Skip to main content

Palo Alto Cortex XDR

Strengthen your endpoint security with JupiterOne's Palo Alto Cortex XDR integration. Our guide offers detailed instructions on setting up the integration and utilizing its comprehensive data model to gain visibility into your device and endpoint security data. Learn how the integration can help you detect potential security threats and streamline your security operations.

Installation​

info

Before you begin, create an API key in Palo Alto Cortex XDR. See the Cortex XDR documentation for step-by-step instructions.

To install the Palo Alto Cortex XDR integration in JupiterOne, navigate to the Integrations tab and select Palo Alto Cortex XDR. Click New Instance to begin.

Prerequisites​

Creating a Palo Alto Cortex XDR integration instance requires the following:

  • A Cortex XDR API key and API key ID. In Cortex XDR, navigate to Settings > Configurations > Integrations > API Keys and generate a new key.
    • Select the Standard security level.
    • Assign the appropriate role:
      • To ingest Users, User Groups, and Roles, assign the Instance Administrator role.
      • For all other data, the Viewer role is sufficient.
    • After generation, copy the API key value and note the numeric API Key ID shown in the table. Your tenant Host is the FQDN displayed in the Cortex XDR top-right URL bar (for example, tenant-id.xdr.us.paloaltonetworks.com).
  • Your Host (the Cortex XDR tenant FQDN, for example mytenant.xdr.us.paloaltonetworks.com)
  • Your API Key (the generated key value)
  • Your API Key ID (the numeric ID displayed next to the key in the API Keys table)

Create an instance​

  1. Sign in to Cortex Gateway.
  2. Select the tenant you want to integrate.
  3. In the Cortex XDR console, navigate to Settings > Configurations > Integrations > API Keys.
  4. Click New Key. Under Security Level choose Standard; under Role choose Instance Administrator (for full data access) or Viewer (for alerts, incidents, and endpoints only).
  5. Click Generate. Copy the API key — it is shown only once.
  6. Note the API Key ID (the numeric value in the table) and the FQDN from your browser's address bar.
  7. In JupiterOne, enter the Host, API Key, and API Key ID in the corresponding fields, then click Create.

Data Volume Configuration​

Ingestion Windows​

Limit how far back the integration looks when ingesting incidents and alerts. Narrower windows reduce ingestion volume.

FieldDescriptionDefault
Incident Ingestion WindowHow far back (in days) to look for incidents based on their last modification time.90 days
Alert Ingestion WindowHow far back (in days) to look for alerts based on their detection timestamp.90 days

Available options for both fields: 1 day, 7 days, 30 days, 60 days, 90 days.

Data Filtering Options​

Control which incidents are ingested by status.

FieldDescriptionDefault
Incident StatusRestrict ingestion to incidents in specific statuses. When left at the default, only open incidents are ingested.New, Under Investigation

Available status options: New, Under Investigation, Resolved (auto-resolve), Resolved (duplicate incident), Resolved (false positive), Resolved (true positive), Resolved (known issue), Resolved (threat handled), Resolved (security testing), Resolved (other).

Next steps​

Your integration is now configured. It will run on the polling interval you selected and populate data in JupiterOne. See the Instance management guide for more details on working with integration instances.