Skip to main content
{ Attack Surface Management / Reporting and Compliance }

Palo Alto Cortex Xpanse Attack Surface Posture Report

Delivers a weekly report on the attack surface in Palo Alto Cortex Xpanse, with new assets and services, alerts opened and resolved by rule, aging alerts, attribution coverage, and anything that needs attention.

What this agent does

This read-only agent reports every week on the attack surface Palo Alto Cortex Xpanse attributes to the organization. It counts the assets, services, and certificates in the inventory and the open alerts by attack surface rule and severity. It lists the assets and services that appeared and disappeared since last week and the alerts opened and resolved, with the resolution reasons. It lists the alerts open for more than 30 days with their business unit. It checks that the attribution covers every public range and domain the organization owns in the cloud accounts I connect. It flags anything that needs an admin.

The challenge

Xpanse finds new exposures every day and the alerts queue up by attack surface rule. A rule fires fifty times in a week because one team deploys the same insecure template. A dozen alerts sit under investigation for two months. A new cloud account adds a network range that Xpanse does not attribute, so its exposures never appear. The fifty alerts look like fifty problems instead of one template.

The solution

The agent reads the inventory, the alerts, and the attribution data in one pass each week and compares them with the previous week. It groups alerts by rule and business unit so a repeated exposure shows as one pattern with one fix. It lists what changed and what someone needs to act on, with the fix for each item. Provides a weekly briefing an attack surface owner reads in a few minutes.

Workflow

  1. 01

    Read the inventory

    Count the assets, services, and certificates Xpanse attributes to the organization, and list the additions and removals since last week.

  2. 02

    Read alerts

    Read the open alerts by rule, severity, and business unit, the alerts opened and resolved since last week with their resolution reasons, and the age of each open alert.

  3. 03

    Check attribution

    Compare the attributed ranges and domains with the public ranges and DNS zones in the cloud accounts I connect, and list the gaps.

  4. 04

    Report

    Publish what changed and what needs action, with the fix for each item.

Agent template 

# Palo Alto Cortex Xpanse Attack Surface Posture Report

## Measurable outcomes

Every week, the attack surface owner knows what appeared, what disappeared, which alerts are open and for how long, which rules fire most, and which ranges and domains Xpanse does not attribute. Track the asset, service, and open alert counts and the open action items on every run.

## Procedure

Once a week, count the assets, services, and certificates Xpanse attributes to the organization, and list the assets and services added and removed since the last report, grouped by service type. Flag any new service on a database, remote access, or management port. Read the open alerts by attack surface rule, severity, and business unit. List the alerts opened and resolved since last week, with the resolution reason for each resolved alert, and flag resolutions with no comment. Call out any rule with 5 or more new alerts this week as a pattern, and name the business unit behind it. List the open alerts older than 30 days, unless I set another window, with the business unit and the assignee when one exists. List the certificates in the inventory that expire within 30 days. When I grant read-only access to the cloud accounts, list the public network ranges, public addresses, and DNS zones they hold, and list each range and domain that Xpanse does not attribute to the organization. Compare everything with last week's report, and lead with what changed. Give every action item the specific fix, such as add a range to attribution, assign an owner, or fix the template behind a pattern. Report a check it cannot run as not checked, never as fine.

## Requirements

It needs a Palo Alto Cortex Xpanse API key with read access to assets, services, certificates, alerts, and attack surface rules, and optional read-only access to the cloud accounts for the attribution comparison, and nothing more. It never changes alerts, attribution, or any asset. Reports show service types, rule names, business units, and counts. Addresses and hostnames appear as stable pseudonyms in the summary and in full in the ticket for each action item.