Details
Content
Dependencies
Version History

Reco is the leader in Dynamic SaaS Security — the only approach that eliminates the SaaS Security Gap (the growing gap between what you can protect and what’s outpacing your security).

Reco

Reco is the leader in SaaS & AI Security — the only approach that secures AI sprawl across SaaS apps and agents. Our platform provides complete visibility and control across your entire SaaS ecosystem, from core applications to the latest AI agents, enabling security teams to keep pace with the speed of AI adoption while maintaining robust security and reducing risk.

The Reco integration for Cortex XSOAR and Cortex XSIAM brings Reco's SaaS & AI intelligence directly into your SOC workflows — surfacing threats, enriching investigations, and automating remediation across the broader Cortex content ecosystem.

What does this pack do?

Govern AI usage — discover AI agents, AI-powered SaaS apps, and SaaS-to-SaaS OAuth grants with AI capabilities; prevent unauthorized data sharing; maintain audit-ready AI activity records
Secure AI agents — continuously monitor non-human identities operating in SaaS; enforce least-privilege policies; detect agent misuse and anomalous behavior
Audit your SaaS posture — query posture issues, posture checks, and threat detection policies across every connected app; score against SOC 2, ISO 27001, CIS, NIST, PCI DSS, HITRUST, and more
Detect and respond to SaaS threats — fetch behavioral threat alerts with a minimum-severity filter and AI-powered summaries; respond with existing SIEM & SOAR tooling
Investigate identities and accounts — enrich user context, flag risky employees, and track account activity across SaaS apps
Manage app risk — inventory your app portfolio, update authorization status, and track shadow IT
Protect sensitive data — surface files shared publicly, externally, or with private emails; query sensitivity-labeled assets
Automate remediation — tag leaving employees, add risk labels, post comments to alerts, and trigger playbooks

The SaaS Security Gap

Five types of sprawl are widening the gap between what you can and cannot protect:

App Sprawl — Apps constantly multiply, update, and form SaaS-to-SaaS connections, making it impossible to keep up
AI Sprawl — The infusion of GenAI into SaaS apps, and the surge of AI agents, undermines AI security readiness
Identity Sprawl — Keeping accounts secure while minimizing access privileges is unfeasible with the relentless proliferation of human and machine identities
Configuration Sprawl — The security posture of apps and users is critical yet utterly impractical to continuously update and maintain
Data Sprawl — More entities — including AI agents — access your data through more pathways, making breaches and insider threats harder to spot

Key Capabilities

AI Governance

Gain full visibility into AI tool adoption — from ChatGPT to copilots to embedded AI features
Prevent unauthorized data sharing and monitor AI usage for policy compliance
List AI agents with authorization status, risk level, and vendor
Surface apps and SaaS-to-SaaS grants using AI capabilities

AI Agent Security

Discover and continuously monitor AI agents operating within your SaaS environment
Understand what data agents access, what actions they perform, and where over-permission creates risk
Enforce least-privilege policies for non-human identities at scale
Detect AI agent misuse through behavioral threat detection policies

Posture Management

Continuously assess security risk across applications, identities, and data
List posture issues with severity, check status, and compliance framework mappings (SOC 2, ISO 27001, CIS, NIST CSF, NIST 800-53, PCI DSS, HITRUST)
List posture check definitions and threat detection policies
Track configuration drift with one-click remediation guidance

Threat Detection & Response (ITDR)

Fetch incidents with a minimum-severity filter (e.g., MEDIUM fetches medium severity and higher)
Get full alert details including policy violation evidence
Add comments to alerts and update incident timelines
Change alert status and resolve visibility events
Get AI-generated alert summaries

Identity & Account Intelligence

List all SaaS accounts with risk signals (MFA status, admin flag, risky user label)
Look up user context by email address across all integrated apps
List identities with aggregated cross-app view
Tag risky users and departing employees

SaaS Application Governance

Discover all apps (sanctioned, shadow, AI-powered) with vendor risk grades
List app instances (portfolio) from actively integrated apps
List SaaS-to-SaaS OAuth grants with permission risk scores
Update app authorization status

Data Security

Find sensitive files by name, ID, or sensitivity level
Query files shared with third-party domains
Identify files shared publicly or with external emails
List NetApp files carrying active business-impact labels

Platform Visibility

List SaaS events with actor, application, and outcome context
List groups and IP addresses
List business units
Query platform audit logs

Commands

Alerts & Incidents

reco-add-comment-to-alert — Add a comment to a Reco alert
reco-update-incident-timeline — Add a comment to an incident timeline
reco-change-alert-status — Update alert status (NEW / IN_PROGRESS / CLOSED)
reco-resolve-visibility-event — Resolve a visibility event in a Reco Finding
reco-get-alert-ai-summary — Get an AI-generated summary of an alert

Identities & Users

reco-get-risky-users — List all accounts flagged as risky
reco-add-risky-user-label — Tag a user as risky
reco-add-leaving-org-user-label — Tag a user as a departing employee
reco-get-user-context-by-email-address — Get identity context for an email address

SaaS Applications

reco-get-apps — List discovered apps with risk and AI signals
reco-set-app-authorization-status — Update an app's authorization status

Posture & Policies

reco-list-posture-issues — List posture issues with severity and check status
reco-list-posture-checks — List posture check definitions
reco-list-threat-detection-policies — List threat detection policies
reco-list-exclusions — List alert suppression exclusion rules

Data & Files

reco-get-sensitive-assets-by-name — Find sensitive assets by name
reco-get-sensitive-assets-by-id — Find sensitive assets by ID
reco-get-assets-by-id — Find any asset by ID
reco-get-assets-user-has-access-to — List files a user has access to
reco-get-sensitive-assets-with-public-link — List publicly exposed sensitive files
reco-get-assets-shared-externally — List files shared outside the organization
reco-get-files-exposed-to-email-address — List files accessible to a specific email
reco-get-files-shared-with-3rd-parties — List files shared with a third-party domain
reco-get-3rd-parties-accessible-to-data-list — List third-party domains with data access
reco-get-private-email-list-with-access — List private emails with file access

SaaS Events & Activity

reco-list-events — List SaaS activity events
reco-list-accounts — List SaaS accounts with risk signals
reco-list-groups — List SaaS groups
reco-list-saas-to-saas — List SaaS-to-SaaS OAuth grants
reco-list-ip-addresses — List observed IP addresses
reco-list-audit-logs — List Reco platform audit logs

AI Governance

reco-list-ai-agents — List detected AI agents

Platform

reco-list-app-instances — List integrated app instances (portfolio)
reco-list-devices — List managed and unmanaged devices
reco-list-business-units — List business units
reco-get-link-to-user-overview-page — Generate a deep link to the Reco UI
reco-add-exclusion-filter — Add a classifier exclusion filter

For more information: www.reco.ai

Reco Overview

Reco

The Reco integration for Cortex and Cortex XSIAM brings Reco's SaaS & AI intelligence directly into your SOC workflows — surfacing threats, enriching investigations, and automating remediation across the broader Cortex content ecosystem.

What does this pack do?

Govern AI usage — discover AI agents, AI-powered SaaS apps, and SaaS-to-SaaS OAuth grants with AI capabilities; prevent unauthorized data sharing; maintain audit-ready AI activity records
Secure AI agents — continuously monitor non-human identities operating in SaaS; enforce least-privilege policies; detect agent misuse and anomalous behavior
Audit your SaaS posture — query posture issues, posture checks, and threat detection policies across every connected app; score against SOC 2, ISO 27001, CIS, NIST, PCI DSS, HITRUST, and more
Detect and respond to SaaS threats — fetch behavioral threat alerts with a minimum-severity filter and AI-powered summaries; respond with existing SIEM & SOAR tooling
Investigate identities and accounts — enrich user context, flag risky employees, and track account activity across SaaS apps
Manage app risk — inventory your app portfolio, update authorization status, and track shadow IT
Protect sensitive data — surface files shared publicly, externally, or with private emails; query sensitivity-labeled assets
Automate remediation — tag leaving employees, add risk labels, post comments to alerts, and trigger playbooks

The SaaS Security Gap

Five types of sprawl are widening the gap between what you can and cannot protect:

App Sprawl — Apps constantly multiply, update, and form SaaS-to-SaaS connections, making it impossible to keep up
AI Sprawl — The infusion of GenAI into SaaS apps, and the surge of AI agents, undermines AI security readiness
Identity Sprawl — Keeping accounts secure while minimizing access privileges is unfeasible with the relentless proliferation of human and machine identities
Configuration Sprawl — The security posture of apps and users is critical yet utterly impractical to continuously update and maintain
Data Sprawl — More entities — including AI agents — access your data through more pathways, making breaches and insider threats harder to spot

Key Capabilities

AI Governance

Gain full visibility into AI tool adoption — from ChatGPT to copilots to embedded AI features
Prevent unauthorized data sharing and monitor AI usage for policy compliance
List AI agents with authorization status, risk level, and vendor
Surface apps and SaaS-to-SaaS grants using AI capabilities

AI Agent Security

Discover and continuously monitor AI agents operating within your SaaS environment
Understand what data agents access, what actions they perform, and where over-permission creates risk
Enforce least-privilege policies for non-human identities at scale
Detect AI agent misuse through behavioral threat detection policies

Posture Management

Continuously assess security risk across applications, identities, and data
List posture issues with severity, check status, and compliance framework mappings (SOC 2, ISO 27001, CIS, NIST CSF, NIST 800-53, PCI DSS, HITRUST)
List posture check definitions and threat detection policies
Track configuration drift with one-click remediation guidance

Threat Detection & Response (ITDR)

Fetch incidents with a minimum-severity filter (e.g., MEDIUM fetches medium severity and higher)
Get full alert details including policy violation evidence
Add comments to alerts and update incident timelines
Change alert status and resolve visibility events
Get AI-generated alert summaries

Identity & Account Intelligence

List all SaaS accounts with risk signals (MFA status, admin flag, risky user label)
Look up user context by email address across all integrated apps
List identities with aggregated cross-app view
Tag risky users and departing employees

SaaS Application Governance

Discover all apps (sanctioned, shadow, AI-powered) with vendor risk grades
List app instances (portfolio) from actively integrated apps
List SaaS-to-SaaS OAuth grants with permission risk scores
Update app authorization status

Data Security

Find sensitive files by name, ID, or sensitivity level
Query files shared with third-party domains
Identify files shared publicly or with external emails
List NetApp files carrying active business-impact labels

Platform Visibility

List SaaS events with actor, application, and outcome context
List groups and IP addresses
List business units
Query platform audit logs

Commands

Alerts & Incidents

reco-add-comment-to-alert — Add a comment to a Reco alert
reco-update-incident-timeline — Add a comment to an incident timeline
reco-change-alert-status — Update alert status (NEW / IN_PROGRESS / CLOSED)
reco-resolve-visibility-event — Resolve a visibility event in a Reco Finding
reco-get-alert-ai-summary — Get an AI-generated summary of an alert

Identities & Users

reco-get-risky-users — List all accounts flagged as risky
reco-add-risky-user-label — Tag a user as risky
reco-add-leaving-org-user-label — Tag a user as a departing employee
reco-get-user-context-by-email-address — Get identity context for an email address

SaaS Applications

reco-get-apps — List discovered apps with risk and AI signals
reco-set-app-authorization-status — Update an app's authorization status

Posture & Policies

reco-list-posture-issues — List posture issues with severity and check status
reco-list-posture-checks — List posture check definitions
reco-list-threat-detection-policies — List threat detection policies
reco-list-exclusions — List alert suppression exclusion rules

Data & Files

reco-get-sensitive-assets-by-name — Find sensitive assets by name
reco-get-sensitive-assets-by-id — Find sensitive assets by ID
reco-get-assets-by-id — Find any asset by ID
reco-get-assets-user-has-access-to — List files a user has access to
reco-get-sensitive-assets-with-public-link — List publicly exposed sensitive files
reco-get-assets-shared-externally — List files shared outside the organization
reco-get-files-exposed-to-email-address — List files accessible to a specific email
reco-get-files-shared-with-3rd-parties — List files shared with a third-party domain
reco-get-3rd-parties-accessible-to-data-list — List third-party domains with data access
reco-get-private-email-list-with-access — List private emails with file access

SaaS Events & Activity

reco-list-events — List SaaS activity events
reco-list-accounts — List SaaS accounts with risk signals
reco-list-groups — List SaaS groups
reco-list-saas-to-saas — List SaaS-to-SaaS OAuth grants
reco-list-ip-addresses — List observed IP addresses
reco-list-audit-logs — List Reco platform audit logs

AI Governance

reco-list-ai-agents — List detected AI agents

Platform

reco-list-app-instances — List integrated app instances (portfolio)
reco-list-devices — List managed and unmanaged devices
reco-list-business-units — List business units
reco-get-link-to-user-overview-page — Generate a deep link to the Reco UI
reco-add-exclusion-filter — Add a classifier exclusion filter

For more information: www.reco.ai

Reco Overview

Classifiers

Name	Description
Reco Incident Mapper

Incident Types

Name	Description
SaaS Data Leakage

Integrations

Name	Description
Reco (Partner Contribution)	Reco is the leader in SaaS & AI Security, providing full visibility and control across your SaaS ecosystem and AI agents.

Layouts

Name	Description
Reco Finding

Playbooks

Name	Description
Reco - Reduce Risk - Google Publicly Exposed Files	The "Reco - Reduce Risk - Google Publicly Exposed Files" playbook aims to identify and mitigate the risk associated with publicly exposed sensitive files on Google Drive. It follows a sequence of tasks to detect such files, analyze their locations, and remove the "anyone with link" permission to enhance data security.
Reco-Google-Drive-Revoke-Permissions	This workflow enables you to easily list the permissions of files stored in Google Drive, giving you visibility into who has access to your organization's data. If a file's permission is publicly exposed, the workflow restricts access to the file to prevent unauthorized use. Similarly, if a file's permission is set to accessible by all org users and shared with internal users, access to the file is restricted to authorized users only. Using the Google Drive API and built-in conditional logic, this workflow helps you secure sensitive data and streamline your organization's data management.
Reco Build String Message	Build a string message from list of files (file name, link)
Reco Google Drive Automation	Automate Google Drive alert remediation with our solution that revokes over-access permissions and shares file details and links with end-users via Slack. Reco workflow seamlessly integrates with Palo Alto Networks' Demisto platform to resolve the alert and streamline your organization's security operations. By automating remediation, you can ensure that sensitive data is protected and that end-users are promptly notified of any changes to their file access. With our solution, you can close alerts in Demisto and improve your organization's security posture with minimal effort.

Classifiers

Name	Description
Reco Incident Mapper

Incident Types

Name	Description
SaaS Data Leakage

Integrations

Name	Description
Reco (Partner Contribution)	Reco is the leader in SaaS & AI Security, providing full visibility and control across your SaaS ecosystem and AI agents.

Playbooks

Name	Description
Reco Google Drive Automation	Automate Google Drive alert remediation with our solution that revokes over-access permissions and shares file details and links with end-users via Slack. Reco workflow seamlessly integrates with Palo Alto Networks' Demisto platform to resolve the alert and streamline your organization's security operations. By automating remediation, you can ensure that sensitive data is protected and that end-users are promptly notified of any changes to their file access. With our solution, you can close alerts in Demisto and improve your organization's security posture with minimal effort.
Reco-Google-Drive-Revoke-Permissions	This workflow enables you to easily list the permissions of files stored in Google Drive, giving you visibility into who has access to your organization's data. If a file's permission is publicly exposed, the workflow restricts access to the file to prevent unauthorized use. Similarly, if a file's permission is set to accessible by all org users and shared with internal users, access to the file is restricted to authorized users only. Using the Google Drive API and built-in conditional logic, this workflow helps you secure sensitive data and streamline your organization's data management.
Reco - Reduce Risk - Google Publicly Exposed Files	The "Reco - Reduce Risk - Google Publicly Exposed Files" playbook aims to identify and mitigate the risk associated with publicly exposed sensitive files on Google Drive. It follows a sequence of tasks to detect such files, analyze their locations, and remove the "anyone with link" permission to enhance data security.
Reco Build String Message	Build a string message from list of files (file name, link)

Required Content Packs (5)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Google Drive	By: Cortex XSOAR
Slack	By: Cortex XSOAR

Optional Content Packs (2)

Pack Name	Pack By
Common Types	By: Cortex XSOAR
Malware Core	By: Cortex XSOAR

All level dependencies (6)

Pack Name	Pack By
Cortex REST API	By: Cortex XSOAR
Slack	By: Cortex XSOAR
Base	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Google Drive	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR

1.8.0 - 11460840 (July 30, 2026)

Integrations

Reco

Note: The fetch-incidents Risk level parameter now fetches alerts at the given severity and above, instead of an exact match. For example, setting it to MEDIUM now also returns HIGH and CRITICAL alerts.
Updated the alert fetching, identity, app, file, and label commands to use the new Reco External API for cleaner JSON responses and improved reliability. All pre-migration output field names are still populated alongside the new ones for backward compatibility. A few fields have no equivalent in the new External API and are no longer populated: reco-get-user-context-by-email-address Reco.User.groups and Reco.User.labels; reco-get-sensitive-assets-by-id, reco-get-sensitive-assets-by-name, and reco-get-assets-by-id Reco.SensitiveAssets.currently_permitted_users and source; reco-get-apps Reco.Apps.risk_score, status, and updated_at; reco-set-app-authorization-status Reco.AppAuthorization.rows_affected.
Added support for rate-limit handling (automatic 429 retry with exponential backoff) for all External API calls.
Added the following commands, all backed by the External API and accepting SCIM v2 filter expressions: reco-list-events, reco-list-posture-issues, reco-list-accounts, reco-list-devices, reco-list-ai-agents, reco-list-groups, reco-list-saas-to-saas, reco-list-ip-addresses, reco-list-business-units, reco-list-audit-logs, reco-list-posture-checks, reco-list-threat-detection-policies, reco-list-exclusions, and reco-list-app-instances.
Added the full set of valid status values to reco-change-alert-status (previously only 3 of the 12 supported statuses were listed).
Updated the Docker image to: demisto/python3:3.12.13.10404775.

Related pull requests:
- 45270
- 45126

Download

1.7.5 - 7843807 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43568

Download

1.7.4 - 7685745 (March 15, 2026)

Integrations

Reco

Fixed an issue where posture check alerts were incorrectly ingested as incidents. The integration now queries the same filtered alerts view used by the Reco UI, which excludes posture policy alerts.
Updated the Docker image to: demisto/python3:3.12.13.7444307.

Related pull requests:
- 43536
- 43395

Download

1.7.3 - 5636304 (October 29, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41629

Download

1.7.2 - 5591931 (October 27, 2025)

Integrations

Reco

Updated incident processing to only handle alerts, removing the dual incidents + alerts fetching logic.
Cleaned up unused constants and test methods related to incident asset management.
Fixed timeline update functionality to use the correct API endpoint (/share-service/share-comment instead of /incident-timeline).

Related pull requests:
- 41484
- 41649

Download

1.7.1 - R5469292 (October 20, 2025)

Integrations

Reco

Removing get_incident unused methods and constants.
Updated the Docker image to: demisto/python3:3.12.11.4417419.

Related pull requests:
- 40844
- 40778

Download

1.8.0 - 11460840 (July 30, 2026)

Integrations

Reco

Note: The fetch-incidents Risk level parameter now fetches alerts at the given severity and above, instead of an exact match. For example, setting it to MEDIUM now also returns HIGH and CRITICAL alerts.
Updated the alert fetching, identity, app, file, and label commands to use the new Reco External API for cleaner JSON responses and improved reliability. All pre-migration output field names are still populated alongside the new ones for backward compatibility. A few fields have no equivalent in the new External API and are no longer populated: reco-get-user-context-by-email-address Reco.User.groups and Reco.User.labels; reco-get-sensitive-assets-by-id, reco-get-sensitive-assets-by-name, and reco-get-assets-by-id Reco.SensitiveAssets.currently_permitted_users and source; reco-get-apps Reco.Apps.risk_score, status, and updated_at; reco-set-app-authorization-status Reco.AppAuthorization.rows_affected.
Added support for rate-limit handling (automatic 429 retry with exponential backoff) for all External API calls.
Added the following commands, all backed by the External API and accepting SCIM v2 filter expressions: reco-list-events, reco-list-posture-issues, reco-list-accounts, reco-list-devices, reco-list-ai-agents, reco-list-groups, reco-list-saas-to-saas, reco-list-ip-addresses, reco-list-business-units, reco-list-audit-logs, reco-list-posture-checks, reco-list-threat-detection-policies, reco-list-exclusions, and reco-list-app-instances.
Added the full set of valid status values to reco-change-alert-status (previously only 3 of the 12 supported statuses were listed).
Updated the Docker image to: demisto/python3:3.12.13.10404775.

Related pull requests:
- 45270
- 45126

Download

1.7.5 - 7850318 (March 23, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43568

Download

1.7.4 - 7685745 (March 15, 2026)

Integrations

Reco

Fixed an issue where posture check alerts were incorrectly ingested as incidents. The integration now queries the same filtered alerts view used by the Reco UI, which excludes posture policy alerts.
Updated the Docker image to: demisto/python3:3.12.13.7444307.

Related pull requests:
- 43536
- 43395

Download

1.7.3 - 5636304 (October 29, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41629

Download

1.7.2 - 5591931 (October 27, 2025)

Integrations

Reco

Updated incident processing to only handle alerts, removing the dual incidents + alerts fetching logic.
Cleaned up unused constants and test methods related to incident asset management.
Fixed timeline update functionality to use the correct API endpoint (/share-service/share-comment instead of /incident-timeline).

Related pull requests:
- 41484
- 41649

Download

1.7.1 - R5469292 (October 20, 2025)

Integrations

Reco

Removing get_incident unused methods and constants.
Updated the Docker image to: demisto/python3:3.12.11.4417419.

Related pull requests:
- 40844
- 40778

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	February 14, 2023
Last Release	July 30, 2026

Asset Management

Identity And Access Management

Breach Notification

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.