Palo Alto Xpanse - Expander Connector Guide

Summary: How to set up and use the Palo Alto Xpanse - Expander connector in Ivanti Neurons RBVM/ASPM/VULN KB.

Palo Alto Xpanse - Expander collects data about every device connected to the Internet and attributes assets to customers. Expander maintains the inventory associated with a given organization and sends alerts to unexpected, unknown, or risky IT assets that appear in the system.

The Ivanti Neurons RBVM/ASPM/VULN KB platform provides an API-based connector that integrates with Palo Alto Expanse - Expander, enabling customers to bring in their findings. It allows customers to gain visibility into their overall risk due to vulnerabilities in their endpoint and a more straightforward, more efficient way to manage those vulnerabilities.

Expander is a cloud-based solution. Ivanti Neurons requires a user account with the following access to communicate with and pull data from Expander.

The following API calls are performed during a connector run to pull security vulnerabilities from Cortex Xpanse into Ivanti Neurons for RBVM.

Navigate to the Automate > Integrations page.

Using the search bar in the upper-right corner of the Integrations page, type Expander to find the connector.

Locate the Palo Alto Xpanse - Expander card on the page and click Configuration.

In the new window under Connection, complete the required fields, as described below.

Click the Test Credentials button to ensure the credentials are correct and have the necessary access to make Xpanse API calls.

Under Schedule, configure the desired schedule for the connector to retrieve results from the Expander instance. Users can optionally turn on Enable auto URBA (Update Remediation by Assessment).

Click the Save button to save the connector’s configuration and create the connector. Once saved, the connector is now visible on the Integrations page under Currently Configured Integrations.

Clicking the History button displays the connector details for each pull. The Sync button allows users to perform on-demand sync. The Edit button allows the user to edit the connector configuration. The Delete button allows the user to delete the connector.

Once files have been processed on the Uploads page, view the ingested data by navigating to the Hosts and Host Findings pages.

This connector does not include any additional filter options for data ingestion.

Connector configurations can be updated at any time after creation. Go to the Automate > Integrations page and select the specific connector you want to update.

The data from Palo Alto Networks Cortex Xpanse API is ingested into Ivanti Neurons for RBVM as Hosts and Host Findings. The Scanner Name associated with these scans is Expander. Scanner Name can be used as a filter for Hosts and Host Findings.

All assets from the Palo Alto Networks Cortex Xpanse API are shown on the Hosts page.

Ivanti Neurons RBVM Tags

The following fields from Cortex Xpanse APIs are converted into RBVM asset tags. These tags can be used for searching, playbook automation, and better visualization in RBVM Dashboards.

All findings from the Palo Alto Networks Cortex Xpanse API are shown on the Host Findings page.

This table showcases the high-level mapping of Xpanse API fields in Ivanti Neurons for RBVM.