Skip to main content

Palo Alto Cortex XDR

Strengthen your endpoint security with JupiterOne's Palo Alto Cortex XDR integration. Our guide offers detailed instructions on setting up the integration and utilizing its comprehensive data model to gain visibility into your device and endpoint security data. Learn how the integration can help you detect potential security threats and streamline your security operations.

Installation​

info

Before you begin, create an API key in Palo Alto Cortex XDR. See the Cortex XDR documentation for step-by-step instructions.

To install the Palo Alto Cortex XDR integration in JupiterOne, navigate to the Integrations tab and select Palo Alto Cortex XDR. Click New Instance to begin.

Prerequisites​

Creating a Palo Alto Cortex XDR integration instance requires the following:

  • A Cortex XDR API key and API key ID. In Cortex XDR, navigate to Settings > Configurations > Integrations > API Keys and generate a new key.
    • Select the Standard security level.
    • Assign a role with access to the data you want to ingest. To ingest Users, User Groups, and Roles, the key requires the Instance Administrator role.
    • After generation, copy the API key value and note the numeric API Key ID shown in the table. Your tenant Host is the FQDN displayed in the Cortex XDR top-right URL bar (for example, tenant-id.xdr.us.paloaltonetworks.com).
  • Your Host (the Cortex XDR tenant FQDN, for example mytenant.xdr.us.paloaltonetworks.com)
  • Your API Key (the generated key value)
  • Your API Key ID (the numeric ID displayed next to the key in the API Keys table)

Create an instance​

  1. Sign in to Cortex Gateway.
  2. Select the tenant you want to integrate.
  3. In the Cortex XDR console, navigate to Settings > Configurations > Integrations > API Keys.
  4. Click New Key. Under Security Level choose Standard; under Role choose a role with access to the data you want to ingest (Instance Administrator is required to ingest Users, User Groups, and Roles).
  5. Click Generate. Copy the API key — it is shown only once.
  6. Note the API Key ID (the numeric value in the table) and the FQDN from your browser's address bar.
  7. In JupiterOne, enter the Host, API Key, and API Key ID in the corresponding fields, then click Create.

Data Volume Configuration​

Ingestion Windows​

Limit how far back the integration looks when ingesting incidents, alerts, and Cortex Cloud issues and cases. Narrower windows reduce ingestion volume.

FieldDescriptionDefaultOptions
Incident Ingestion WindowHow far back to look for incidents based on their last modification time.90 days30 days, 90 days, 180 days, 365 days
Alert Ingestion WindowHow far back to look for alerts based on their detection time.90 days30 days, 90 days, 180 days, 365 days
Cortex Cloud Issue and Case Ingestion WindowHow far back to look for Cortex Cloud issues and cases based on their last modification time. Applies when the Cortex Cloud issues or cases ingestion source is enabled.90 days30 days, 90 days, 180 days, 365 days, All (no window)

Data Filtering Options​

Control which incidents are ingested by status.

FieldDescriptionDefaultOptions
Incident StatusRestrict ingestion to incidents in specific statuses. When left at the default, New and Under Investigation incidents are ingested.New, Under InvestigationNew, Under Investigation, Resolved

Next steps​

Your integration is now configured. It will run on the polling interval you selected and populate data in JupiterOne. See the Instance management guide for more details on working with integration instances.