Palo Alto Cortex XDR

Palo Alto Cortex XDR is the detection and response app that natively integrates network, endpoint and cloud data to stop sophisticated attacks. Cortex XDR accurately detects threats with behavioral analytics and reveals the root cause to speed up investigations.

Integration: API

Tables: Detections, Incidents

Palo Alto Cortex XDR Configuration

To enable the integration, an API key and other information is needed, including the API Key, API Key ID, and FQDN.

Create API Key

• In Cortex XDR, navigate to Settings > Configurations > Integrations > API Keys.

• Select + New Key.

  

• Choose the security level: Standard.

• Provide a comment that describes the purpose for the API key, if desired.

• Select the Role: Viewer.

• Click on the Generate button.

  

• Copy the API key, and then click Done. This value represents your unique API_SECRET_KEY.

Note:

You will not be able to view the API Key again after you complete this step. Ensure that you copy it before closing the notification.

Refer Get Started with Cortex XDR APIs for detailed information.

Get API Key ID

• In the API Keys table, locate the ‘ID’ field.

• Note your corresponding ID number. This value represents the API_ACCESS_KEY.

  

Get FQDN value

• Select your API key and click on Copy API URL. This defines the FQDN of your API endpoint. For example you need to fill the FQDN value, api name and the name of the call in the https://api-{fqdn}/public_api/v1/{name of api}/{name of call}/

• The Palo Alto Cortex XDR will be supporting the below mentioned APIs.

  • https://api-{fqdn}/public_api/v1/incidents/get_incidents

  • https://api-{fqdn}/public_api/v1/alerts/get_alerts/

DataBee Configuration

• To configure the Data Source, login into the Databee UI and click on Add New Data Source. Search and click on the Palo Alto Cortex XDR as mentioned below.

  

• Click on the API Ingest option for the collection method.

  

• Provide the name of the Data Source and other relevant information as mentioned below.

  

• In the endpoint configuration page, give the FQDN value which can be found in the previous step of the API Key generation. Select the Custom API Key as ‘Authorization Method’. Paste the API Key ID in ‘Access Key’ field which can be found in the API Keys section in Palo Alto Cortex XDR dashboard. Paste the API Key in ‘Secret Key’ field as mentioned below.