What Changed

PR #14751 ports detection and parser content from the legacy Cortex XDR solution into the renamed CCF-based solution (solution name drops the CCP suffix). The legacy solution held analytic rules and a parser that were never carried over when the CCF connector was introduced.

Analytic Rules (3 added)

Three new Scheduled Analytic Rules fire against the PaloAltoCortexXDR_Incidents parser function:

  • Cortex XDR Incident - High (PaloAltoCortexXDR_High.yaml)
  • Cortex XDR Incident - Medium (PaloAltoCortexXDR_Medium.yaml)
  • Cortex XDR Incident - Low (PaloAltoCortexXDR_Low.yaml)

Detection Logic (all three rules share the same structure, differing only in severity filter):

  • Primary data source: PaloAltoCortexXDR_Incidents_CL (via PaloAltoCortexXDR_Incidents parser)
  • Core logic: Filters incidents by Severity containing the target level, excludes auto-resolved incidents (Status !contains “resolved_auto”), and requires at least one host or user entity (HostCount > 0 or UserCount > 0)
  • Query frequency / period: 5 minutes / 5 minutes
  • Suppression: 5 hours
  • Incident grouping: AllEntities match, 5-hour lookback
  • Entity mappings: Account (Name <- Users_s), URL (Url <- XdrUrl), Host (HostName <- Hosts_s)

No relevantTechniques or tactics are populated – MITRE mapping is absent from the rule YAML.

Detection gap note: Organizations running the CCF-based Palo Alto Cortex XDR connector prior to this release had zero Analytic Rules generating Sentinel incidents from Cortex XDR incident data. This is a blind spot closure.

Parser (1 added)

PaloAltoCortexXDR_Incidents (PaloAltoCortexXDR.yaml) – a union parser normalising incidents from both data sources:

  • CCF path: PaloAltoCortexXDR_Incidents_CL – uses column_ifexists() for safe field access, normalises timestamps, severity counts, host/user arrays, and alert categorisation fields.
  • Legacy path: CortexXDR_Incidents_CL – maps legacy snake_case fields (e.g., incident_id_s, severity_s, creation_time_d as Unix milliseconds) to the normalised schema. Timestamps are converted via unixtime_milliseconds_todatetime().

The union means organisations with both legacy and CCF connectors deployed will see incidents from both tables through a single parser function.

Data fidelity note: The legacy path does not populate IncidentName, DetectionTime, WildfireHits, AlertsGroupingStatus, or OriginalTags (set to empty/null) – these fields do not exist in the legacy table schema.

MITRE Mapping

No MITRE techniques are declared in the rule YAML (tactics: [], relevantTechniques: []). MITRE coverage is not determinable from this diff.

Affected Files

.script/tests/KqlvalidationsTests/CustomTables/PaloAltoCortexXDR_Incidents.json
.script/tests/detectionTemplateSchemaValidation/ValidConnectorIds.json
Solutions/Palo Alto Cortex XDR/Analytic Rules/PaloAltoCortexXDR_High.yaml
Solutions/Palo Alto Cortex XDR/Analytic Rules/PaloAltoCortexXDR_Low.yaml
Solutions/Palo Alto Cortex XDR/Analytic Rules/PaloAltoCortexXDR_Medium.yaml
Solutions/Palo Alto Cortex XDR/Data Connectors/CortexXDR_ccp/DCR.json
Solutions/Palo Alto Cortex XDR/Data Connectors/CortexXDR_ccp/DataConnectorDefinition.json
Solutions/Palo Alto Cortex XDR/Data Connectors/CortexXDR_ccp/PollingConfig.json
Solutions/Palo Alto Cortex XDR/Data Connectors/CortexXDR_ccp/table_agent.json
Solutions/Palo Alto Cortex XDR/Data Connectors/CortexXDR_ccp/table_alerts.json
Solutions/Palo Alto Cortex XDR/Data Connectors/CortexXDR_ccp/table_endpoint.json
Solutions/Palo Alto Cortex XDR/Data Connectors/CortexXDR_ccp/table_incidents.json
Solutions/Palo Alto Cortex XDR/Data Connectors/CortexXDR_ccp/table_managment.json
Solutions/Palo Alto Cortex XDR/Package/testParameters.json
Solutions/Palo Alto Cortex XDR/Parsers/PaloAltoCortexXDR.yaml
(packaging artefacts: 3.0.0.zip, 3.0.1.zip, 3.0.2.zip, 3.0.3.zip, 3.0.4.zip, 3.0.5.zip, ReleaseNotes.md, SolutionMetadata.json, Solution_CortexXDR.json, createUiDefinition.json, mainTemplate.json)