Palo Alto Networks Cortex XSOAR API

Indicator Enrichment and Threat Intelligence

Enrich security incidents with indicators of compromise (IOCs) by creating or updating indicators via the API. Indicators include IP addresses, domains, URLs, file hashes, and email addresses with reputation scores, threat actor associations, and expiration dates. This supports automated threat intel ingestion from STIX/TAXII feeds, VirusTotal, or custom sources, centralizing IOC data for playbook-driven enrichment.

Playbook Execution and Orchestration

Trigger playbook execution on incidents programmatically to automate investigation and remediation workflows. Playbooks define sequences of actions like enriching IOCs, querying EDR, isolating endpoints, notifying stakeholders, and closing incidents. The API supports starting playbooks, querying their status, and retrieving outputs, enabling external systems to orchestrate XSOAR workflows in response to real-time threats.

War Room Collaboration and Evidence Tracking

Manage war rooms for collaborative incident investigation by adding notes, evidence, and attachments via the API. War rooms aggregate timeline data, analyst comments, IOC lookups, and external tool outputs. POST /entry creates war room entries with markdown-formatted notes, file attachments, or structured evidence like EDR query results. This supports multi-analyst investigations and audit-ready incident documentation.

AI Agent for SOC Automation

Let an AI agent handle SOC workflows like creating incidents from alerts, enriching IOCs, executing playbooks, adding analysis notes, and closing incidents with resolution summaries. Through Jentic, the agent searches by intent (e.g., 'create xsoar incident'), loads the schema, and executes with the API key injected securely, enabling conversational security orchestration.