Details
Content
Dependencies
Version History

Reco is an identity-first SaaS security solution that empowers organizations with full visibility into every app, identity, and their actions to seamlessly prioritize and control risks in the SaaS ecosystem

Reco

Reco is an identity-first SaaS security solution.
It empowers organizations with full visibility into every app, identity, and their actions to seamlessly prioritize and control risks in the SaaS ecosystem. Their AI-based graph technology connects in minutes and provides immediate value to security teams to continuously discover all SaaS applications including sanctioned and unsanctioned apps, associated identities from both humans and machines, their permission level, and actions. Reco uses advanced analytics around persona, actions, interactions and relationships to other users, and then alerts on exposure from misconfigurations, over-permission users, compromised accounts, and risky user behavior. This comprehensive picture is generated continuously using the Reco Identities Interaction Graph and empowers security teams to take swift action to effectively prioritize their most critical points of risk.
Reco helps organizations secure the identities and data of core SaaS applications including Salesforce, Microsoft 365 (including SharePoint, Teams, and OneDrive), Google Workspace, Workday, ServiceNow, Slack, Zoom, Okta, Monday.com, NetApp, Wiz, GitLab, Confluence, and Box.
The Reco and Palo Alto Networks Cortex XSOAR integration empower organizations to automate SaaS threat detection and remediation workflows for enhanced protection. Reco integrates with over 985 Cortex XSOAR content packs, the market’s leading SOAR platform.

What does this pack do?

• Assess over 100 configuration rules unified across SaaS applications.
• Access Reco data risk alerts
• Trigger automatic remediation flows to discover SaaS misconfigurations
• Seamlessly integrate alerts into Cortex XSOAR's incident management system
• Leverage prebuilt playbooks within Cortex XSOAR to automate the entire process of identifying and remediating SaaS misconfigurations and data exposure risks

Benefits to organizations:

• Gain better visibility into potential SaaS misconfigurations and take proactive measures to mitigate them
• Streamline threat detection, automate remediation workflows, and fortify your organization's security posture.
• Investigate and respond to critical alerts promptly and effectively
• Reduce manual effort, accelerating incident response, and improving overall security posture
• Enforce user-data centric security policies and embrace new SaaS applications at a faster rate
• Adhere to compliance requirements

Integrations

Supported commands to query Reco platform:
update-reco-incident-timeline - Update Reco incident timeline
resolve-visibility-event - Resolve Reco visibility event
reco-get-risky-users - Get risky users
reco-add-risky-user-label - Add risky user
reco-get-assets-user-has-access-to - Get assets user has access to (optional to get only sensitive assets)
reco-add-leaving-org-user-label - Add leaving org user label in Reco
reco-get-sensitive-assets-by-name - Get sensitive assets by name (optional to search by regex)
reco-get-sensitive-assets-by-id - Get sensitive assets by file id
reco-get-files-shared-with-3rd-parties - Get 3rd parties list with access to files
reco-get-3rd-parties-accessible-to-data-list - Get files shared with 3rd parties
reco-get-sensitive-assets-with-public-link - Get sensitive assets publicly exposed
reco-get-user-context-by-email-address - Get user context by email address
reco-get-private-email-list-with-access - Get private email list with access

For more information on Reco, please visit www.reco.ai

Reco

What does this pack do?

Benefits to organizations:

Integrations

Supported commands to query Reco platform:
update-reco-incident-timeline - Update Reco incident timeline
resolve-visibility-event - Resolve Reco visibility event
reco-get-risky-users - Get risky users
reco-add-risky-user-label - Add risky user
reco-get-assets-user-has-access-to - Get assets user has access to (optional to get only sensitive assets)
reco-add-leaving-org-user-label - Add leaving org user label in Reco
reco-get-sensitive-assets-by-name - Get sensitive assets by name (optional to search by regex)
reco-get-sensitive-assets-by-id - Get sensitive assets by file id
reco-get-files-shared-with-3rd-parties - Get 3rd parties list with access to files
reco-get-3rd-parties-accessible-to-data-list - Get files shared with 3rd parties
reco-get-sensitive-assets-with-public-link - Get sensitive assets publicly exposed
reco-get-user-context-by-email-address - Get user context by email address
reco-get-private-email-list-with-access - Get private email list with access

For more information on Reco, please visit www.reco.ai

Incident Types

Name	Description
SaaS Data Leakage

Integrations

Name	Description
Reco (Partner Contribution)	Reco is a Saas data security solution that protects your data from accidental leaks and malicious attacks.

Layouts

Name	Description
Reco Finding

Playbooks

Name	Description
Reco Build String Message	Build a string message from list of files (file name, link)
Reco Google Drive Automation	Automate Google Drive alert remediation with our solution that revokes over-access permissions and shares file details and links with end-users via Slack. Reco workflow seamlessly integrates with Palo Alto Networks' Demisto platform to resolve the alert and streamline your organization's security operations. By automating remediation, you can ensure that sensitive data is protected and that end-users are promptly notified of any changes to their file access. With our solution, you can close alerts in Demisto and improve your organization's security posture with minimal effort.
Reco-Google-Drive-Revoke-Permissions	This workflow enables you to easily list the permissions of files stored in Google Drive, giving you visibility into who has access to your organization's data. If a file's permission is publicly exposed, the workflow restricts access to the file to prevent unauthorized use. Similarly, if a file's permission is set to accessible by all org users and shared with internal users, access to the file is restricted to authorized users only. Using the Google Drive API and built-in conditional logic, this workflow helps you secure sensitive data and streamline your organization's data management.
Reco - Reduce Risk - Google Publicly Exposed Files	The "Reco - Reduce Risk - Google Publicly Exposed Files" playbook aims to identify and mitigate the risk associated with publicly exposed sensitive files on Google Drive. It follows a sequence of tasks to detect such files, analyze their locations, and remove the "anyone with link" permission to enhance data security.

Incident Types

Name	Description
SaaS Data Leakage

Integrations

Name	Description
Reco (Partner Contribution)	Reco is a Saas data security solution that protects your data from accidental leaks and malicious attacks.

Playbooks

Name	Description
Reco Build String Message	Build a string message from list of files (file name, link)
Reco - Reduce Risk - Google Publicly Exposed Files	The "Reco - Reduce Risk - Google Publicly Exposed Files" playbook aims to identify and mitigate the risk associated with publicly exposed sensitive files on Google Drive. It follows a sequence of tasks to detect such files, analyze their locations, and remove the "anyone with link" permission to enhance data security.
Reco-Google-Drive-Revoke-Permissions	This workflow enables you to easily list the permissions of files stored in Google Drive, giving you visibility into who has access to your organization's data. If a file's permission is publicly exposed, the workflow restricts access to the file to prevent unauthorized use. Similarly, if a file's permission is set to accessible by all org users and shared with internal users, access to the file is restricted to authorized users only. Using the Google Drive API and built-in conditional logic, this workflow helps you secure sensitive data and streamline your organization's data management.
Reco Google Drive Automation	Automate Google Drive alert remediation with our solution that revokes over-access permissions and shares file details and links with end-users via Slack. Reco workflow seamlessly integrates with Palo Alto Networks' Demisto platform to resolve the alert and streamline your organization's security operations. By automating remediation, you can ensure that sensitive data is protected and that end-users are promptly notified of any changes to their file access. With our solution, you can close alerts in Demisto and improve your organization's security posture with minimal effort.

Required Content Packs (5)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Google Drive	By: Cortex XSOAR
Slack	By: Cortex XSOAR

Optional Content Packs (2)

Pack Name	Pack By
Common Types	By: Cortex XSOAR
Malware Core	By: Cortex XSOAR

All level dependencies (6)

Pack Name	Pack By
Google Drive	By: Cortex XSOAR
Base	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Slack	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	February 14, 2023
Last Release	December 5, 2024

Asset Management

Identity And Access Management

Breach Notification

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

Content packs are licensed by the Publisher identified above and subject to the Publisher’s own licensing terms. Palo Alto Networks is not liable for and does not warrant or support any content pack produced by a third-party Publisher, whether or not such packs are designated as “Palo Alto Networks-certified” or otherwise. For more information, see the Marketplace documentation.