Palo Alto Cortex XDR
Collect Palo Alto Cortex XDR alerts, incidents and investigations
The Palo Alto Cortex XDR connector allows you to integrate your threat detection and response data into OverView.
Overview
The Palo Alto Cortex XDR connector enables you to collect the following information:
- Endpoint inventory
- XDR alerts and incidents
- Active investigations
Prerequisites
- Access to Palo Alto Cortex XDR
- API keys configured in Cortex XDR
- Appropriate permissions for API access
Information to provide in OverView
| Field | Description |
|---|---|
| API Key ID | Cortex XDR API key ID |
| API Key | Cortex XDR API key |
| API URL | Cortex XDR API URL (e.g., https://api-{region}.xdr.paloaltonetworks.com) |
Parameters
These parameters are optional. Leave them at their default value unless you have a specific reason to change them.
| Parameter | Description | Default |
|---|---|---|
| Use Advanced Authentication | Use advanced authentication with nonce, timestamp and SHA256 hash | Disabled |
| Domain | Import only endpoints belonging to that domain | — |
Configuration
Generate Cortex XDR API keys
- Log in to your Palo Alto Cortex XDR console.
- Navigate to Settings > Configuration > API Keys.
- Click Create New API Key.
- Select the Advanced tab for more options.
- Assign a descriptive name (e.g., OverView Connector).
- Configure the required permissions:
- Incident management: Read
- Alert management: Read
- Endpoint administration: Read
- Click Save and note the API Key ID and API Key.
- Also note the API URL corresponding to your region.
Configure the connector in OverView
- In OverView, go to Data Sources Settings > Sources.
- Select Palo Alto Cortex XDR and click Configure.
- Fill in the API Key ID, API Key, and API URL.
- Click Save Configuration.
Required Permissions
The API keys must have the following minimum permissions:
- Incident management: Read incidents and alerts
- Alert management: XDR alert access
- Endpoint administration: Read endpoint inventory
Alternative: file import through DropPoint
The API access described above is the recommended method for this connector. Where it is not available (a segregated network, a version or licence without API, an export you already produce), OverView accepts file exports, to be uploaded to the bucket dedicated to Palo Alto Cortex XDR.
Bucket : s3://cortex/
Example : s3://cortex/export.csv
The procedure is described in the OverView DropPoint guide: generating credentials, configuring the client, then sending files from the OverView web interface, the AWS CLI or an SDK. Its examples come pre-filled with this bucket when you follow this link.