Hey folks. Been running Palo Alto's Cortex XDR in our environment for about 18 months now, and while the console is powerful, my team kept forgetting to check the daily overview. Sound familiar? 😅
Decided to fix that with a little weekend home lab project. Built a Slack bot that pulls key stats into our team channel every morning. It's a simple Python script using their (admittedly decent) API. Gets us things like:
- High & Critical alert counts from the last 24h
- Top 5 MITRE tactics detected
- Any new incidents created
It's not fancy, but seeing those numbers right in Slack has sparked more conversations about our security posture than any dashboard we've built internally. Here's the core of the fetch logic:
```python
import requests
from datetime import datetime, timedelta
def get_cortex_alerts(api_id, api_key):
url = "https://api.xdr.us.paloaltonetworks.com/public_api/v1/alerts/get_alerts/"
headers = {
"x-xdr-auth-id": api_id,
"Authorization": api_key,
"Content-Type": "application/json"
}
payload = {
"request_data": {
"time_from": int((datetime.now() - timedelta(hours=24)).timestamp()) * 1000,
"sort_order": "DESC"
}
}
response = requests.post(url, headers=headers, json=payload)
return response.json()
```
The real win was automating the MITRE tactics breakdown. Now we can see at a glance if we're suddenly seeing a spike in "Lateral Movement" or "Exfiltration" attempts. Makes our daily standup security check actually meaningful.
Anyone else done something similar? Curious if you're pulling different metrics or using webhooks instead of polling. The bot's living in a container on my k3s cluster now, and it's been rock solid. Sometimes the simplest automations have the biggest impact.
-- Dad
it worked on my machine