and query the connection states for all tunnels. If any tunnels are down - the playbook escalates to a manual task for remediation and provides recommendations on next steps in the task description. The playbook can be run as a job, or triggered from an incoming event to confirm an initial suspicion (such as a tunnel log from Cortex Data Lake) to validate that the issue still exists.

The playbook will handle the operation of blocking a URL within the organization.
If a category is provided, the URL will be added to the list.
If not, a new URL category will be created, and a new security rule that blocks that category.

Retrieve Prisma Access Egress IP for specific geographic zones and populate in security groups within cloud services.

This playbook creates new address objects in the Prisma SASE Object section. Those objects can be used later on in other objects such as Security Rules.

This playbook forces logout of a specific user and computer from Prisma Access.

Integrate with Prisma Access to monitor the status of the Service, alert and take actions.

Provides commands for interaction with Prisma SASE API.

Dynamically retrieve and add to allow list IPs Prisma Access uses to egress traffic to the internet and SaaS apps.

Use the Prisma Access integration to run SSH CLI commands and query the connection states for all tunnels. If any tunnels are down - the playbook escalates to a manual task for remediation and provides recommendations on next steps in the task description. The playbook can be run as a job, or triggered from an incoming event to confirm an initial suspicion (such as a tunnel log from Cortex Data Lake) to validate that the issue still exists.

This playbook forces logout of a specific user and computer from Prisma Access.

This playbook assists in blocking communication with the provided IPs in the Prisma SASE policy.
If a group name is provided, the IPs will be added to the mentioned static address group (there should be a rule associated with the group name to block communication with that group).
And if the group name is not provided, a new group will be created with a dedicated rule to block communication with those IPs.

Retrieve Prisma Access Egress IP for specific geographic zones and populate in security groups within cloud services.

This playbook helps to create a security rule to block indicators from an EDL. This playbook should run only once to setup the EDL object and its rule.

This playbook helps to create an EDL object within the Prisma SASE Objects section.

Goal

This playbook is designed to automatically quarantine a SentinelOne host in response to a new threat incident trigger using Prisma SASE.

Playbook Flow

• Trigger: The playbook activates upon the creation of a new SentinelOne Threat incident.
• Process:
  1. Retrieves the Host ID from Cortex Data Lake.
  2. Loads detailed information about the agent.
  3. If the Host ID is found and the agent is not decommissioned, it initiates quarantine through Prisma SASE.

Dependencies and Configuration

• This playbook requires being set as the default in the SentinelOne instance configuration.
• It specifically responds to events categorized as 'Threats'.
• Ensure that the Prisma SASE, Cortex Data Lake and SentinelOne integrations are properly configured and operational for seamless execution of this playbook.

The playbook will handle the operation of blocking a URL within the organization.
If a category is provided, the URL will be added to the list.
If not, a new URL category will be created, and a new security rule that blocks that category.

This playbook creates new address objects in the Prisma SASE Object section. Those objects can be used later on in other objects such as Security Rules.

This playbook appends a Static Address Group with provided IPs.

This playbook handles the creation or editing of the Security Policy Rule for Prisma SASE integration.