SaaS Security by Palo Alto Networks

Maps incoming Saas Security incidents fields.

Maps outgoing Saas Security incidents fields.

Administrator who is assigned to the incident on SaaS Security to investigate the incident.

Fully qualified URL to the Assets Details page on SaaS Security for the asset that triggered the incident. For security reasons, the link is not active, yet provides an efficient method to access the asset: simply copy/paste the link in your browser.

For example: https://example.com/cloud_assets/61d7bb44539a741ce86stf3

Administrator who resolved the incident on SaaS Security. SaaS Security captures all administrator actions in administrator logs. If incident closes automatically because policy violation no longer exists, the incident is Resolved by the API.

Asset exposure due to inheritance from parent folders. Used by playbook to specify whether or not to remove inherited sharing. If True, Remove public sharing displays. If False, N/A displays.

Reason the incident is Closed on SaaS Security, including No Reason, Business Justified, Misidentified, and In The Cloud. Open incidents indicate New.

Unique numeric number assigned by SaaS Security when it discovers a policy violation and records an incident. This number associates the asset with the rule violation on SaaS Security. Incident ID is not the same as ID, which is the unique identifier that XSOAR assigns when it loads the corresponding incident.

Unique alphanumeric number assigned by SaaS Security when it discovers a policy violation and records an incident.

Used for troubleshooting purposes. If you need to contact SaaS Security Technical Support, a Support Engineer might ask for this ID in order to perform database searches on that asset.

For example:
61d7bb44539a741ce86stf3

Incident status details, combining State and Category. When Closed, followed by No Reason, Business Justified, Misidentified, or In The Cloud. When Open, followed by New.

Incident state, either Open or Closed.

Action taken to remediate includes Remove Public Link, Quarantine, and Restore.

Unique name of the asset. Item Name on SaaS Security.

Severity that you specified in that policy rule on SaaS Security.

SaaS Security API is a cloud-based service that you can connect directly to your sanctioned SaaS applications using the cloud app’s API to provide data classification, sharing and permission visibility, and threat detection. This Content Pack provides insights into risks posed by data exposure and policy violations and enables you to use Cortex XSOAR to effectively manage the incidents discovered by SaaS Security API.

Layout for the Saas Security incident type.

This sub-playbook will send email notification to the Saas Security Admin for taking remediation action on the incident.

This playbook notifies incidents owner and provides remediation options to Saas Security admin for resolving incidents.

Take a remediation action over an asset:
Use this playbook as a sub-playbook to take a remediation action on an asset. Available remediation actions are 1) Remove public sharing, 2) Quarantine, and 3) Restore.
This playbook implements polling by continuously running the saas-security-remediation-status-get
command to get the remediation status for a given asset ID, until the operation completes.

The remote action should have the following structure:

1. Initiate the operation - provide the Asset ID and the remediation action.
2. Poll to check if the operation completed.
3. Get the results of the operation.

Maps incoming Saas Security incidents fields.

Maps outgoing Saas Security incidents fields.

Action taken to remediate includes Remove Public Link, Quarantine, and Restore.

Unique numeric number assigned by SaaS Security when it discovers a policy violation and records an incident. This number associates the asset with the rule violation on SaaS Security. Incident ID is not the same as ID, which is the unique identifier that XSOAR assigns when it loads the corresponding incident.

Fully qualified URL to the Assets Details page on SaaS Security for the asset that triggered the incident. For security reasons, the link is not active, yet provides an efficient method to access the asset: simply copy/paste the link in your browser.

For example: https://example.com/cloud_assets/61d7bb44539a741ce86stf3

Incident state, either Open or Closed.

Unique alphanumeric number assigned by SaaS Security when it discovers a policy violation and records an incident.

Used for troubleshooting purposes. If you need to contact SaaS Security Technical Support, a Support Engineer might ask for this ID in order to perform database searches on that asset.

For example:
61d7bb44539a741ce86stf3

Incident status details, combining State and Category. When Closed, followed by No Reason, Business Justified, Misidentified, or In The Cloud. When Open, followed by New.

Severity that you specified in that policy rule on SaaS Security.

Unique name of the asset. Item Name on SaaS Security.

Administrator who resolved the incident on SaaS Security. SaaS Security captures all administrator actions in administrator logs. If incident closes automatically because policy violation no longer exists, the incident is Resolved by the API.

Asset exposure due to inheritance from parent folders. Used by playbook to specify whether or not to remove inherited sharing. If True, Remove public sharing displays. If False, N/A displays.

Administrator who is assigned to the incident on SaaS Security to investigate the incident.

Palo Alto Networks SaaS Security Event Collector integration for XSIAM.

SaaS Security API is a cloud-based service that you can connect directly to your sanctioned SaaS applications using the cloud app’s API to provide data classification, sharing and permission visibility, and threat detection. This Content Pack provides insights into risks posed by data exposure and policy violations and enables you to use Cortex XSIAM to effectively manage the incidents discovered by SaaS Security API.

Take a remediation action over an asset:
Use this playbook as a sub-playbook to take a remediation action on an asset. Available remediation actions are 1) Remove public sharing, 2) Quarantine, and 3) Restore.
This playbook implements polling by continuously running the saas-security-remediation-status-get
command to get the remediation status for a given asset ID, until the operation completes.

The remote action should have the following structure:

1. Initiate the operation - provide the Asset ID and the remediation action.
2. Poll to check if the operation completed.
3. Get the results of the operation.

This sub-playbook will send email notification to the Saas Security Admin for taking remediation action on the alert.

This playbook notifies alerts owner and provides remediation options to Saas Security admin for resolving alerts.