feat(soc-cortex-xpanse-posture): platform-native Posture lifecycle with attack surface + vulnerability categories - #1042
Draft
sha-x-ai wants to merge 6 commits into
Draft
Conversation
…re lifecycle) First vendor pack for a unified-platform-native data source. Cortex Xpanse-XSIAM integration writes attack-surface issues directly into the unified issues dataset (xdm.issue.detection.method = XPANSE) with XDM normalization applied at platform ingestion. No raw vendor dataset; the standard raw-to-XDM modeling step does not apply. Routes through soc-framework-posture lifecycle via SOCProductCategoryMap_V3 (ds_panw_asm: Posture). Platform stamps DOM:Posture and DS:PANW/ASM tags on every Xpanse issue at ingestion, which Foundation Product Classification reads for lifecycle dispatch. Schema at schemas/vendors/cortex-xpanse/cortex-xpanse-posture.yaml documents the pattern for unified-platform-native vendors. Same shape will apply to AI-SPM, CIEM, and future Cortex Cloud sources that write directly to the issues dataset. Dispatch mechanism for platform-native issue sources (versus the standard third-party correlation-rule pattern) pending framework review - see PR discussion.
- Add docs/soc-cortex-xpanse-posture/ (overview + schema doc) auto-generated by prep_docs.py - Regenerate docs/SocFrameworkProofPointTap/overview.md and docs/soc-crowdstrike-falcon/overview.md (version bump drift from prior merges - global prep_docs gate)
Six-panel dashboard visualizing attack surface findings from Cortex Xpanse issues: - Findings by severity - Findings by action_status - Findings trend over time (30d) - Top 10 finding types by rule_id - Geographic exposure by country - Top 10 affected assets All queries operate directly against dataset = issues filtered by xdm.issue.detection.method = XPANSE. Field-verified in dev tenant against real Xpanse data. Panels reference standard PANW palette colors. Baseline v1.0. Panel content may refine after validation against framework-installed tenant.
… posture categories Removes correlation and modeling rules. Cortex Xpanse writes issues directly to the unified issues dataset at platform ingestion - no raw vendor dataset exists to transform. Adds two categories to SOCFrameworkNormalizeMap_POSTURE: posture_attack_surface - exposed services, certificates, network protocols. Fields: target_ip, target_hostname, target_port, application_protocol, certificate_issuer, certificate_not_after, target_country. Dedup on target_ip + target_port. posture_vulnerability - CVE-bearing findings on exposed services. Fields: cve_id, cvss_score, cvss_vector, affected_package, affected_package_version, fixed_version, target_ip, target_hostname. Dedup on cve_id + target_ip. Field mappings verified against real Xpanse data in Skynet tenant. Categories present after edit: posture_misconfig, posture_compliance, posture_drift, posture_attack_surface, posture_vulnerability, generic. Updated README and release notes to document the framework contract extension pattern and prerequisites. Same shape will apply to AI-SPM, CIEM, and future Cortex Cloud sources that write directly to the unified issues dataset.
…xtension The same unified-platform-native pattern applies when Cortex AES / Koi telemetry begins flowing to XSIAM. Koi issues will land in the issues dataset at platform ingestion with XDM normalization applied, and a future posture_agent_runtime category in SOCFrameworkNormalizeMap_POSTURE will normalize agent identity, runtime policy violations, MCP tool interactions, and prompt injection detections into the CloudPosture contract shape following this pack's precedent.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Additional category added: posture_vulnerability
Beyond
posture_attack_surfacefor exposed services, this PR also addsposture_vulnerabilitytoSOCFrameworkNormalizeMap_POSTUREfor CVE-bearing findings from Cortex Xpanse's vulnerability policy detections. Fields:cve_id,cvss_score,cvss_vector,affected_package,affected_package_version,fixed_version, plustarget_ip/target_hostnamefor asset identification. Dedup oncve_id+target_ip.