Palo Alto Networks - Strata Cloud Manager

Integrate with Palo Alto Networks Prisma SASE to query activity and take actions.

## Prisma Access Content Pack

This content pack enables XSOAR to integrate with Palo Alto Networks Prisma Access. It includes 2 integrations.

### Prisma Access Egress IP feed

Dynamically retrieve and allow IPs Prisma Access uses to egress traffic to the internet and SaaS apps.

This integration can be used as a TIM feed to fetch indicators, or if a playbook starts from a non-indicator trigger it can use the command to get the IPs.

### Prisma Access

Integrate with Prisma Access to query the status of the service and take actions.

The integration includes commands to:

Force logout a specific user from Prisma Access
List currently active users
Run a Prisma Access query (e.g. getGPaaSLast90DaysUniqueUsers)
Run a custom CLI command

The integration uses both the Panorama XML API and SSH into the PAN-OS CLI. SSH is based on the netmiko library and will use the netmiko docker image.

### Prisma SASE

Integrate with Prisma SASE to view or make changes to Prisma Access configurations.

The integration includes commands to:

Create, update, delete and get security rules.
Create, update, delete and get address objects.
Create, update, delete and get external dynamic lists.
Create, update, delete and get custom URL categories.
Create, update, delete and get tags.
Create, update, delete and get address groups.
Get configuration jobs.
Push all configuration jobs.

The integration uses the Prisma SASE Multi-tenant API documented here: Prisma SASE API.

Pack Contributors:

JD Plant

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

## Prisma Access Content Pack

This content pack enables XSOAR to integrate with Palo Alto Networks Prisma Access. It includes 2 integrations.

### Prisma Access Egress IP feed

Dynamically retrieve and allow IPs Prisma Access uses to egress traffic to the internet and SaaS apps.

This integration can be used as a TIM feed to fetch indicators, or if a playbook starts from a non-indicator trigger it can use the command to get the IPs.

### Prisma Access

Integrate with Prisma Access to query the status of the service and take actions.

The integration includes commands to:

Force logout a specific user from Prisma Access
List currently active users
Run a Prisma Access query (e.g. getGPaaSLast90DaysUniqueUsers)
Run a custom CLI command

The integration uses both the Panorama XML API and SSH into the PAN-OS CLI. SSH is based on the netmiko library and will use the netmiko docker image.

### Prisma SASE

Integrate with Prisma SASE to view or make changes to Prisma Access configurations.

The integration includes commands to:

Create, update, delete and get security rules.
Create, update, delete and get address objects.
Create, update, delete and get external dynamic lists.
Create, update, delete and get custom URL categories.
Create, update, delete and get tags.
Create, update, delete and get address groups.
Get configuration jobs.
Push all configuration jobs.

The integration uses the Prisma SASE Multi-tenant API documented here: Prisma SASE API.

Pack Contributors:

JD Plant

Contributions are welcome and appreciated. For more info, visit our Contribution Guide.

Integrations

Name	Description
Palo Alto Networks - Strata Cloud Manager	Provides commands for interaction with Prisma SASE API.
Prisma Access	Integrate with Prisma Access to monitor the status of the Service, alert and take actions.
Prisma Access Egress IP feed	Dynamically retrieve and add to allow list IPs Prisma Access uses to egress traffic to the internet and SaaS apps.

Playbooks

Name	Description
Prisma SASE - Quarantine a SentinelOne Host With Active Threat	Goal This playbook is designed to automatically quarantine a SentinelOne host in response to a new threat incident trigger using Prisma SASE. Playbook Flow Trigger: The playbook activates upon the creation of a new SentinelOne Threat incident. Process: Retrieves the Host ID from Cortex Data Lake. Loads detailed information about the agent. If the Host ID is found and the agent is not decommissioned, it initiates quarantine through Prisma SASE. Dependencies and Configuration This playbook requires being set as the default in the SentinelOne instance configuration. It specifically responds to events categorized as 'Threats'. Ensure that the Prisma SASE, Cortex Data Lake and SentinelOne integrations are properly configured and operational for seamless execution of this playbook.
Prisma SASE - Block URL	The playbook will handle the operation of blocking a URL within the organization. If a category is provided, the URL will be added to the list. If not, a new URL category will be created, and a new security rule that blocks that category.
Prisma SASE - Block IP	This playbook assists in blocking communication with the provided IPs in the Prisma SASE policy. If a group name is provided, the IPs will be added to the mentioned static address group (there should be a rule associated with the group name to block communication with that group). And if the group name is not provided, a new group will be created with a dedicated rule to block communication with those IPs.
Prisma Access - Connection Health Check	Use the Prisma Access integration to run SSH CLI commands and query the connection states for all tunnels. If any tunnels are down - the playbook escalates to a manual task for remediation and provides recommendations on next steps in the task description. The playbook can be run as a job, or triggered from an incoming event to confirm an initial suspicion (such as a tunnel log from Cortex Data Lake) to validate that the issue still exists.
Prisma SASE - Create Address Object	This playbook creates new address objects in the Prisma SASE Object section. Those objects can be used later on in other objects such as Security Rules.
Prisma SASE - Create or Edit Security Policy Rule	This playbook handles the creation or editing of the Security Policy Rule for Prisma SASE integration.
Prisma Access Whitelist Egress IPs on SaaS Services	Retrieve Prisma Access Egress IP for specific geographic zones and populate in security groups within cloud services.
Prisma SASE - Create a security pre-rule for EDL	This playbook helps to create a security rule to block indicators from an EDL. This playbook should run only once to setup the EDL object and its rule.
Prisma Access - Logout User	This playbook forces logout of a specific user and computer from Prisma Access.
Prisma SASE - Create or Edit EDL object	This playbook helps to create an EDL object within the Prisma SASE Objects section.
Prisma SASE - Add IPs to Static Address Group	This playbook appends a Static Address Group with provided IPs.

Integrations

Name	Description
Prisma Access Egress IP feed	Dynamically retrieve and add to allow list IPs Prisma Access uses to egress traffic to the internet and SaaS apps.
Prisma Access	Integrate with Prisma Access to monitor the status of the Service, alert and take actions.
Palo Alto Networks - Strata Cloud Manager	Provides commands for interaction with Prisma SASE API.

Playbooks

Name	Description
Prisma SASE - Create or Edit EDL object	This playbook helps to create an EDL object within the Prisma SASE Objects section.
Prisma SASE - Quarantine a SentinelOne Host With Active Threat	Goal This playbook is designed to automatically quarantine a SentinelOne host in response to a new threat alert trigger using Prisma SASE. Playbook Flow Trigger: The playbook activates upon the creation of a new SentinelOne Threat alert. Process: Retrieves the Host ID from Cortex Data Lake. Loads detailed information about the agent. If the Host ID is found and the agent is not decommissioned, it initiates quarantine through Prisma SASE. Dependencies and Configuration This playbook requires being set as the default in the SentinelOne instance configuration. It specifically responds to events categorized as 'Threats'. Ensure that the Prisma SASE, Cortex Data Lake and SentinelOne integrations are properly configured and operational for seamless execution of this playbook.
Prisma SASE - Block IP	This playbook assists in blocking communication with the provided IPs in the Prisma SASE policy. If a group name is provided, the IPs will be added to the mentioned static address group (there should be a rule associated with the group name to block communication with that group). And if the group name is not provided, a new group will be created with a dedicated rule to block communication with those IPs.
Prisma SASE - Add IPs to Static Address Group	This playbook appends a Static Address Group with provided IPs.
Prisma SASE - Create or Edit Security Policy Rule	This playbook handles the creation or editing of the Security Policy Rule for Prisma SASE integration.
Prisma SASE - Block URL	The playbook will handle the operation of blocking a URL within the organization. If a category is provided, the URL will be added to the list. If not, a new URL category will be created, and a new security rule that blocks that category.
Prisma SASE - Create a security pre-rule for EDL	This playbook helps to create a security rule to block indicators from an EDL. This playbook should run only once to setup the EDL object and its rule.
Prisma Access Whitelist Egress IPs on SaaS Services	Retrieve Prisma Access Egress IP for specific geographic zones and populate in security groups within cloud services.
Prisma Access - Connection Health Check	Use the Prisma Access integration to run SSH CLI commands and query the connection states for all tunnels. If any tunnels are down - the playbook escalates to a manual task for remediation and provides recommendations on next steps in the task description. The playbook can be run as a job, or triggered from an incoming event to confirm an initial suspicion (such as a tunnel log from Cortex Data Lake) to validate that the issue still exists.
Prisma Access - Logout User	This playbook forces logout of a specific user and computer from Prisma Access.
Prisma SASE - Create Address Object	This playbook creates new address objects in the Prisma SASE Object section. Those objects can be used later on in other objects such as Security Rules.

Required Content Packs (3)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (4)

Pack Name	Pack By
AWS - EC2	By: Cortex XSOAR
Strata Logging Service by Palo Alto Networks	By: Cortex XSOAR
Google Cloud Compute	By: Cortex XSOAR
Okta	By: Cortex XSOAR

All level dependencies (4)

Pack Name	Pack By
Common Scripts	By: Cortex XSOAR
Base	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

2.1.7 - 938811 (April 7, 2024)

Integrations

Prisma Access

Updated the Docker image to: demisto/netmiko:1.0.0.91280.

Related pull requests:
- 33641
- 33516
- 33519
- 33515
- 33329
- 33314
- 33318
- 33328
- 33357
- 33344
- 33359
- 33458
- 33535
- 33534
- 33537
- 33552
- 33580
- 33553
- 33418
- 33583
- 33555
- 33556
- 33559
- 33560
- 33619
- 33591
- 33602
- 33600
- 33314
- 33318
- 33328
- 33357
- 33344
- 33359
- 33458

Download

2.1.6 - 883873 (March 11, 2024)

Integrations

Palo Alto Networks - Strata Cloud Manager

Note: the integration previously known as Palo Alto Networks - Prisma SASE will now be displayed as Palo Alto Networks Strata Cloud Manager.
Updated the Docker image to: demisto/python3:3.10.13.89009.

Related pull requests:
- 33121

Download

2.1.5 - 881200 (March 10, 2024)

Playbooks

Prisma SASE - Quarantine a SentinelOne Host With Active Threat

Changed the name of the playbook

Related pull requests:
- 33243

Download

2.1.4 - 836299 (February 18, 2024)

Integrations

Prisma Access Egress IP feed

Updated the Docker image to: demisto/python3:3.10.13.86272.

Related pull requests:
- 32446

Download

2.1.3 - 7098642 (December 7, 2023)

Playbooks

New: Prisma SASE - Quarantine Host With Active Threat

New:
This playbook is designed to automatically quarantine a SentinelOne host in response to a new threat incident trigger using Prisma SASE.

Playbook Flow

Trigger: The playbook activates upon the creation of a new SentinelOne Threat incident.
Process:
1. Retrieves the Host ID from Cortex Data Lake.
2. Loads detailed information about the agent.
3. If the Host ID is found and the agent is not decommissioned, it initiates quarantine through Prisma SASE.

Dependencies and Configuration

This playbook requires being set as the default in the SentinelOne instance configuration.
It specifically responds to events categorized as 'Threats'.
Ensure that the Prisma SASE, Cortex Data Lake and SentinelOne integrations are properly configured and operational for seamless execution of this playbook.
(Available from Cortex XSOAR 6.10.0).

Related pull requests:
- 31346

Download

2.1.2 - R6950398 (November 21, 2023)

Integrations

Palo Alto Networks - Prisma SASE

Added the prisma-sase-quarantine-host command to quarantine a host.
Updated the Docker image to: demisto/python3:3.10.13.78960.

Related pull requests:
- 30360
- 30461

Download

2.1.1 - R5866730 (July 25, 2023)

Integrations

Prisma Access Egress IP feed

Updated the Docker image to: demisto/python3:3.10.12.63474.

Related pull requests:
- 27905

Download

2.1.0 - 5636258 (June 28, 2023)

Playbooks

Prisma Access Whitelist Egress IPs on SaaS Services

Set sub-playbooks to be skipped if unavailable

New: Prisma SASE - Add IPs to Static Address Group

New: This playbook appends a Static Address Group with provided IPs.
This playbook appends a Static Address Group with provided IPs. (Available from Cortex XSOAR 6.8.0).

New: Prisma SASE - Block IP

New: This playbook assists in blocking communication with the provided IPs in the Prisma SASE policy.
If a group name is provided, the IPs will be added to the mentioned static address group (there should be a rule associated with the group name to block communication with that group).
And if the group name is not provided, a new group will be created with a dedicated rule to block communication with those IPs.
This playbook assists in blocking communication with the provided IPs in the Prisma SASE policy.
If a group name is provided, the IPs will be added to the mentioned static address group (there should be a rule associated with the group name to block communication with that group).
And if the group name is not provided, a new group will be created with a dedicated rule to block communication with those IPs. (Available from Cortex XSOAR 6.8.0).

New: Prisma SASE - Block URL

New: The playbook will handle the operation of blocking a URL within the organization.
If a category is provided, the URL will be added to the list.
If not, a new URL category will be created, and a new security rule that blocks that category.
The playbook will handle the operation of blocking a URL within the organization.
If a category is provided, the URL will be added to the list.
If not, a new URL category will be created, and a new security rule that blocks that category. (Available from Cortex XSOAR 6.8.0).

New: Prisma SASE - Create Address Object

New: This playbook creates new address objects in the Prisma SASE Object section. Those objects can be used later on in other objects such as Security Rules.
This playbook creates new address objects in the Prisma SASE Object section. Those objects can be used later on in other objects such as Security Rules.

New: Prisma SASE - Create a security pre-rule for EDL

New: This playbook helps to create a security rule to block indicators from an EDL. This playbook should run only once to setup the EDL object and its rule.
This playbook helps to create a security rule to block indicators from an EDL. This playbook should run only once to setup the EDL object and its rule. (Available from Cortex XSOAR 6.8.0).

New: Prisma SASE - Create or Edit EDL object

New: This playbook helps to create an EDL object within the Prisma SASE Objects section.
This playbook helps to create an EDL object within the Prisma SASE Objects section. (Available from Cortex XSOAR 6.8.0).

New: Prisma SASE - Create or Edit Security Policy Rule

New: This playbook handles the creation or editing of the Security Policy Rule for Prisma SASE integration.
This playbook handles the creation or editing of the Security Policy Rule for Prisma SASE integration.
(Available from Cortex XSOAR 6.8.0).

Related pull requests:
- 26162

Download

2.0.5 - 5583312 (June 21, 2023)

Integrations

Palo Alto Networks - Prisma SASE

Added the name argument the Prisma-sase-address-object-list command, to use as a filter.
Updated the Docker image to: demisto/python3:3.10.12.63474.

Related pull requests:
- 27610

Download

2.0.4 - 5443304 (June 4, 2023)

Integrations

Prisma Access

Fixed an issue where prisma-access-logout-user command failed to run when tenant is provided.

Related pull requests:
- 26700

Download

2.0.3 - 5428648 (June 2, 2023)

Integrations

Prisma Access

Added the Key integration parameters to support credentials fetching object.
Updated the Docker image to: demisto/netmiko:1.0.0.61830.

Related pull requests:
- 27112

Download

2.0.2 - 5356324 (May 24, 2023)

Integrations

Palo Alto Networks - Prisma SASE

Added the name argument to all the 'list' commands, to use as a filter.
Fixed an issue with the Frequency field in the human readable output of the prisma-sase-external-dynamic-list-create command.
Fixed an issue with the prisma-sase-external-dynamic-list-list command, caused by an API structure change.
Updated the Docker image to: demisto/python3:3.10.11.60032.

Related pull requests:
- 26315

Download

2.0.1 - R5170573 (May 2, 2023)

Integrations

Prisma Access

Added the tenant_name argument to the prisma-access-logout-user command.
Updated the Docker image to: demisto/netmiko:1.0.0.49353.

Related pull requests:
- 24872

Download

Certification	Certified	Read more
Supported By	Cortex
Created	July 22, 2020
Last Release	April 7, 2024

Palo Alto Networks - Strata Cloud Manager

## Prisma Access Content Pack

### Prisma Access Egress IP feed

### Prisma Access

### Prisma SASE

Pack Contributors:

## Prisma Access Content Pack

### Prisma Access Egress IP feed

### Prisma Access

### Prisma SASE

Pack Contributors:

Goal

Playbook Flow

Dependencies and Configuration

Goal

Playbook Flow

Dependencies and Configuration

Integrations

Prisma Access

Integrations

Palo Alto Networks - Strata Cloud Manager

Playbooks

Prisma SASE - Quarantine a SentinelOne Host With Active Threat

Integrations

Prisma Access Egress IP feed

Playbooks

New: Prisma SASE - Quarantine Host With Active Threat

Playbook Flow

Dependencies and Configuration

Integrations

Palo Alto Networks - Prisma SASE

Integrations

Prisma Access Egress IP feed

Playbooks

Prisma Access Whitelist Egress IPs on SaaS Services

New: Prisma SASE - Add IPs to Static Address Group

New: Prisma SASE - Block IP

New: Prisma SASE - Block URL

New: Prisma SASE - Create Address Object

New: Prisma SASE - Create a security pre-rule for EDL

New: Prisma SASE - Create or Edit EDL object

New: Prisma SASE - Create or Edit Security Policy Rule

Integrations

Palo Alto Networks - Prisma SASE

Integrations

Prisma Access

Integrations

Prisma Access

Integrations

Palo Alto Networks - Prisma SASE

Integrations

Prisma Access

PUBLISHER

PLATFORMS

INFO

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER