Cortex XSOAR (Webhook)

This guide explains how to configure Cortex XSOAR's Generic Webhook so that alerts from AiStrike are automatically ingested and converted into incidents in XSOAR.◼︎

Overview of Responsibilities

Step 1: Create an Integration User in XSOAR (Customer)

1. Log in to Cortex XSOAR with an Administrator account.

2. Go to Settings → Users & Roles → Users.

3. Click + New User.

4. Enter details:

   • Username: aistrike_integration (example)

   • Password: strong password (store securely)

   • Role: Assign a role (Analyst) that has permission to Create Incidents and Execute Integrations.

5. Save the new user.

Deliverable for AiStrike: Username and password for Basic Auth (securely shared).

Step 2: Configure Generic Webhook in XSOAR (Customer)

1. Go to Settings → Integrations → Instances.

2. Search for Generic Webhook and click Add instance.

3. Configure:

   • Name: AiStrike_Webhook

   • Incident Type: choose the desired type (e.g., Incident, or a custom type like AiStrike Incident).

   • Authentication: enter the username and password created in Step 1.

   • (Optional) Enable store_samples=true to capture sample payloads for mapping.

4. Save the instance.

5. Copy the Webhook URL generated by XSOAR:
   Example (cloud):
   https://ext-mytenant.crtx.us.paloaltonetworks.com/xsoar/instance/execute/AiStrike_Webhook

Deliverable for AiStrike: Webhook URL.

Step 3: Field Mapping in XSOAR (Customer)

1. In XSOAR, navigate to Settings → Object Setup → Incident Types & Fields → Classification & Mapping.

2. Create an Incoming Mapper for AiStrike.

3. Map AiStrike JSON fields to XSOAR incident fields, e.g.:

   • alert_id → Incident ID

   • severity → Incident Severity

   • description → Incident Description

4. Save and test with a sample payload.

Step 4: Share details with AiStrike to Send Alerts

Share the details below with AiStrike. AiStrike will configure a webhook connector with:

• Webhook URL: provided by customer (Step 2).

• Authentication: use username: password (Step 1).

Example payload delivery from AiStrike:

curl -X POST "https://<XSOAR_URL>/xsoar/instance/execute/AiStrike_Webhook" \
  -u "aistrike_integration:<PASSWORD>" \
  -H "Content-Type: application/json" \
  -d '{
        "name": "AiStrike Test Alert",
        "rawJson": {
          "alert_id": "12345",
          "severity": "high",
          "description": "Suspicious AWS IAM activity detected",
          "source": "AWS CloudTrail"
        }
      }'

Step 5: End-to-End Testing

1. Trigger a test alert from AiStrike.

2. Confirm in XSOAR that a new incident is created.

3. Validate that fields are mapped correctly.

4. Confirm the assigned playbook (if applicable) is triggered.