Google SecOps - Export XDR Detection Findings

This workflows exports XDR detection findings to Google SecOps every 5 minutes using a schedule automation rule. More information about the XDR Query API and its schemas can be found here: https://developer.cisco.com/docs/cisco-xdr/exporting-xdr-detection-findings-exporting-xdr-detection-findings/

Targets: Automation APIs, Platform APIs, Query APIs, Google SecOps

Steps:

• Check if a configuration was provided in the workflow
  • If not, fetch it from the Google SecOps integration
• Calculate and format the necessary timestamps
• For each page of findings:
  • Fetch this page of findings
  • For each finding returned, fetch its events and export them to Google SecOps
  • Check if there's a next page
    • If there isn't, end the loop
    • If there is, update the paging variables