Skip to main content

Palo Alto Cortex XSOAR integration

Mark Glinski
  • Updated

In this article:

    Palo Alto Cortex XSOAR integration is available with a paid SecurityScorecard plan. See our plans page for more information about levels of features and access. You must also have a paid Cortex XSOAR account.

    Integrate SecurityScorecard with XSOAR (Security Orchestration, Automation, and Response) to receive incidents and build Playbooks based on SecurityScorecard data.

    If you use XSOAR, this integration is useful for monitoring and addressing security-related alerts. If you are a SecurityScorecard user, this integration enables you to put essential Scorecard data closer to your security infrastructure.

    Set up the integration

    Create a bot user with an API token

    Note: If you do not have administrative permissions in SecurityScorecard, ask an administrator to create the user and API token for you.
    1. In SecurityScorecard, click your profile avatar and select My Settings.

      snow-my-settings.png

    2. On the Users tab under Admin Settings, click Add User.

      snow-ssc-create-user.png

    3. Make the new user a bot so that it will not expire. This prevents a scenario where human users attempt to refresh an expired API token, causing the integration to stop working. 

      snow-ssc-add-user-select-bot.png

    4. Click Add.
    5. Name the bot user and make sure it has read-only access. Then click Add.

      snow-ssc-add-user-details.png

    6. Click Create token for the new bot user.

      snow-ssc-new-user.png

    7. Copy the API token and click Done.

      snow-ssc-token-new.png

    Install the integration components

    1. In Cortex XSOAR, select Marketplace in the left pane.

      xsoar-marketplace.png

    2. On the Marketplace page, select SecurityScorecard.
    3. On the SecurityScorcard page click Install in the top-right corner.
    4. When XSOAR adds the integration to the installation cart, click Install in the bottom-right corner.

    Installation completes in a few seconds.

    Configure the integration

    1. Select Settings in the left pane.
    2. In the Settings page, select Integrations, and then Servers & Services.

      xsoar-servers-services.png

    3. Click the gear icon for SecurityScorecard (Partner Contribution).
    4. From the popup window, select or enter your configuration  choices:
      • Name - Provide a unique name for the integration connection.
      • Fetches incidents - Set to true to ensure SecurityScorecard alerts generate incidents in XSOAR.
      • API Base URL - Provide your API URL, typically https://api.securityscorecard.io/.
      • Username/Email - Provide the email address of the user for which the API token was generated in SecurityScorecard. If you created a bot user, enter the bot user ID from your SecurityScorecard settings.

        xsoar-ssc-users.png
      • Incidents Fetch Interval - Set to one day, since SecurityScorecard provides new data each day.
      • Fetch Limit - Set the batch size for responses from SecurityScorecard. For more than 50 results the integration makes multiple requests.
      • First Fetch - Select how many preceding days worth of data to include in the initial fetch.

        xsoar-config-choices.png
    1. Click Test to verify your connection settings.
      A success message appears.
    2. Click Save and Exit.

    Get started using the integration

    Shortly after you set up and successfully test integration, Cortex XSOAR starts syncing with SecurityScorecard to fetch and display data.

    Select Incidents in the left pane.

    xsoar-incidents.png

    Note that score changes trigger the creation of incidents to investigate.

    Create Playbooks

    While this integration does not currently include Playbooks, you can create Playbooks based on data coming back from SecurityScorecard. 

    Select Playbooks in the left pane, and then select New Playbook.

    xsoar-new-playbook.png

    See various commands available with the SecurityScorecard integration, including:

    • securityscorecard-alert-delete
    • securityscorecard-alert-grade-change-create
    • securityscorecard-alert-score-threshold-create
    • securityscorecard-alerts-list
    • securityscorecard-company-factor-score-get
    • securityscorecard-company-history-factor-score-get
    • securityscorecard-company-history-score-get
    • securityscorecard-company-score-get
    • securityscorecard-company-services-get
    • securityscorecard-portfolio-list-companies
    • securityscorecard-portfolios-list

      xsoar-playbook-commands.png

    Learn about these endpoints.

    Use the Playbook editor to build workflows based on your needs.

    Learn more

    Get Help

    If you need help or have questions about the integration, contact the Palo Alto Support team.



    Related articles