Vega | Marketplace

Details
Content
Dependencies
Version History

The Vega integration allows you to ingest alerts and incidents from the Vega platform into Cortex XSOAR.

This pack provides an end-to-end integration with the Vega security platform, allowing analysts to fetch, map, and mirror Vega alerts and incidents directly in Cortex XSOAR.

Real-Life Context

Security Operations Centers (SOCs) often need to track alerts and incidents originating from the Vega platform. Manually syncing comments, statuses, and events between Vega and Cortex XSOAR can be tedious and prone to human error. This pack automates the bidirectional syncing of Vega incidents and alerts into Cortex XSOAR, streamlining the incident response lifecycle.

What does this pack do?

Ingest Vega Alerts and Incidents: Automatically fetch and map alerts and incidents from Vega into Cortex XSOAR.
Bidirectional Mirroring: Sync comments, verdict reasoning, and status updates between Vega and XSOAR in real-time.
Update Alerts and Incidents: Provides commands like vega-update-alert and vega-update-incident to update Vega records from XSOAR playbooks.
Fetch Alert Events: Retrieve rich contextual alert events directly into the XSOAR layout for deep analysis.
Custom Layouts: Includes customized layouts for Vega Alerts and Incidents, providing a tailored view of all critical fields, including MITRE ATT&CK techniques, Verdicts, and Recommended Actions.

This pack provides an end-to-end integration with the Vega security platform, allowing analysts to fetch, map, and mirror Vega alerts and incidents directly in Cortex.

Real-Life Context

Security Operations Centers (SOCs) often need to track alerts and incidents originating from the Vega platform. Manually syncing comments, statuses, and events between Vega and Cortex can be tedious and prone to human error. This pack automates the bidirectional syncing of Vega incidents and alerts into Cortex, streamlining the incident response lifecycle.

What does this pack do?

Ingest Vega Alerts and Incidents: Automatically fetch and map alerts and incidents from Vega into Cortex.
Bidirectional Mirroring: Sync comments, verdict reasoning, and status updates between Vega and XSOAR in real-time.
Update Alerts and Incidents: Provides commands like vega-update-alert and vega-update-incident to update Vega records from XSOAR playbooks.
Fetch Alert Events: Retrieve rich contextual alert events directly into the XSOAR layout for deep analysis.
Custom Layouts: Includes customized layouts for Vega Alerts and Incidents, providing a tailored view of all critical fields, including MITRE ATT&CK techniques, Verdicts, and Recommended Actions.

Classifiers

Name	Description
Vega Classifier	Classifies incoming Vega alerts and incidents by their entity type.
Vega Mapper	Maps incoming Vega alert and incident data to XSOAR incident fields.
Vega Outgoing Mapper	Maps outgoing Cortex XSOAR investigation changes to Vega alert and incident updates.

Incident Fields

Name	Description
Vega Incident Status	The current status of a Vega incident.
Vega Status	The current status of a Vega alert.
Vega Alert ID	The unique identifier of the Vega alert.
Vega Alert Link	Direct URL link to this alert in the Vega platform.
Vega Alerts Count	The number of Vega alerts grouped under this incident.
Vega Detection Query	The raw query used by the detection rule to identify this alert.
Vega New Comment	Comment to mirror from Cortex XSOAR to Vega.
Vega Is Test Mode	Indicates whether this alert was generated in test/simulation mode.
Vega Alert Events	Aggregated alert events for a Vega alert, rendered as a markdown table.
Vega Verdict Reasoning	The analyst's written reasoning behind the verdict.
Vega Alerts	Alerts associated with this Vega incident.
Vega Incident Summary	AI-generated or analyst-written summary of the incident investigation.
Vega Detection ID	The unique identifier of the underlying detection rule that triggered this alert.
Vega MITRE Techniques	MITRE ATT&CK techniques associated with this alert (e.g. Cloud Infrastructure Discovery).
Vega Created By	The user ID of the person who created this incident in Vega.
Vega Incident Findings	Detailed investigation findings for the Vega incident, one finding per entry.
Vega Observables	Observable indicators (IP addresses, domains, hashes) associated with this incident.
Vega Created At	The timestamp when this Vega alert or incident was created.
Vega Assignee	The display name of the user assigned to this alert or incident in Vega.
Vega Alert Events Loaded For	Vega alert ID that the cached alert events table was fetched for.
Vega Alert Events Offset	Pagination offset for the cached Vega alert events table.
Vega Comments	Analyst comments on this Vega alert or incident.
Vega Detection Source	The source of the detection rule (e.g. custom, builtin).
Vega Assignee Email	The email address of the user assigned to this alert or incident in Vega.
Vega Data Sources	The data sources from which the Vega alert or incident was generated (e.g. CloudTrail, VPC Flow Logs).
Vega Timeline Events	Chronological investigation timeline for a Vega incident, including alerts, data sources, and entities.
Vega Assets	Assets (IPs, instance IDs, IAM roles) involved in this incident.
Vega Alert Events Total	Total number of aggregated alert events reported by Vega for this alert.
Vega Event Count	The number of raw events that contributed to triggering this alert.
Vega Alert Severity	The severity assigned to the Vega alert.
Vega Severity	The severity assigned to the Vega incident.
Vega MITRE ATT&CK	MITRE ATT&CK tactics and techniques associated with this Vega alert.
Vega Detection Description	Human-readable description of what the detection rule looks for.
Vega Last Updated	The timestamp of the last update to this incident in Vega (e.g. 2023-10-25T14:30:00Z).
Vega MITRE Tactics	MITRE ATT&CK tactics associated with this alert (e.g. Discovery, Lateral Movement).
Vega Verdict	The verdict assigned to the Vega alert or incident.
Vega Incident ID	The unique identifier of the Vega incident.
Vega Incident Link	Direct URL link to this incident in the Vega platform.
Vega Related Incidents	List of Vega incidents that this alert is related to.

Incident Types

Name	Description
Vega Alert
Vega Incident

Integrations

Name	Description
Vega (Partner Contribution)	Vega integration for fetching alerts and incidents from the Vega platform.

Layouts

Name	Description
Vega Incident
Vega Alert

Playbooks

Name	Description
Vega Incident - External IP Enrichment - Generic	Enriches incoming IP addresses using the 'IP Enrichment - External - Generic v2' sub-playbook and automatically posts the retrieved endpoint details back to the Vega incident as a comment.

Classifiers

Name	Description
Vega Classifier	Classifies incoming Vega alerts and incidents by their entity type.
Vega Outgoing Mapper	Maps outgoing Cortex investigation changes to Vega alert and incident updates.
Vega Mapper	Maps incoming Vega alert and incident data to XSOAR incident fields.

Incident Fields

Name	Description
Vega Detection Query	The raw query used by the detection rule to identify this alert.
Vega Incident Summary	AI-generated or analyst-written summary of the incident investigation.
Vega Comments	Analyst comments on this Vega alert or incident.
Vega Related Incidents	List of Vega incidents that this alert is related to.
Vega Alert Events	Aggregated alert events for a Vega alert, rendered as a markdown table.
Vega Incident Findings	Detailed investigation findings for the Vega incident, one finding per entry.
Vega Assignee Email	The email address of the user assigned to this alert or incident in Vega.
Vega Created At	The timestamp when this Vega alert or incident was created.
Vega Detection Description	Human-readable description of what the detection rule looks for.
Vega Alert Events Total	Total number of aggregated alert events reported by Vega for this alert.
Vega Alert ID	The unique identifier of the Vega alert.
Vega Alert Severity	The severity assigned to the Vega alert.
Vega Verdict Reasoning	The analyst's written reasoning behind the verdict.
Vega Incident Link	Direct URL link to this incident in the Vega platform.
Vega Timeline Events	Chronological investigation timeline for a Vega incident, including alerts, data sources, and entities.
Vega Severity	The severity assigned to the Vega incident.
Vega MITRE Tactics	MITRE ATT&CK tactics associated with this alert (e.g. Discovery, Lateral Movement).
Vega Status	The current status of a Vega alert.
Vega MITRE ATT&CK	MITRE ATT&CK tactics and techniques associated with this Vega alert.
Vega Verdict	The verdict assigned to the Vega alert or incident.
Vega Alert Link	Direct URL link to this alert in the Vega platform.
Vega Detection ID	The unique identifier of the underlying detection rule that triggered this alert.
Vega Alert Events Offset	Pagination offset for the cached Vega alert events table.
Vega Assets	Assets (IPs, instance IDs, IAM roles) involved in this incident.
Vega Is Test Mode	Indicates whether this alert was generated in test/simulation mode.
Vega MITRE Techniques	MITRE ATT&CK techniques associated with this alert (e.g. Cloud Infrastructure Discovery).
Vega Assignee	The display name of the user assigned to this alert or incident in Vega.
Vega Alerts	Alerts associated with this Vega incident.
Vega Incident ID	The unique identifier of the Vega incident.
Vega Alert Events Loaded For	Vega alert ID that the cached alert events table was fetched for.
Vega Data Sources	The data sources from which the Vega alert or incident was generated (e.g. CloudTrail, VPC Flow Logs).
Vega Incident Status	The current status of a Vega incident.
Vega Created By	The user ID of the person who created this incident in Vega.
Vega Alerts Count	The number of Vega alerts grouped under this incident.
Vega Last Updated	The timestamp of the last update to this incident in Vega (e.g. 2023-10-25T14:30:00Z).
Vega Observables	Observable indicators (IP addresses, domains, hashes) associated with this incident.
Vega Detection Source	The source of the detection rule (e.g. custom, builtin).
Vega New Comment	Comment to mirror from Cortex to Vega.
Vega Event Count	The number of raw events that contributed to triggering this alert.

Incident Types

Name	Description
Vega Incident
Vega Alert

Integrations

Name	Description
Vega (Partner Contribution)	Vega integration for fetching alerts and incidents from the Vega platform.

Layouts

Name	Description
Vega Incident
Vega Alert

Playbooks

Name	Description
Vega Alert - External IP Enrichment - Generic	Enriches incoming IP addresses using the 'IP Enrichment - External - Generic v2' sub-playbook and automatically posts the retrieved endpoint details back to the Vega alert as a comment.

Required Content Packs (4)

Pack Name	Pack By
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR
Common Scripts	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR

Optional Content Packs (1)

Pack Name	Pack By
Common Types	By: Cortex XSOAR

All level dependencies (6)

Pack Name	Pack By
Common Scripts	By: Cortex XSOAR
Rasterize	By: Cortex XSOAR
Filters And Transformers	By: Cortex XSOAR
Cortex REST API	By: Cortex XSOAR
Base	By: Cortex XSOAR
Common Playbooks	By: Cortex XSOAR

PUBLISHER

PLATFORMS

Cortex XSOARCortex XSIAM

INFO

Certification	Certified	Read more
Supported By	Partner
Created	July 27, 2026
Last Release	July 27, 2026

Hunting

Incident Response

Vulnerability Management

WORKS WITH THE FOLLOWING INTEGRATIONS:

DISCLAIMER

By downloading or using Marketplace content, you agree to the applicable Terms of Use and End User License Agreement. Third-party content is provided by its publisher, and Palo Alto Networks does not warrant, endorse, support, or assume responsibility for content not expressly identified as owned by Palo Alto Networks.