PANW Cortex XDR - Run Script

PANW Cortex XDR - Run Script runs scripts on assets returned by the selected query or assets selected on the relevant asset page. This enables Axonius to automate security response and remotely manage endpoints

Required Fields

These fields must be configured to run the Enforcement Action.

• Use stored credentials from the Palo Alto Networks Cortex XDR adapter - Select this option to use credentials from the adapter connection. By default, the first connection is selected.

  • When you select this option, the Select Adapter Connection drop-down becomes available. Select the adapter connection to use for this Enforcement Action.

📘

Note

To use this option, you must successfully configure a Palo Alto Networks Cortex XDR adapter connection.

• Script ID - The ID of the script you want to run.

• Compute Node - The Axonius node to use when connecting to the specified host. For more details, see Working with Axonius Compute Nodes.

Additional Fields

These fields are optional.

💡

Connection and Credentials

When Use stored credentials from the adapter is toggled off, some of the connection fields below are required to create the connection, while other fields are optional.

• Cortex XDR Domain - The hostname of the Palo Alto Networks Cortex XDR API server. Example: api-CUSTOMER.xdr.us.paloaltonetworks.com

• URL Base Path - Specify the fully qualified domain name (FQDN). For more details, see Get Started with Cortex XDR APIs.

• API Key ID and API Key - Specify the API key and the API key ID of an Advanced Security Level API, as generated in Cortex XDR app. A standard API key will not work — this integration requires an Advanced Security level API key. For more details on generating an Advanced Security Level API, see Get Started with Cortex XDR APIs.

• Verify SSL (optional) - Select whether to verify the SSL certificate of the server against the CA database inside of Axonius. For more details, see SSL Trust & CA Settings.

• HTTPS Proxy (optional) - Connect the adapter to a proxy instead of directly connecting it to the domain.

• Additional fields (json format) - Specify additional fields to be added as part of the script as key/value pairs in a JSON format. For example:

{"field1": "value1", "field2": "value2"}

• Gateway Name - Select the Gateway through which to connect to perform the action.

APIs

Axonius uses the Cortex XDR API.

Required Permissions