Set up IoT Security and Cortex XSOAR for Extreme Networks ExtremeCloud IQ Site Engine Integration

Configure IoT Security and Cortex XSOAR

1. Log in to IoT Security, and from there access the ExtremeCloud IQ Site Engine integration settings in Cortex XSOAR.

   1. Log in to IoT Security and select Integrations.
   2. Launch Cortex XSOAR from the IoT Security portal.

      When you Launch Cortex XSOAR, the Cortex XSOAR interface opens in a new browser tab or window.
   3. Click Settings, and on the integration page search for ExtremeCloud IQ Site Engine to locate it among other integrations.
2. Configure the ExtremeCloud IQ Site Engine integration instance.

   1. Click Add instance to open the settings panel.
   2. In the settings panel, configure the following settings:

      • Name: Use the default name of the instance or enter a new one.
      • Site Engine URL: Enter the domain URL of the ExtremeCloud IQ Site Engine instance.
      • Port: Enter the port to access your ExtremeCloud IQ Site Engine instance. The default port is 8443.
      • Client ID: Enter the client ID for ExtremeCloud IQ Site Engine.
      • Client Secret: Enter the client secret for ExtremeCloud IQ Site Engine.
      • Optional Quarantine End-System(MAC) Group: If you want to use a different ExtremeCloud IQ Site Engine end-system group to quarantine devices, enter the end-system group name. By default, the integration uses the Blacklist end-system group to quarantine devices.
      • Use single engine: When using a cloud-based Cortex XSOAR instance and an on-premises ExtremeCloud IQ Site Engine server, choose the Cortex XSOAR engine that you want to communicate with the ExtremeCloud IQ Site Engine server.

      

   3. When finished, click Test or Test resultsRun test to test the integration instance.

      If the test is successful, a Success message appears. If not, check that the settings were entered correctly, and then test the configuration again.

      

   4. After the test succeeds, click Save & exit to save your changes and close the settings panel.
3. Create a job for Cortex XSOAR to send information to or receive information from ExtremeCloud IQ Site Engine.

   Depending on whether you want to import or send device details, select the appropriate playbook when configuring the job. If you want to import devices and also send devices, you must create separate jobs, one for each playbook. You can create multiple jobs if you want to use different playbooks or if you have multiple integration instances.

   1. Click Jobs in the sidebar, and then click New Job to create a new Cortex XSOAR job.
   2. Configure the following settings in the New Job panel:

      • Optional Recurring: Select this if you want to periodically run the job. Clear it if you want to run the job on-demand.
      • Optional Every: If you selected Recurring, enter a number and set the interval value (Minutes, Hours, Days, or Weeks) and select the days on which to run the job. If you don't select specific days, then the job will run every day by default. This determines how often Cortex XSOAR queries ExtremeCloud IQ Site Engine to send and receive information.
        You can configure Queue Handling to determine what happens if a new job starts while an old job is still running.
      • Name: Enter a name for the job.
      • Playbook: Select the playbook depending on the type of job you're configuring. You can select one of the following playbooks when integrating with ExtremeCloud IQ Site Engine:
        • Bulk Export to ExtremeCloud IQ Site Engine - PANW IoT 3rd Party Integration
        • Import ExtremeCloud IQ Site Engine assets to PANW IoT cloud
        • Incremental Export to ExtremeCloud IQ Site Engine - PANW IoT 3rd Party Integration

        

      • Integration Instance Name: Enter the instance name of the integration instance you created.
      • Export job ExtremeCloud IQ Site Engine End-System Custom Attribute: You can export up to four attributes as ExtremeCloud IQ Site Engine custom attributes.
        By default, the export job sends the following attributes: profile, category, risk score, and vendor.
        • Under PANW IoT Attribute, select the IoT Security attribute that you want to export from the drop-down.
        • Under PANW IoT Attribute Key, enter a name to help you identify the attribute in ExtremeCloud IQ Site Engine. The PANW IoT Attribute Key is appended to the attribute value exported to ExtremeCloud IQ Site Engine.

        

      • Bulk export playbook Polling Duration in days: Enter the time range in days that you want to get device information from IoT Security to send to ExtremeCloud IQ Site Engine. The default polling duration is a look-back of 30 days.
   3. Click Create new job and verify that the job appears in the Jobs list.
4. Enable the job and run it.

   1. Check the Job Status for the job you created. If it's Disabled, select its check box and then click Enable.
   2. If you enabled the export or import jobs, keep the check box selected and click Run now. The Run Status changes from Idle to Running.

      If you selected Recurring, Cortex XSOAR queries ExtremeCloud IQ Site Engine at the defined interval and sends information to IoT Security.

      If you cleared Recurring, Cortex XSOAR immediately queries ExtremeCloud IQ Site Engine.
5. Return to the IoT Security portal and check the status of the ExtremeCloud IQ Site Engine integration.

   An integration instance can be in one of the following four states, which IoT Security displays in the Status column on the Integrations page:

   • Disabled — either the integration was configured but intentionally disabled or it was never configured and a job that references it is enabled and running.
   • Error — the integration was configured and enabled but is not functioning properly, possibly due to a configuration error or network condition.
   • Inactive — the integration was configured and enabled but no job has run for at least the past 60 minutes.
   • Active — the integration was configured and enabled and is functioning properly.

   When you see that the status of an integration instance is Active, its setup is complete.