SaaS Security connects directly to your sanctioned SaaS applications to provide data classification, sharing and permission visibility, and threat detection.
SaaS Security Incident Layout:
Remediate an Asset:
SaaS Security Incident Layout:
Remediate an Asset:
| Name | Description |
|---|---|
Saas Security - Incoming Mapper | Maps incoming Saas Security incidents fields. |
Saas Security - Outgoing Mapper | Maps outgoing Saas Security incidents fields. |
| Name | Description |
|---|---|
Saas Security Remove Inherited Sharing | Asset exposure due to inheritance from parent folders. Used by playbook to specify whether or not to remove inherited sharing. If True, Remove public sharing displays. If False, N/A displays. |
Saas Security Status | Incident status details, combining State and Category. When Closed, followed by No Reason, Business Justified, Misidentified, or In The Cloud. When Open, followed by New. |
Saas Security Incident Severity Level | Severity that you specified in that policy rule on SaaS Security. |
Saas Security Asset ID | Unique alphanumeric number assigned by SaaS Security when it discovers a policy violation and records an incident. Used for troubleshooting purposes. If you need to contact SaaS Security Technical Support, a Support Engineer might ask for this ID in order to perform database searches on that asset. For example: |
Saas Security State | Incident state, either Open or Closed. |
Saas Security Incident Id | Unique numeric number assigned by SaaS Security when it discovers a policy violation and records an incident. This number associates the asset with the rule violation on SaaS Security. Incident ID is not the same as ID, which is the unique identifier that XSOAR assigns when it loads the corresponding incident. |
Saas Security Asset Name | Unique name of the asset. Item Name on SaaS Security. |
Saas Security Asset Owner | |
Saas Security Assigned To | Administrator who is assigned to the incident on SaaS Security to investigate the incident. |
Saas Security Asset Owner Email | |
Saas Security Resolved By | Administrator who resolved the incident on SaaS Security. SaaS Security captures all administrator actions in administrator logs. If incident closes automatically because policy violation no longer exists, the incident is Resolved by the API. |
Saas Security Asset URL | Fully qualified URL to the Assets Details page on SaaS Security for the asset that triggered the incident. For security reasons, the link is not active, yet provides an efficient method to access the asset: simply copy/paste the link in your browser. For example: https://example.com/cloud_assets/61d7bb44539a741ce86stf3 |
Saas Security Remediation Type | Action taken to remediate includes Remove Public Link, Quarantine, and Restore. |
Saas Security Category | Reason the incident is Closed on SaaS Security, including No Reason, Business Justified, Misidentified, and In The Cloud. Open incidents indicate New. |
| Name | Description |
|---|---|
Saas Security Incident |
| Name | Description |
|---|---|
| SaaS Security | SaaS Security API is a cloud-based service that you can connect directly to your sanctioned SaaS applications using the cloud app’s API to provide data classification, sharing and permission visibility, and threat detection. This Content Pack provides insights into risks posed by data exposure and policy violations and enables you to use Cortex XSOAR to effectively manage the incidents discovered by SaaS Security API. |
| Name | Description |
|---|---|
Saas Security Layout | Layout for the Saas Security incident type. |
| Name | Description |
|---|---|
| Saas Security - Take Action on the Incident | This sub-playbook will send email notification to the Saas Security Admin for taking remediation action on the incident. |
| Saas Security - Incident Processor | This playbook notifies incidents owner and provides remediation options to Saas Security admin for resolving incidents. |
| SaaS Security - Remediate an Asset | Take a remediation action over an asset: The remote action should have the following structure:
|
| Name | Description |
|---|---|
Saas Security - Outgoing Mapper | Maps outgoing Saas Security incidents fields. |
Saas Security - Incoming Mapper | Maps incoming Saas Security incidents fields. |
| Name | Description |
|---|---|
Saas Security Asset URL | Fully qualified URL to the Assets Details page on SaaS Security for the asset that triggered the incident. For security reasons, the link is not active, yet provides an efficient method to access the asset: simply copy/paste the link in your browser. For example: https://example.com/cloud_assets/61d7bb44539a741ce86stf3 |
Saas Security Remove Inherited Sharing | Asset exposure due to inheritance from parent folders. Used by playbook to specify whether or not to remove inherited sharing. If True, Remove public sharing displays. If False, N/A displays. |
Saas Security Status | Incident status details, combining State and Category. When Closed, followed by No Reason, Business Justified, Misidentified, or In The Cloud. When Open, followed by New. |
Saas Security Asset Name | Unique name of the asset. Item Name on SaaS Security. |
Saas Security Asset Owner | |
Saas Security Resolved By | Administrator who resolved the incident on SaaS Security. SaaS Security captures all administrator actions in administrator logs. If incident closes automatically because policy violation no longer exists, the incident is Resolved by the API. |
Saas Security State | Incident state, either Open or Closed. |
Saas Security Incident Id | Unique numeric number assigned by SaaS Security when it discovers a policy violation and records an incident. This number associates the asset with the rule violation on SaaS Security. Incident ID is not the same as ID, which is the unique identifier that XSOAR assigns when it loads the corresponding incident. |
Saas Security Asset ID | Unique alphanumeric number assigned by SaaS Security when it discovers a policy violation and records an incident. Used for troubleshooting purposes. If you need to contact SaaS Security Technical Support, a Support Engineer might ask for this ID in order to perform database searches on that asset. For example: |
Saas Security Asset Owner Email | |
Saas Security Remediation Type | Action taken to remediate includes Remove Public Link, Quarantine, and Restore. |
Saas Security Assigned To | Administrator who is assigned to the incident on SaaS Security to investigate the incident. |
Saas Security Incident Severity Level | Severity that you specified in that policy rule on SaaS Security. |
| Name | Description |
|---|---|
Saas Security Incident |
| Name | Description |
|---|---|
| SaaS Security Event Collector | Palo Alto Networks SaaS Security Event Collector integration for XSIAM. |
| SaaS Security | SaaS Security API is a cloud-based service that you can connect directly to your sanctioned SaaS applications using the cloud app’s API to provide data classification, sharing and permission visibility, and threat detection. This Content Pack provides insights into risks posed by data exposure and policy violations and enables you to use Cortex to effectively manage the incidents discovered by SaaS Security API. |
| Name | Description |
|---|---|
Prisma SAAS Security Modeling Rule |
| Name | Description |
|---|---|
Prisma SAAS Security Parsing Rule |
| Name | Description |
|---|---|
| SaaS Security - Remediate an Asset | Take a remediation action over an asset: The remote action should have the following structure:
|
Saas Security - Alert Processor | This playbook notifies alerts owner and provides remediation options to Saas Security admin for resolving alerts. |
Saas Security - Take Action on the Alert | This sub-playbook will send email notification to the Saas Security Admin for taking remediation action on the alert. |
| Pack Name | Pack By |
|---|---|
| Base | By: Cortex XSOAR |
| Common Playbooks | By: Cortex XSOAR |
| Common Scripts | By: Cortex XSOAR |
| Filters And Transformers | By: Cortex XSOAR |
| Pack Name | Pack By |
|---|---|
| Common Types | By: Cortex XSOAR |
| Pack Name | Pack By |
|---|---|
| Cortex REST API | By: Cortex XSOAR |
| Common Scripts | By: Cortex XSOAR |
| Filters And Transformers | By: Cortex XSOAR |
| Rasterize | By: Cortex XSOAR |
| Common Playbooks | By: Cortex XSOAR |
| Aggregated Scripts | By: Cortex XSOAR |
| Base | By: Cortex XSOAR |
Updated the YML config name and id objects to unique values in order to resolve a backend compatibility issue.
Updated the YML config name and id objects to unique values in order to resolve a backend compatibility issue.
max_iterations default value to be 50 instead of 100 to avoid timeouts.max_fetch parameter is empty, it will default to 1000 to avoid timeouts.
| Certification | Certified | Read more |
| Supported By | Cortex | |
| Created | September 1, 2021 | |
| Last Release | April 27, 2026 |
