Repository navigation
feat(soc-cortex-xpanse-posture): platform-native Posture lifecycle with attack surface + vulnerability categories - #1042
Merged
scottbrumley merged 9 commits intoOct 14, 2026
Conversation
…re lifecycle) First vendor pack for a unified-platform-native data source. Cortex Xpanse-XSIAM integration writes attack-surface issues directly into the unified issues dataset (xdm.issue.detection.method = XPANSE) with XDM normalization applied at platform ingestion. No raw vendor dataset; the standard raw-to-XDM modeling step does not apply. Routes through soc-framework-posture lifecycle via SOCProductCategoryMap_V3 (ds_panw_asm: Posture). Platform stamps DOM:Posture and DS:PANW/ASM tags on every Xpanse issue at ingestion, which Foundation Product Classification reads for lifecycle dispatch. Schema at schemas/vendors/cortex-xpanse/cortex-xpanse-posture.yaml documents the pattern for unified-platform-native vendors. Same shape will apply to AI-SPM, CIEM, and future Cortex Cloud sources that write directly to the issues dataset. Dispatch mechanism for platform-native issue sources (versus the standard third-party correlation-rule pattern) pending framework review - see PR discussion.
- Add docs/soc-cortex-xpanse-posture/ (overview + schema doc) auto-generated by prep_docs.py - Regenerate docs/SocFrameworkProofPointTap/overview.md and docs/soc-crowdstrike-falcon/overview.md (version bump drift from prior merges - global prep_docs gate)
Six-panel dashboard visualizing attack surface findings from Cortex Xpanse issues: - Findings by severity - Findings by action_status - Findings trend over time (30d) - Top 10 finding types by rule_id - Geographic exposure by country - Top 10 affected assets All queries operate directly against dataset = issues filtered by xdm.issue.detection.method = XPANSE. Field-verified in dev tenant against real Xpanse data. Panels reference standard PANW palette colors. Baseline v1.0. Panel content may refine after validation against framework-installed tenant.
… posture categories Removes correlation and modeling rules. Cortex Xpanse writes issues directly to the unified issues dataset at platform ingestion - no raw vendor dataset exists to transform. Adds two categories to SOCFrameworkNormalizeMap_POSTURE: posture_attack_surface - exposed services, certificates, network protocols. Fields: target_ip, target_hostname, target_port, application_protocol, certificate_issuer, certificate_not_after, target_country. Dedup on target_ip + target_port. posture_vulnerability - CVE-bearing findings on exposed services. Fields: cve_id, cvss_score, cvss_vector, affected_package, affected_package_version, fixed_version, target_ip, target_hostname. Dedup on cve_id + target_ip. Field mappings verified against real Xpanse data in Skynet tenant. Categories present after edit: posture_misconfig, posture_compliance, posture_drift, posture_attack_surface, posture_vulnerability, generic. Updated README and release notes to document the framework contract extension pattern and prerequisites. Same shape will apply to AI-SPM, CIEM, and future Cortex Cloud sources that write directly to the unified issues dataset.
…xtension The same unified-platform-native pattern applies when Cortex AES / Koi telemetry begins flowing to XSIAM. Koi issues will land in the issues dataset at platform ingestion with XDM normalization applied, and a future posture_agent_runtime category in SOCFrameworkNormalizeMap_POSTURE will normalize agent identity, runtime policy violations, MCP tool interactions, and prompt injection detections into the CloudPosture contract shape following this pack's precedent.
… findings Three defects prevented the posture categories from producing any contract output on a tenant. posture_attack_surface wrote nothing. Two target_country rows sat in the stamps array without a value key, so apply_stamps raised KeyError and the category produced no output including its dedup fields. Both rows moved into mappings with the standard row shape, flat field plus Artifacts.* structured counterpart. Categories were absent from the schema YAML, so the next NormalizeMap regeneration would have dropped them. Both now in SOCFrameworkNormalizeMap_POSTURE.yaml, roundtrip verified byte-identical against the shipped JSON. ds_panw_asm resolved to a lifecycle name rather than a category, so Xpanse issues fell through to generic and category inference was skipped because the datasource was mapped. Now maps to posture_attack_surface in both the SOCProductCategoryMap_V3 YAML and JSON. Routing verified end to end through the framework's own key conversion. Pack catalog regenerated.
sha-x-ai
force-pushed
the
feat/soc-cortex-xpanse-posture-v2
branch
from
October 11, 2026 18:46
bf289a0 to
f38554e
Compare
Contributor
Author
SummaryFirst Posture-lifecycle vendor pack for a unified-platform-native data source. Cortex Xpanse writes attack-surface findings directly to the unified Rebased onto current main. Scope is the contract layer: Xpanse findings normalize into a complete Contents
Defects fixed in this revisionThe earlier revision produced no contract output on a tenant. Three causes:
Routing verified end to end through the framework's own key conversion. Deliberately out of scopeLifecycle routing. The four posture phase routers branch only on misconfig, compliance and drift, so these categories do not execute. Adding gate-and-dispatch branches would extend the per-category conditional pattern, which reads as the wrong direction given the move toward AI reasoning over the contract. The contract populates correctly and is available to whatever consumes it. Happy to wire the routers if you would rather have that in this PR. Known gaps
|
sha-x-ai
marked this pull request as ready for review
October 11, 2026 18:52
…pack_metadata validate_pack_catalog.py rejects the stray "version" alongside currentVersion: CI copies pack_metadata.json to metadata.json where the platform parses version as int64, so a string value fails the upload with 400. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AG4FLrpZea8MDqSjjmPh5u
…envelope demisto-sdk Pack model requires XSIAMDashboard id; add fresh global_id, top-level id/name/fromVersion and metadata to match framework dashboards. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01AG4FLrpZea8MDqSjjmPh5u
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
3 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
First Posture-lifecycle vendor pack for a unified-platform-native data source. Cortex Xpanse writes attack-surface findings directly to the unified
issuesdataset at platform ingestion with XDM normalization applied, so no correlation rule or modeling rule is required.Rebased onto current main. Scope is the contract layer: Xpanse findings normalize into a complete
SOCFramework.CloudPosture.*contract. Lifecycle routing is deliberately out of scope, see below.Contents
posture_attack_surfaceandposture_vulnerabilitycategories inSOCFrameworkNormalizeMap_POSTURE, in both the schema YAML and the generated JSONds_panw_asmrouting entry inSOCProductCategoryMap_V3Defects fixed in this revision
The earlier revision produced no contract output on a tenant. Three causes:
target_countryrows sat instampswithout avaluekey.apply_stampsraised KeyError and the entireposture_attack_surfacecategory produced nothing, dedup fields included. Rows moved intomappings.ds_panw_asmresolved toPosture, a lifecycle name rather than a category, so the normalizer fell back to generic and inference was skipped because the datasource was mapped.Routing verified end to end through the framework's own key conversion.
Deliberately out of scope
Lifecycle routing. The four posture phase routers branch only on misconfig, compliance and drift, so these categories do not execute. Adding gate-and-dispatch branches would extend the per-category conditional pattern, which reads as the wrong direction given the move toward AI reasoning over the contract. The contract populates correctly and is available to whatever consumes it. Happy to wire the routers if you would rather have that in this PR.
Known gaps
ds_panw_asmmaps toposture_attack_surfacefor all Xpanse findings, so CVE-bearing findings do not reachposture_vulnerability. Aproduct_mapsplit following theds_crowdstrike_falcon_eventpattern would separate them.SOCFrameworkPhaseContract_POSTUREhas nowrites_by_phaseand none of theai-role fields the IR contract carries (closure_*,action_confidence). Relevant if posture gets an AI layer.