Cortex Xpanse

External Attack Surface Management

Overview

The Cortex Xpanse Connector fetches and synchronizes external attack surface management (ASM) data from Palo Alto Networks Cortex Xpanse. It connects to the Cortex Xpanse public API and maps internet-exposure assets (hosts, certificates, sites/domains, cloud resources, services, IP ranges) along with alerts, incidents, and their attack-surface-rule definitions to the Brinqa Data Model. Results are paged using the Xpanse search_from / search_to window combined with next_page_token cursors.

Data retrieved from Cortex Xpanse Connector

Connector Object	Required	Maps to Data Model
Host	Yes	Host
Certificate	Yes	Certificate
Site	Yes	Site
Cloud Resource	Yes	Cloud Resource
Service	Yes	Service
IP Range	Yes	IPRange
Alert	Yes	Alert
Alert Definition	Yes	Alert Definition
Incident	Yes	Incident
Incident Definition	Yes	Incident Definition

Model relationships

note

For detailed steps on how to view the data retrieved from Cortex Xpanse Connector in the Brinqa Platform, see How to view your data.

note

Site records carry the Certificate asset category. The Site model resolves its asset category to Certificate, so synchronized Site objects appear under that category rather than a domain-specific one.

Setup

Connection settings

When setting up a data integration, select Cortex Xpanse Connector from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	Yes	—	Cortex Xpanse API URL
API key ID	No	—	The Cortex Xpanse api account api key ID.
Api key	Yes	—	The Cortex Xpanse api account api key.
Page size	No	100	Maximum number of records to get per API request

Authentication

Cortex Xpanse uses API Key authentication. The connector authenticates every request with two HTTP headers: a Standard API key in the Authorization header and the matching API key ID in the x-xdr-auth-id header. There is no separate token-exchange step — the credentials are sent directly on each call.

Request Headers

Header	Value
Authorization	The Cortex Xpanse API key (clear text)
x-xdr-auth-id	The Cortex Xpanse API key ID
Accept	application/json
Content-Type	application/json

Connectivity Test Endpoint

Method	URL
POST	/public_api/v1/assets/get_assets_internet_exposure/

Request Body

{
  "request_data": {
    "filters": [],
    "sort": null,
    "search_from": 0,
    "search_to": 1
  }
}

Sample Response

{
  "reply": {
    "total_count": 1,
    "result_count": 1,
    "assets_internet_exposure": [
      {
        "asm_ids": [
          "3c2c4e5e-..."
        ],
        "name": "example.com",
        "asset_type": "DOMAIN",
        "first_observed": 1690000000000,
        "last_observed": 1700000000000
      }
    ],
    "next_page_token": "eyJ..."
  }
}

Response Fields

Field	Description
reply.total_count	Total number of records matching the request filters
reply.result_count	Number of records returned in this page
reply.<data array>	Page of resource objects (varies by endpoint)
reply.next_page_token	Opaque cursor used to request the next page

A non-2xx status causes the connector to surface the platform error message from the response body. On a successful test the connector confirms reachability and credential validity.

Sync Behavior

The connector uses a mix of incremental (delta) and full syncs, depending on the model:

• Incremental — Alert filters server-side on creation_time >= since, and Incident filters on modification_time >= since, both using the sync token in epoch milliseconds.
• Full sync — the asset models (Host, Certificate, Site, Cloud Resource, Service, IP Range) and the attack-surface-rule models (Alert Definition, Incident Definition) apply no date filter, so every run re-fetches the complete result set.

Because behavior is mixed, each model below carries its own #### Sync Duration Parameter marker, which is authoritative for that model.

How to obtain Cortex Xpanse Connector credentials

Obtain the required credentials (url, apiKeyID, apiKey) from your Cortex Xpanse Connector administrator or the Cortex Xpanse Connector admin console, then enter them in the connection settings above.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Host

Source Field Name	SDM Attribute
AssetResource.agentId	AGENT_ID
AssetResource.annotation	ANNOTATION
AssetResource.asmIds	ASM_IDS
AssetResource.asmVaScore	ASM_VA_SCORE
AssetResource.asnCountries	ASN_COUNTRIES
AssetResource.asnHandles	ASN_HANDLES
AssetResource.asnRecordNames	ASN_RECORD_NAMES
AssetResource.asnRegistries	ASN_REGISTRIES
AssetResource.assetExplainers	ASSET_EXPLAINERS
AssetResource.assetType	ASSET_TYPE
AssetResource.businessUnits[].creationTime	BUSINESS_UNIT_HIERARCHIES_CREATION_TIME
AssetResource.businessUnits[].family	BUSINESS_UNIT_HIERARCHIES_FAMILY
AssetResource.businessUnits[].familyAlias	BUSINESS_UNIT_HIERARCHIES_FAMILY_ALIAS
AssetResource.businessUnits[].id	BUSINESS_UNIT_HIERARCHIES_ID
AssetResource.businessUnits[].isActive	BUSINESS_UNIT_HIERARCHIES_IS_ACTIVE
AssetResource.businessUnits[].name	BUSINESS_UNIT_HIERARCHIES_NAME
AssetResource.businessUnits[].parentId	BUSINESS_UNIT_HIERARCHIES_PARENT_ID
AssetResource.businessUnits[].updateTime	BUSINESS_UNIT_HIERARCHIES_UPDATE_TIME
AssetResource.dateAdded	SOURCE_CREATED_DATE
AssetResource.externalIps	EXTERNAL_IPS
AssetResource.externallyDetectedProviders	EXTERNALLY_DETECTED_PROVIDERS
AssetResource.externallyInferredCves	EXTERNALLY_INFERRED_CVES
AssetResource.firstObserved	FIRST_SEEN
AssetResource.geoRegion	GEO_REGION
AssetResource.hasActiveExternallyServices	HAS_ACTIVE_EXTERNALLY_SERVICES
AssetResource.hasAlerts	HAS_ALERTS
AssetResource.hasBuOverrides	HAS_BU_OVERRIDES
AssetResource.hasIncidents	HAS_INCIDENTS
AssetResource.hasXdrAgent	HAS_XDR_AGENT
AssetResource.hierarchy	HIERARCHY
AssetResource.internalIps	INTERNAL_IPS
AssetResource.iotCategory	IOT_CATEGORY
AssetResource.iotModel	IOT_MODEL
AssetResource.iotProfile	IOT_PROFILE
AssetResource.ipRanges	IP_RANGES
AssetResource.ips (distinct)	IP_ADDRESSES
AssetResource.ips where not public	PRIVATE_IP_ADDRESSES
AssetResource.ips where public	PUBLIC_IP_ADDRESSES
AssetResource.lastObserved	LAST_SEEN
AssetResource.lastSampledIp	LAST_SAMPLED_IP
AssetResource.macAddresses (normalized)	MAC_ADDRESSES
AssetResource.managementStatus	MANAGEMENT_STATUS
AssetResource.name	NAME
AssetResource.name	HOSTNAMES
AssetResource.openPorts	OPEN_PORTS
AssetResource.operationSystem	OPERATION_SYSTEM
AssetResource.projectName	PROJECT_NAME
AssetResource.region	REGION
AssetResource.sensor	SENSOR
AssetResource.serviceType	SERVICE_TYPE
AssetResource.subRegion	SUB_REGION
AssetResource.tags	TAGS
AssetResource.vpcNameId	VPC_NAME_ID
Constant active	SOURCE_STATUS
Host category + AssetResource.assetType	CATEGORIES
MD5(AssetResource.name + AssetResource.assetType)	UID

Certificate

Source Field Name	SDM Attribute
AssetResource.asmIds	ASM_IDS
AssetResource.assetType	ASSET_TYPE
AssetResource.businessUnits[].creationTime	BUSINESS_UNIT_HIERARCHIES_CREATION_TIME
AssetResource.businessUnits[].family	BUSINESS_UNIT_HIERARCHIES_FAMILY
AssetResource.businessUnits[].familyAlias	BUSINESS_UNIT_HIERARCHIES_FAMILY_ALIAS
AssetResource.businessUnits[].id	BUSINESS_UNIT_HIERARCHIES_ID
AssetResource.businessUnits[].isActive	BUSINESS_UNIT_HIERARCHIES_IS_ACTIVE
AssetResource.businessUnits[].name	BUSINESS_UNIT_HIERARCHIES_NAME
AssetResource.businessUnits[].parentId	BUSINESS_UNIT_HIERARCHIES_PARENT_ID
AssetResource.businessUnits[].updateTime	BUSINESS_UNIT_HIERARCHIES_UPDATE_TIME
AssetResource.dateAdded	SOURCE_CREATED_DATE
AssetResource.firstObserved	FIRST_SEEN
AssetResource.lastObserved	LAST_SEEN
AssetResource.name	NAME
AssetResource.projectName	PROJECT_NAME
AssetResource.region	REGION
AssetResource.serviceType	SERVICE_TYPE
AssetResource.tags	TAGS
Certificate category + AssetResource.assetType	CATEGORIES
certificateDetails.formattedIssuerOrg	FORMATTED_ISSUER_ORG
certificateDetails.issuer	ISSUER
certificateDetails.issuerAlternativeNames	ISSUER_ALTERNATIVE_NAMES
certificateDetails.issuerCountry	ISSUER_COUNTRY
certificateDetails.issuerEmail	ISSUER_EMAIL
certificateDetails.issuerLocality	ISSUER_LOCALITY
certificateDetails.issuerName	ISSUER_NAME
certificateDetails.issuerOrg	ISSUER_ORG
certificateDetails.issuerOrgUnit	ISSUER_ORG_UNIT
certificateDetails.issuerOrgUnit	MD5_FINGERPRINT
certificateDetails.issuerState	ISSUER_STATE
certificateDetails.publicKey	PUBLIC_KEY
certificateDetails.publicKeyModulus	PUBLIC_KEY_MODULUS
certificateDetails.publicKeyRsaExponent	PUBLIC_KEY_RSA_EXPONENT
certificateDetails.publicKeySpki	PUBLIC_KEY_SPKI
certificateDetails.sha1Fingerprint	SHA1_FINGERPRINT
certificateDetails.sha256Fingerprint	SHA256_FINGERPRINT
certificateDetails.signatureAlgorithm	SIGNATURE_ALGORITHM
certificateDetails.subject	SUBJECT
certificateDetails.subjectCountry	SUBJECT_COUNTRY
certificateDetails.subjectEmail	SUBJECT_EMAIL
certificateDetails.subjectLocality	SUBJECT_LOCALITY
certificateDetails.subjectName	SUBJECT_NAME
certificateDetails.subjectOrg	SUBJECT_ORG
certificateDetails.subjectOrgUnit	SUBJECT_ORG_UNIT
certificateDetails.subjectState	SUBJECT_STATE
certificateDetails.validNotAfter	VALID_DATE_AFTER
certificateDetails.validNotBefore	VALID_DATE_BEFORE
certificateDetails.version	VERSION
CertificateResource.certificateAlgorithm	ALGORITHM
CertificateResource.certificateClassifications	CLASSIFICATIONS
CertificateResource.certificateExpiryDate	EXPIRY_DATE
CertificateResource.certificateHash	HASH
CertificateResource.certificatePublicKeyAlgorithm / certificateDetails.publicKeyAlgorithm	PUBLIC_KEY_ALGORITHM
CertificateResource.certificatePublicKeyBits / certificateDetails.publicKeyBits	PUBLIC_KEY_BITS
CertificateResource.certificateSerialNumber / certificateDetails.serialNumber	SERIAL_NUMBER
CertificateResource.certificateSubjectAltNames / certificateDetails.subjectAlternativeNames	SUBJECT_ALT_NAMES
CertificateResource.certificateSubjectOrganization / certificateDetails.subjectOrg	SUBJECT_ORGANIZATION
CertificateResource.certificateSubjectOrganizationUnit / certificateDetails.subjectOrgUnit	SUBJECT_ORGANIZATION_UNIT
Constant active	SOURCE_STATUS
MD5(AssetResource.name + AssetResource.assetType)	UID

Site

Source Field Name	SDM Attribute
AssetResource.asmIds	ASM_IDS
AssetResource.assetType	ASSET_TYPE
AssetResource.businessUnits[].creationTime	BUSINESS_UNIT_HIERARCHIES_CREATION_TIME
AssetResource.businessUnits[].family	BUSINESS_UNIT_HIERARCHIES_FAMILY
AssetResource.businessUnits[].familyAlias	BUSINESS_UNIT_HIERARCHIES_FAMILY_ALIAS
AssetResource.businessUnits[].id	BUSINESS_UNIT_HIERARCHIES_ID
AssetResource.businessUnits[].isActive	BUSINESS_UNIT_HIERARCHIES_IS_ACTIVE
AssetResource.businessUnits[].name	BUSINESS_UNIT_HIERARCHIES_NAME
AssetResource.businessUnits[].parentId	BUSINESS_UNIT_HIERARCHIES_PARENT_ID
AssetResource.businessUnits[].updateTime	BUSINESS_UNIT_HIERARCHIES_UPDATE_TIME
AssetResource.firstObserved	FIRST_SEEN
AssetResource.lastObserved	LAST_SEEN
AssetResource.projectName	PROJECT_NAME
AssetResource.region	REGION
AssetResource.serviceType	SERVICE_TYPE
AssetResource.tags	TAGS
Certificate category + AssetResource.assetType	CATEGORIES
Constant active	SOURCE_STATUS
domainDetails.admin.emailAddress	ADMIN_EMAIL_ADDRESS
domainDetails.admin.name	ADMIN_NAME
domainDetails.admin.organization	ADMIN_ORGANIZATION
domainDetails.admin.registryId	ADMIN_REGISTRY_ID
domainDetails.alignedRegistrar	ALIGNED_REGISTRAR
domainDetails.collectionTime	COLLECTIONTIME
domainDetails.creationDate	SOURCE_CREATED_DATE
domainDetails.dnssec	DNSSEC
domainDetails.domainName	DOMAIN_NAME
domainDetails.domainStatuses	DOMAIN_STATUSES
domainDetails.dropped	DROPPED
domainDetails.nameServers	NAMESERVERS
domainDetails.registrant.emailAddress	REGISTRANT_EMAIL
domainDetails.registrant.name	REGISTRANT_NAME
domainDetails.registrant.organization	REGISTRANT_ORGANIZATION
domainDetails.registrant.registryId	REGISTRANT_REGISTRY_ID
domainDetails.registrar.abuseContactEmail	REGISTRAR_ABUSE_CONTACT_EMAIL
domainDetails.registrar.abuseContactPhone	REGISTRAR_ABUSE_CONTACT_PHONE
domainDetails.registrar.alignedName	REGISTRAR_ALIGNED_NAME
domainDetails.registrar.ianaId	REGISTRAR_IANA_ID
domainDetails.registrar.name	REGISTRAR_NAME
domainDetails.registrar.registrationExpirationDate	REGISTRAR_REGISTRATION_EXPIRATION_DATE
domainDetails.registrar.url	REGISTRAR_URL
domainDetails.registrar.whoisServer	REGISTRAR_WHO_IS_SERVER
domainDetails.registryDomainId	REGISTRY_ID
domainDetails.registryExpiryDate	REGISTRY_EXPIRY_DATE
domainDetails.reseller	RESELLER
domainDetails.retrievedDate	RETRIEVE_DATE
domainDetails.tech.emailAddress	TECH_EMAIL_ADDRESS
domainDetails.tech.name	TECH_NAME
domainDetails.tech.organization	TECH_ORGANIZATION
domainDetails.tech.registryId	TECH_REGISTRY_ID
domainDetails.updatedDate	SOURCE_LAST_MODIFIED
DomainResource.domain	NAME
DomainResource.domainExpiryDate	EXPIRY_DATE
DomainResource.domainResolves	RESOLVES
DomainResource.isPaidLevelDomain	IS_PAID_LEVEL_DOMAIN
MD5(AssetResource.name + AssetResource.assetType)	UID

Cloud Resource

Source Field Name	SDM Attribute
AssetResource.asmIds	ASM_IDS
AssetResource.assetType	ASSET_TYPE
AssetResource.businessUnits[].creationTime	BUSINESS_UNIT_HIERARCHIES_CREATION_TIME
AssetResource.businessUnits[].family	BUSINESS_UNIT_HIERARCHIES_FAMILY
AssetResource.businessUnits[].familyAlias	BUSINESS_UNIT_HIERARCHIES_FAMILY_ALIAS
AssetResource.businessUnits[].id	BUSINESS_UNIT_HIERARCHIES_ID
AssetResource.businessUnits[].isActive	BUSINESS_UNIT_HIERARCHIES_IS_ACTIVE
AssetResource.businessUnits[].name	BUSINESS_UNIT_HIERARCHIES_NAME
AssetResource.businessUnits[].parentId	BUSINESS_UNIT_HIERARCHIES_PARENT_ID
AssetResource.businessUnits[].updateTime	BUSINESS_UNIT_HIERARCHIES_UPDATE_TIME
AssetResource.dateAdded	SOURCE_CREATED_DATE
AssetResource.firstObserved	FIRST_SEEN
AssetResource.lastObserved	LAST_SEEN
AssetResource.name	NAME
AssetResource.projectName	PROJECT_NAME
AssetResource.region	REGION
AssetResource.serviceType	SERVICE_TYPE
AssetResource.tags	TAGS
Cloud Resource category + AssetResource.assetType	CATEGORIES
CloudInstanceResource.awsCloudTags	AWS_CLOUD_TAGS
CloudInstanceResource.azureCloudTags	AZURE_CLOUD_TAGS
CloudInstanceResource.cloudId	CLOUD_ID
CloudInstanceResource.cloudProvider	CLOUD_PROVIDER
CloudInstanceResource.cloudResourceType	CLOUD_RESOURCE_TYPE
CloudInstanceResource.gcpCloudTags	GCP_CLOUD_TAGS
CloudInstanceResource.providerAccount	CLOUD_ACCOUNT_ID
Constant active	SOURCE_STATUS
MD5(AssetResource.name + AssetResource.assetType)	UID

Service

Source Field Name	SDM Attribute
ServiceResource.activeClassifications	ACTIVE_CLASSIFICATIONS
ServiceResource.asmAssetIds	ASM_ASSET_IDS
ServiceResource.businessUnits[].creationTime	BUSINESS_UNIT_HIERARCHIES_CREATION_TIME
ServiceResource.businessUnits[].family	BUSINESS_UNIT_HIERARCHIES_FAMILY
ServiceResource.businessUnits[].familyAlias	BUSINESS_UNIT_HIERARCHIES_FAMILY_ALIAS
ServiceResource.businessUnits[].id	BUSINESS_UNIT_HIERARCHIES_ID
ServiceResource.businessUnits[].isActive	BUSINESS_UNIT_HIERARCHIES_IS_ACTIVE
ServiceResource.businessUnits[].name	BUSINESS_UNIT_HIERARCHIES_NAME
ServiceResource.businessUnits[].parentId	BUSINESS_UNIT_HIERARCHIES_PARENT_ID
ServiceResource.businessUnits[].updateTime	BUSINESS_UNIT_HIERARCHIES_UPDATE_TIME
ServiceResource.cloudManagementStatus	CLOUD_MANAGEMENT_STATUS
ServiceResource.confirmedNotVulnerableCveIds	CONFIRMED_NOT_VULNERABLE_CVE_IDS
ServiceResource.confirmedVulnerableCveIds	CONFIRMED_VULNERABLE_CVE_IDS
ServiceResource.discoveryType	DISCOVERY_TYPE
ServiceResource.domain	DOMAIN
ServiceResource.externallyDetectedProviders	EXTERNALLY_DETECTED_PROVIDERS
ServiceResource.externallyInferredCves	EXTERNALLY_INFERRED_CVES
ServiceResource.externallyInferredVulnerabilityScore	EXTERNALLY_INFERRED_VULNERABILITY_SCORE
ServiceResource.firstObserved	SOURCE_CREATED_DATE
ServiceResource.inactiveClassifications	INACTIVE_CLASSIFICATIONS
ServiceResource.ipAddress (distinct)	IP_ADDRESSES
ServiceResource.ipAddress where not public	PRIVATE_IP_ADDRESSES
ServiceResource.ipAddress where public	PUBLIC_IP_ADDRESSES
ServiceResource.ipv6Address	IPV6_ADDRESS
ServiceResource.isActive	IS_ACTIVE
ServiceResource.lastObserved	SOURCE_LAST_MODIFIED
ServiceResource.port	PORT
ServiceResource.protocol	PROTOCOL
ServiceResource.serviceId	UID
ServiceResource.serviceName	NAME
ServiceResource.serviceName	SERVICE_NAME
ServiceResource.serviceType	CATEGORIES
ServiceResource.serviceType	SERVICE_TYPE
ServiceResource.tags	TAGS
ServiceResource.vulnerabilityTestResults	VULNERABILITY_TEST_RESULTS
ServiceResource.vulnerabilityTestStatus	VULNERABILITY_TEST_STATUS

IP Range

Source Field Name	SDM Attribute
Constant Network	CATEGORIES
IPRangeResource.activeResponsiveIpsCount	ACTIVE_RESPONSIVE_IPS_COUNT
IPRangeResource.annotation	ANNOTATION
IPRangeResource.asnCountries	ASN_COUNTRIES
IPRangeResource.asnHandles	ASN_HANDLES
IPRangeResource.asnRecordNames	ASN_RECORD_NAMES
IPRangeResource.asnRegistries	ASN_REGISTRIES
IPRangeResource.dateAdded	SOURCE_CREATED_DATE
IPRangeResource.firstIp	FIRST_IP
IPRangeResource.firstIpv6	FIRST_IPV6
IPRangeResource.hasBuOverrides	HAS_BU_OVERRIDES
IPRangeResource.ipaddressVersion	IPADDRESS_VERSION
IPRangeResource.ipsCount	IPS_COUNT
IPRangeResource.lastIp	LAST_IP
IPRangeResource.lastIpv6	LAST_IPV6
IPRangeResource.organizationHandles	ORGANIZATION_HANDLES
IPRangeResource.rangeId	UID
IPRangeResource.tags	TAGS

Alert

Source Field Name	SDM Attribute
AlertResource.action	ACTION
AlertResource.actionCountry	ACTION_COUNTRY
AlertResource.actionExternalHostname	ACTION_EXTERNAL_HOSTNAME
AlertResource.actionLocalIp	ACTION_LOCAL_IP
AlertResource.actionLocalIpV6	ACTION_LOCAL_IP_V6
AlertResource.actionLocalPort	ACTION_LOCAL_PORT
AlertResource.actionPretty	ACTION_PRETTY
AlertResource.actionRemoteIp	ACTION_REMOTE_IP
AlertResource.actionRemoteIpV6	ACTION_REMOTE_IP_V6
AlertResource.actionRemotePort	ACTION_REMOTE_PORT
AlertResource.alertId	UID
AlertResource.alertId	ALERT_ID
AlertResource.alertType / attackSurfaceRuleId	TYPE
AlertResource.asmAlertCategories	ASM_ALERT_CATEGORIES
AlertResource.assetIdentifiers[].domain	ASSET_IDENTIFIERS_DOMAIN
AlertResource.assetIdentifiers[].firstObserved	ASSET_IDENTIFIERS_FIRST_OBSERVED
AlertResource.assetIdentifiers[].httpPath	ASSET_IDENTIFIERS_HTTP_PATH
AlertResource.assetIdentifiers[].ipv4Address	ASSET_IDENTIFIERS_IPV4_ADDRESS
AlertResource.assetIdentifiers[].ipv6Address	ASSET_IDENTIFIERS_IPV6_ADDRESS
AlertResource.assetIdentifiers[].lastObserved	ASSET_IDENTIFIERS_LAST_OBSERVED
AlertResource.assetIdentifiers[].portNumber	ASSET_IDENTIFIERS_PORT_NUMBER
AlertResource.assetIdentifiers[].portProtocol	ASSET_IDENTIFIERS_PORT_PROTOCOL
AlertResource.assetIds	ASSET_IDS
AlertResource.attackSurfaceRuleName	ATTACK_SURFACE_RULE_NAME
AlertResource.businessUnitHierarchies[].creationTime	BUSINESS_UNIT_HIERARCHIES_CREATION_TIME
AlertResource.businessUnitHierarchies[].family	BUSINESS_UNIT_HIERARCHIES_FAMILY
AlertResource.businessUnitHierarchies[].familyAlias	BUSINESS_UNIT_HIERARCHIES_FAMILY_ALIAS
AlertResource.businessUnitHierarchies[].id	BUSINESS_UNIT_HIERARCHIES_ID
AlertResource.businessUnitHierarchies[].isActive	BUSINESS_UNIT_HIERARCHIES_IS_ACTIVE
AlertResource.businessUnitHierarchies[].name	BUSINESS_UNIT_HIERARCHIES_NAME
AlertResource.businessUnitHierarchies[].parentId	BUSINESS_UNIT_HIERARCHIES_PARENT_ID
AlertResource.businessUnitHierarchies[].updateTime	BUSINESS_UNIT_HIERARCHIES_UPDATE_TIME
AlertResource.caseId	CASE_ID
AlertResource.certificate.issuerName	CERTIFICATE_ISSUER_NAME
AlertResource.certificate.serialNumber	CERTIFICATE_SERIAL_NUMBER
AlertResource.certificate.subjectName	CERTIFICATE_SUBJECT_NAME
AlertResource.certificate.validNotAfter	CERTIFICATE_VALID_NOT_AFTER
AlertResource.certificate.validNotBefore	CERTIFICATE_VALID_NOT_BEFORE
AlertResource.cloudManagementStatus	CLOUD_MANAGEMENT_STATUS
AlertResource.cloudProvider	CLOUD_PROVIDER
AlertResource.cloudProviders	CLOUD_PROVIDERS
AlertResource.countryCodes	COUNTRY_CODES
AlertResource.deduplicateTokens	DEDUPLICATE_TOKENS
AlertResource.detectionTimestamp	DETECTION_TIMESTAMP
AlertResource.domainNames	DOMAIN_NAMES
AlertResource.dynamicFields	DYNAMIC_FIELDS
AlertResource.endMatchAttemptTs	END_MATCH_ATTEMPT_TS
AlertResource.endpointId	ENDPOINT_ID
AlertResource.eventId	EVENT_ID
AlertResource.eventTimestamp	EVENT_TIMESTAMP
AlertResource.eventType	EVENT_TYPE
AlertResource.externalId	EXTERNAL_ID
AlertResource.filterRuleId	FILTER_RULE_ID
AlertResource.hostIp	HOST_IP
AlertResource.hostName + AlertResource.assetIds	TARGETS
AlertResource.imageName	IMAGE
AlertResource.integrationSource	INTEGRATION_SOURCE
AlertResource.ipv4Addresses	IPV4_RANGES
AlertResource.ipv6Addresses	IP_V6_RANGES
AlertResource.isWhitelisted	IS_WHITELISTED
AlertResource.lastModifiedTs	SOURCE_LAST_MODIFIED
AlertResource.lastObserved	LAST_SEEN
AlertResource.localInsertTs	LOCAL_INSERT_TS
AlertResource.macAddresses	MAC_ADDRESSES
AlertResource.maliciousUrls	MALICIOUS_URLS
AlertResource.matchingServiceRuleId	MATCHING_SERVICE_RULE_ID
AlertResource.matchingStatus	MATCHING_STATUS
AlertResource.mitreTacticIdAndName	MITRE_TACTIC_ID_AND_NAME
AlertResource.mitreTechniqueIdAndName	MITRE_TECHNIQUE_ID_AND_NAME
AlertResource.portNumber	PORT
AlertResource.portProtocol	PROTOCOL
AlertResource.project	PROJECT
AlertResource.resolutionComment	RESOLUTION_COMMENT
AlertResource.resolutionStatus	RESOLUTION_STATUS
AlertResource.resourceSubType	RESOURCE_SUB_TYPE
AlertResource.resourceType	RESOURCE_TYPE
AlertResource.serviceIds	SERVICE_IDS
AlertResource.source	SOURCE
AlertResource.starred	STARRED
AlertResource.tags	TAGS
AlertResource.userName	USERNAME
AlertResource.websiteIds	WEBSITE_IDS

Alert Definition

Source Field Name	SDM Attribute
AttackSurfaceRuleResource.asmAlertCategories	ASM_ALERT_CATEGORIES
AttackSurfaceRuleResource.attackSurfaceRuleId	UID
AttackSurfaceRuleResource.attackSurfaceRuleName	NAME
AttackSurfaceRuleResource.category	CATEGORIES
AttackSurfaceRuleResource.created	SOURCE_CREATED_DATE
AttackSurfaceRuleResource.description	DESCRIPTION
AttackSurfaceRuleResource.enabledStatus	ENABLED_STATUS
AttackSurfaceRuleResource.knowledgeBaseLink	REFERENCES
AttackSurfaceRuleResource.modified	SOURCE_LAST_MODIFIED
AttackSurfaceRuleResource.modifiedBy	MODIFIED_BY
AttackSurfaceRuleResource.priority	SOURCE_SEVERITY
AttackSurfaceRuleResource.remediationGuidance	RECOMMENDATION
getFindingSeverityScore(normalizeFindingSeverity(priority))	SEVERITY_SCORE
normalizeFindingSeverity(priority)	SEVERITY

Incident

Source Field Name	SDM Attribute
first alert's attackSurfaceRuleId	TYPE
getFindingStatusCategory(normalizeFindingStatus(status))	STATUS_CATEGORY
IncidentExtraData.aggregatedScore	AGGREGATED_SCORE
IncidentExtraData.alertCount	ALERT_COUNT
IncidentExtraData.alertsGroupingStatus	ALERTS_GROUPING_STATUS
IncidentExtraData.assetIds	ASSEST_IDS
IncidentExtraData.assignedUserMail	ASSIGNED_USER_MAIL
IncidentExtraData.assignedUserPrettyName	ASSIGNED_USER_PRETTY_NAME
IncidentExtraData.certificateCommonNames	CERTIFICATE_COMMON_NAMES
IncidentExtraData.certificateIssuers	CERTIFICATE_ISSUERS
IncidentExtraData.certificateSubjectOrganization	CERTIFICATE_SUBJECT_ORGANIZATION
IncidentExtraData.cloudManagementStatus	CLOUD_MANAGEMENT_STATUS
IncidentExtraData.cloudProviders	CLOUD_PROVIDERS
IncidentExtraData.countryCodes	COUNTRY_CODES
IncidentExtraData.creationTime	SOURCE_CREATED_DATE
IncidentExtraData.criticalSeverityAlertCount	CRITICAL_SEVERITY_ALERT_COUNT
IncidentExtraData.detectionTime	FIRST_SEEN
IncidentExtraData.domainNames	DOMAIN_NAMES
IncidentExtraData.highSeverityAlertCount	HIGH_SEVERITY_ALERT_COUNT
IncidentExtraData.hostCount	HOST_COUNT
IncidentExtraData.hosts	TARGETS
IncidentExtraData.incidentId	UID
IncidentExtraData.incidentSources	INCIDENT_SOURCES
IncidentExtraData.integrationSource	INTEGRATION_SOURCE
IncidentExtraData.ipRangeIds	IP_RANGE_IDS
IncidentExtraData.ipv4Addresses	IPV4_RANGES
IncidentExtraData.ipv6Addresses	IP_V6_RANGES
IncidentExtraData.lastObserved	LAST_SEEN
IncidentExtraData.lowSeverityAlertCount	LOW_SEVERITY_ALERT_COUNT
IncidentExtraData.manualDescription	MANUAL_DESCRIPTION
IncidentExtraData.manualScore	MANUAL_SCORE
IncidentExtraData.manualSeverity	MANUAL_SEVERITY
IncidentExtraData.medSeverityAlertCount	MED_SEVERITY_ALERT_COUNT
IncidentExtraData.mitreTacticsIdsAndNames	MITRE_TACTICS_IDS_AND_NAMES
IncidentExtraData.mitreTechniquesIdsAndNames	MITRE_TECHNIQUES_IDS_AND_NAMES
IncidentExtraData.modificationTime	SOURCE_LAST_MODIFIED
IncidentExtraData.notes	NOTES
IncidentExtraData.originalTags	ORIGINAL_TAGS
IncidentExtraData.portNumber	PORT
IncidentExtraData.resolveComment	RESOLVE_COMMENT
IncidentExtraData.resolvedTimestamp	RESOLVED_TIMESTAMP
IncidentExtraData.ruleBasedScore	RULE_BASED_SCORE
IncidentExtraData.serviceIds	SERVICE_IDS
IncidentExtraData.starred	STARRED
IncidentExtraData.starredManually	STARRED_MANUALLY
IncidentExtraData.status	SOURCE_STATUS
IncidentExtraData.tags	TAGS
IncidentExtraData.userCount	USER_COUNT
IncidentExtraData.websiteIds	WEBSITE_IDS
IncidentExtraData.xdrUrl	XDR_URL
IncidentExtraData.xpanseRiskScore	XPANSE_RISK_SCORE
normalizeFindingStatus(status)	STATUS

Incident Definition

Source Field Name	SDM Attribute
AttackSurfaceRuleResource.asmAlertCategories	ASM_ALERT_CATEGORIES
AttackSurfaceRuleResource.attackSurfaceRuleId	UID
AttackSurfaceRuleResource.attackSurfaceRuleName	NAME
AttackSurfaceRuleResource.category	CATEGORIES
AttackSurfaceRuleResource.created	SOURCE_CREATED_DATE
AttackSurfaceRuleResource.description	DESCRIPTION
AttackSurfaceRuleResource.enabledStatus	ENABLED_STATUS
AttackSurfaceRuleResource.knowledgeBaseLink	REFERENCES
AttackSurfaceRuleResource.modified	SOURCE_LAST_MODIFIED
AttackSurfaceRuleResource.modifiedBy	MODIFIED_BY
AttackSurfaceRuleResource.priority	SOURCE_SEVERITY
AttackSurfaceRuleResource.remediationGuidance	RECOMMENDATION
getFindingSeverityScore(normalizeFindingSeverity(priority))	SEVERITY_SCORE
normalizeFindingSeverity(priority)	SEVERITY

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Host

Operation options

Option	Type	Default	Description
tags	String	Filters assets by tags (tag-family:tag-name)
ip_address	Integer	Filters assets by ip_address equality
name	Integer	Filters assets where name contains the value

Delta sync

Not supported. The connector performs a full sync of Host on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/assets/get_assets_internet_exposure/
• Default filters: type in ["unassociated_responsive_ip"]

Certificate

Operation options

Option	Type	Default	Description
tags	String	Filters by tags (tag-family:tag-name)
ip_address	Integer	Filters by ip_address equality
name	Integer	Filters where name contains the value

Delta sync

Not supported. The connector performs a full sync of Certificate on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/assets/get_assets_internet_exposure/
• Default filters: type in ["certificate"]

Site

Operation options

Option	Type	Default	Description
tags	String	Filters by tags (tag-family:tag-name)
ip_address	Integer	Filters by ip_address equality
name	Integer	Filters where name contains the value

Delta sync

Not supported. The connector performs a full sync of Site on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/assets/get_assets_internet_exposure/
• Default filters: type in ["domain"]

note

> [!NOTE] > Site records carry the Certificate asset category. The Site model resolves its asset > category to Certificate, so synchronized Site objects appear under that category > rather than a domain-specific one.

Cloud Resource

Operation options

Option	Type	Default	Description
tags	String	Filters by tags (tag-family:tag-name)
ip_address	Integer	Filters by ip_address equality
name	Integer	Filters where name contains the value

Delta sync

Not supported. The connector performs a full sync of Cloud Resource on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/assets/get_assets_internet_exposure/
• Default filters: type in ["cloud_compute_instance"]

Service

Operation options

Option	Type	Default	Description
tags	String	Filters by tags (tag-family:tag-name)
ip_address	String	Filters by ip_address equality
service_name	String	Filters where service_name contains the value
service_type	String	Filters where service_type contains the value
domain	String	Filters where domain contains the value
discovery_type	String	Filters by discovery_type

Delta sync

Not supported. The connector performs a full sync of Service on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/assets/get_external_services/
• Default filters: None (operation options only)

IP Range

Operation options

Option	Type	Default	Description
tags	String	Filters by tags (tag-family:tag-name)

Delta sync

Not supported. The connector performs a full sync of IP Range on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/assets/get_external_ip_address_ranges/
• Default filters: None (operation options only)

Alert

Operation options

Option	Type	Default	Description
severity	String	Filters by severity
status	String	Filters by status
tags	String	Filters by tags
alert_source	String	Filters by alert_source
cloud_management_status	String	Filters by cloud_management_status
asm_alert_categories	String	Filters by asm_alert_categories

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on creation_time.

API

• Type: REST · Endpoint: POST /public_api/v2/alerts/get_alerts_multi_events/
• Default filters: None (filters are added only when a delta token or operation option is set)

Alert Definition

Operation options

Option	Type	Default	Description
attack_surface_rule_id	String	Filters by attack_surface_rule_id
category	String	Filters by category
priority	String	Filters by priority

Delta sync

Not supported. The connector performs a full sync of Alert Definition on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/get_attack_surface_rules/
• Default filters: None (operation options only)

Incident

Operation options

Option	Type	Default	Description
alert_sources	String	Filters by alert_sources
status	String	Filters by status
incident_id_list	String	Filters by incident_id_list
cloud_management_status	String	Filters by cloud_management_status

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on modification_time.

API

• Type: REST · Endpoint: POST /public_api/v1/incidents/get_incidents/
• Default filters: None (filters are added only when a delta token or operation option is set)

Incident Definition

Operation options

Option	Type	Default	Description
attack_surface_rule_id	String	Filters by attack_surface_rule_id
category	String	Filters by category
priority	String	Filters by priority

Delta sync

Not supported. The connector performs a full sync of Incident Definition on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/get_attack_surface_rules/
• Default filters: None (operation options only)

Changelog

Changelog

The Cortex Xpanse Connector connector has undergone the following changes:

Version	Description	Migration Steps
3.1.0	No changes in this release.	N/A
3.0.6	No changes in this release.	N/A
3.0.5	No changes in this release.	N/A
3.0.4	No changes in this release.	N/A
3.0.3	No changes in this release.	N/A
3.0.2	No changes in this release.	N/A
3.0.1	No changes in this release.	N/A
3.0.0	Overview The Cortex Xpanse connector integrates with Palo Alto Networks Cortex Xpanse to synchronize external attack surface management data, including discovered internet-facing assets, exposed services, and the alerts and incidents raised against them. Category: External Attack Surface Management Models	N/A