|
1 | | -# Agent Check: palo_alto_cortex_xdr |
| 1 | +# Palo Alto Cortex XDR Integration For Datadog |
2 | 2 |
|
3 | 3 | ## Overview |
4 | 4 |
|
5 | | -This check monitors [Palo Alto Cortex XDR][1]. |
| 5 | +[Palo Alto Cortex XDR][1] is a comprehensive detection and response platform that provides advanced threat protection across endpoints, networks, and cloud environments. It integrates endpoint protection, network security, and analytics to offer real-time visibility and response capabilities and combat sophisticated cyber threats effectively. |
6 | 6 |
|
7 | | -## Setup |
| 7 | +This integration ingests the following logs: |
| 8 | + |
| 9 | +- Incident |
| 10 | +- Alert |
8 | 11 |
|
9 | | -### Installation |
| 12 | +The Palo Alto Cortex XDR integration seamlessly collect the data of Palo Alto Cortex XDR logs using REST APIs. |
| 13 | +Before ingesting the data, it normalizes and enriches the logs, ensuring a consistent data format and enhancing information content for downstream processing and analysis. The integration provides insights into incidents and alerts using out-of-the-box dashboards. |
10 | 14 |
|
11 | | -The Palo Alto Cortex XDR check is included in the [Datadog Agent][2] package. |
12 | | -No additional installation is needed on your server. |
| 15 | +## Setup |
13 | 16 |
|
14 | 17 | ### Configuration |
15 | 18 |
|
16 | | -1. List of steps to configure this integration |
| 19 | +#### Get Credentials of Palo Alto Cortex XDR |
| 20 | + |
| 21 | +#### Steps to create API key |
| 22 | + |
| 23 | +1. Sign into your **Palo Alto Cortex XDR** instance. |
| 24 | +2. Navigate to **Settings** > **Configurations** > **Integrations** > **API Keys**. |
| 25 | +3. Click on **New Key**. |
| 26 | +4. Choose the type of API key based on your desired security level, **Advanced** or **Standard**. |
| 27 | +5. If you want to define a time limit on the API key authentication, check **Enable Expiration Date**, and then select the **expiration date and time**. Navigate to **Settings** > **Configurations** > **Integrations** > **API Keys** to track the **Expiration Time** setting for each API key. |
| 28 | +6. Provide a comment that describes the purpose for the API key, if desired. |
| 29 | +7. Select the desired level of access for this key from existing **Roles**, or you can select **Custom** to set the permissions granularly. |
| 30 | +8. Click **Generate** to generate the API key. |
| 31 | +9. Copy the API key, and then click **Done**. This value represents your unique **Authorization:{key}** |
| 32 | + |
| 33 | +#### Steps to get Cortex XDR API Key ID |
| 34 | + |
| 35 | +1. In the API Keys table, locate the ID field. |
| 36 | +2. Note your corresponding ID number. This value represents the **x-xdr-auth-id:{key_id}** token. |
| 37 | + |
| 38 | +#### Steps to get FQDN |
17 | 39 |
|
18 | | -### Validation |
| 40 | +1. Right-click your API key and select **View Examples**. |
| 41 | +2. Copy the **CURL Example** URL. The example contains your unique **FQDN**. |
19 | 42 |
|
20 | | -Steps to validate integration is functioning as expected |
| 43 | +#### Palo Alto Cortex XDR DataDog Integration Configuration |
| 44 | + |
| 45 | +Configure the Datadog endpoint to forward Palo Alto Cortex XDR logs to Datadog. |
| 46 | + |
| 47 | +1. Navigate to `Palo Alto Cortex XDR`. |
| 48 | +2. Add your Palo Alto Cortex XDR credentials. |
| 49 | + |
| 50 | +| Palo Alto Cortex XDR Parameters | Description | |
| 51 | +| ------------------------------- | ------------ | |
| 52 | +| API key | The API key from Palo Alto Cortex XDR. | |
| 53 | +| API Key ID | The auth id from Palo Alto Cortex XDR. | |
| 54 | +| FQDN | The FQDN from Palo Alto Cortex XDR. It is the `baseUrl` part of `baseUrl/public_api/v1/{name of api}/{name of call}/` | |
21 | 55 |
|
22 | 56 | ## Data Collected |
23 | 57 |
|
24 | | -### Metrics |
| 58 | +### Logs |
25 | 59 |
|
26 | | -The Palo Alto Cortex XDR integration does not include any metrics. |
| 60 | +The Palo Alto Cortex XDR integration collects and forwards Palo Alto Cortex XDR Incident and alert logs to Datadog. |
27 | 61 |
|
28 | | -### Service Checks |
| 62 | +### Metrics |
29 | 63 |
|
30 | | -The Palo Alto Cortex XDR integration does not include any service checks. |
| 64 | +The Palo Alto Cortex XDR integration does not include any metrics. |
31 | 65 |
|
32 | 66 | ### Events |
33 | 67 |
|
34 | 68 | The Palo Alto Cortex XDR integration does not include any events. |
35 | 69 |
|
36 | | -## Troubleshooting |
| 70 | +## Support |
37 | 71 |
|
38 | | -Need help? Contact [Datadog support][3]. |
| 72 | +For further assistance, contact [Datadog Support][2]. |
39 | 73 |
|
40 | | -[1]: **LINK_TO_INTEGRATION_SITE** |
41 | | -[2]: https://app.datadoghq.com/account/settings#agent |
42 | | -[3]: https://docs.datadoghq.com/help/ |
| 74 | +[1]: https://docs-cortex.paloaltonetworks.com/p/XDR |
| 75 | +[2]: https://docs.datadoghq.com/help/ |
0 commit comments