Cortex XSOAR × Sentiqra

Use Sentiqra classifications as inputs to your XSOAR playbooks and response logic. You define the enforcement policy. Sentiqra supplies the classification evidence.

Why This Integration Matters

The SOAR question is the "how does this actually work in production" question for cyber buyers. SOAR platforms automate response actions based on detection signals - and without a documented integration, security teams assume Sentiqra requires manual triage.

Cortex XSOAR (formerly Demisto) is one of the top SOAR platforms in enterprise environments. By publishing an integration pack with pre-built playbooks, Sentiqra detections can trigger automated response actions: quarantine phishing emails, disable compromised accounts, escalate tickets, and notify legal - all without human intervention.

Importable playbook definitions close deals in a way documentation alone can't. A security engineer who can import a XSOAR pack and see Sentiqra detections trigger automated responses within minutes is a security engineer who recommends your product.

Reference Architecture

┌──────────────────────────────────────────────────────────────┐
│                Your Infrastructure                           │
│                                                               │
│  ┌──────────┐    ┌──────────────┐    ┌──────────┐           │
│  │ Sentiqra  │───▶│ Cortex XSOAR │───▶│ Automated│           │
│  │ Detection │    │ Integration  │    │ Response │           │
│  │           │    │              │    │          │           │
│  │ Returns:  │    │ Trigger:     │    │ Actions: │           │
│  │ - group   │    │ sentiqra.    │    │ - quarantine│         │
│  │ - concept │    │ detect       │    │ - disable  │         │
│  │ - confid. │    │              │    │   account  │         │
│  │           │    │ Condition:   │    │ - escalate │         │
│  │           │    │ confidence   │    │   ticket   │         │
│  │           │    │ > threshold  │    │ - notify   │         │
│  │           │    │              │    │   legal    │         │
│  └──────────┘    └──────────────┘    └──────────┘           │
│                         │                                     │
│                  ┌──────▼──────┐                             │
│                  │ XSOAR       │                             │
│                  │ Playbook:   │                             │
│                  │ Sentiqra    │                             │
│                  │ Phishing    │                             │
│                  │ Response    │                             │
│                  └─────────────┘                             │
└──────────────────────────────────────────────────────────────┘

Data flow: Sentiqra detection triggers a XSOAR incident via the integration pack → the playbook evaluates the detection group and confidence → if confidence exceeds the threshold, automated actions execute: quarantine email (via Office 365 integration), disable account (via AD integration), create ticket (via ServiceNow integration), and notify the legal team.

Working Code

Actual, tested, copy-pasteable code. Not pseudocode. Not aspirational.

name: Sentiqra
display: Sentiqra Detection
category: Data Enrichment
description: Deterministic harmful-language and threat detection

configuration:
  - display: API Key
    name: apikey
    type: 4  # encrypted
    required: true
  - display: API URL
    name: url
    defaultvalue: https://sentiqra.tech/v1/analyze
    required: true

script:
  type: python
  commands:
    - name: sentiqra-detect
      arguments:
        - name: text
          required: true
          description: Text to analyse
        - name: language
          defaultvalue: en
          description: Language code
      outputs:
        - contextPath: Sentiqra.Harmful
          description: Whether harmful content was detected
        - contextPath: Sentiqra.TopSignal
          description: Top signal code
        - contextPath: Sentiqra.Score
          description: Signal score (0-1)

import requests

def detect_command(client, args):
    text = args["text"]
    language = args.get("language", "en")
    
    response = requests.post(
        f"{client.url}",
        headers={
            "Authorization": f"Bearer {client.apikey}",
            "Content-Type": "application/json",
        },
        json={"text": text, "language": language, "analyzers": ["cybersecurity"]},
    )
    result = response.json()
    signals = result.get("signals", [])
    top = signals[0] if signals else {}
    harmful = bool(top) and top.get("score", 0) >= 0.5
    
    return {
        "Type": 1,
        "Contents": result,
        "ContentsFormat": "json",
        "HumanReadable": (
            f"**Sentiqra Detection Result**\n"
            f"- Harmful: {harmful}\n"
            f"- Top Signal: {top.get('code')}\n"
            f"- Score: {top.get('score')}"
        ),
        "EntryContext": {
            "Sentiqra.Harmful": harmful,
            "Sentiqra.TopSignal": top.get("code"),
            "Sentiqra.Score": top.get("score"),
        },
    }

# Playbook sketch: Sentiqra Phishing Auto-Response
# Trigger: Incident type = "Sentiqra Detection"
# Condition: Sentiqra.TopSignal == "phishing" AND Sentiqra.Score > 0.8
# (Illustrative task flow - adapt conditions: blocks to your XSOAR version)

tasks:
  - name: Quarantine Email
    script: 'office365-mail-quarantine'
    condition: 'Sentiqra.TopSignal == "phishing"'

  - name: Disable Compromised Account
    script: 'ad-disable-account'
    condition: 'Sentiqra.TopSignal == "credential_theft"'

  - name: Create ServiceNow Ticket
    script: 'servicenow-create-ticket'
    fields:
      short_description: 'Sentiqra: {{Sentiqra.TopSignal}} detected'
      priority: 'high'

  - name: Notify Legal Team
    script: 'send-email'
    fields:
      to: 'legal@your-company.com'
      subject: 'Sentiqra Alert: {{Sentiqra.TopSignal}}'
      body: 'Automated detection triggered. See incident {{incident.id}}'

Security & Compliance Posture

• ✓
  NIS2 Article 21 - Incident Response: Automated response playbooks can help contain incidents within minutes of detection, providing evidence relevant to incident response timeline requirements.
• ✓
  SOC 2 Type II - CC7.3 - Anomaly Response: Playbooks provide documented, repeatable response procedures for Sentiqra detections, producing evidence relevant to incident response controls.
• ✓
  Audit Trail: XSOAR records every playbook execution with timestamps, inputs, outputs, and operator actions - providing a complete audit trail for compliance evidence.
• ✓
  Importable Pack: The XSOAR pack can be imported directly into any XSOAR instance, reducing deployment time from weeks to minutes.
• ✓
  MITRE ATT&CK Alignment: Playbook conditions can be mapped to MITRE ATT&CK techniques for alignment with industry-standard threat frameworks.

Deployment Notes