Varonis SaaS

Details
Content
Dependencies
Version History

Download With Dependencies

Streamline alerts, events and related forensic information from Varonis SaaS

This pack enables you to streamline alerts and related forensic information from Varonis SaaS.

What does this pack do?

Enables retrieving alerts and manage alert status.
Enables retrieving information related to alerts for investigation and threat hunting.

This pack enables you to streamline alerts and related forensic information from Varonis SaaS.

What does this pack do?

Enables retrieving alerts and manage alert status.
Enables retrieving information related to alerts for investigation and threat hunting.

Automations

Name	Description
varonis-alert-post-processing	Varonis alert post processing script to set the alert status to closed when an incident is closed.

Classifiers

Name	Description
Varonis SaaS Incident - Outgoing Mapper
Varonis SaaS Incident - Incoming Mapper

Incident Fields

Name	Description
Varonis SaaS Users
Varonis SaaS Close Reason
Varonis SaaS Sources
Varonis SaaS Alert Status
Varonis SaaS Contains Flagged Data
Varonis SaaS Number of Events
Varonis SaaS Locations
Varonis SaaS Contains Malicious External IP
Varonis SaaS Contains Sensitive Data
Varonis SaaS Devices

Incident Types

Name	Description
Varonis SaaS Incident

Integrations

Name	Description
Varonis SaaS (Partner Contribution)	Streamline alerts and related forensic information from Varonis SaaS.

Layouts

Name	Description
Varonis SaaS Incident

Automations

Name	Description
varonis-alert-post-processing	Varonis alert post processing script to set the alert status to closed when an incident is closed.

Classifiers

Name	Description
Varonis SaaS Incident - Incoming Mapper
Varonis SaaS Incident - Outgoing Mapper

Incident Fields

Name	Description
Varonis SaaS Users
Varonis SaaS Number of Events
Varonis SaaS Locations
Varonis SaaS Contains Malicious External IP
Varonis SaaS Contains Flagged Data
Varonis SaaS Close Reason
Varonis SaaS Devices
Varonis SaaS Alert Status
Varonis SaaS Contains Sensitive Data
Varonis SaaS Sources

Incident Types

Name	Description
Varonis SaaS Incident

Integrations

Name	Description
Varonis SaaS (Partner Contribution)	Streamline alerts and related forensic information from Varonis SaaS.

Required Content Packs (2)

Pack Name	Pack By
Base	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (1)

Pack Name	Pack By
Common Types	By: Cortex XSOAR

All level dependencies (3)

Pack Name	Pack By
Aggregated Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Base	By: Cortex XSOAR

1.0.19 - 9264184 (May 25, 2026)

Integrations

Documentation and metadata improvements.

Related pull requests:
- 44363
- 44358
- 42667
- 43952
- 43732
- 44181
- 44008
- 44052
- 44349
- 44357
- 44339
- 44344
- 43700

Download

1.0.18 - 7839944 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43569

Download

1.0.17 - 7657193 (March 13, 2026)

Integrations

Varonis SaaS

Fixed missing Content-Type header in authentication requests.

Related pull requests:
- 43501
- 43506

Download

1.0.16 - 6491123 (December 30, 2025)

Integrations

Varonis SaaS

Added support for Informational alert severity when fetching and filtering alerts.
Updated the Docker image to: demisto/python3:3.12.12.6391686.

Scripts

varonis-alert-post-processing

Updated the Docker image to: demisto/python3:3.12.12.6391686.

Related pull requests:
- 42036
- 42465

Download

1.0.15 - 5636304 (October 29, 2025)

Changes are not relevant for XSOAR marketplace.

Related pull requests:
- 41629

Download

1.0.14 - R5469292 (October 20, 2025)

Integrations

Varonis SaaS

Updated the VaronisSaaS integration to limit the fetching of alerts to the last 7 days.

Related pull requests:
- 40850
- 40988

Download

1.0.13 - 3944251 (June 23, 2025)

Incident Fields

Varonis SaaS Alert Status
Removed usage of unsupported action required and auto-resolved Alert Statuses.

Integrations

Varonis SaaS

Removed the unsupported action required and auto-resolved alert status options when fetching alerts.
Updated the Docker image to: demisto/python3:3.12.8.3720084.

Scripts

varonis-alert-post-processing

Updated the Docker image to: demisto/python3:3.12.8.3720084.

Related pull requests:
- 40305
- 40338

Download

1.0.19 - 9264184 (May 25, 2026)

Integrations

Varonis SaaS

Documentation and metadata improvements.

Related pull requests:
- 44363
- 44358
- 42667
- 43952
- 43732
- 44181
- 44008
- 44052
- 44349
- 44357
- 44339
- 44344
- 43700

Download

1.0.18 - 7839944 (March 22, 2026)

Documentation and metadata improvements.

Related pull requests:
- 43569

Download

1.0.17 - 7657193 (March 13, 2026)

Integrations

Varonis SaaS

Fixed missing Content-Type header in authentication requests.

Related pull requests:
- 43501
- 43506

Download

1.0.16 - 6491123 (December 30, 2025)

Integrations

Varonis SaaS

Added support for Informational alert severity when fetching and filtering alerts.
Updated the Docker image to: demisto/python3:3.12.12.6391686.

Scripts

varonis-alert-post-processing

Updated the Docker image to: demisto/python3:3.12.12.6391686.

Related pull requests:
- 42036
- 42465

Download

1.0.15 - 5636304 (October 29, 2025)

Changes are not relevant for XSIAM marketplace.

Related pull requests:
- 41629

Download

1.0.14 - R5469292 (October 20, 2025)

Integrations

Varonis SaaS

Updated the VaronisSaaS integration to limit the fetching of alerts to the last 7 days.

Related pull requests:
- 40850
- 40988

Download

1.0.13 - 3944251 (June 23, 2025)

Incident Fields

Varonis SaaS Alert Status
Removed usage of unsupported action required and auto-resolved Alert Statuses.

Integrations

Varonis SaaS

Removed the unsupported action required and auto-resolved alert status options when fetching alerts.
Updated the Docker image to: demisto/python3:3.12.8.3720084.

Scripts

varonis-alert-post-processing

Updated the Docker image to: demisto/python3:3.12.8.3720084.

Related pull requests:
- 40305
- 40338

Download

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	January 23, 2024
Last Release	May 25, 2026

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.