Integrate IoT Security with Cortex XDR
Table of Contents
Integrate IoT Security with Cortex XDR
Integrate IoT Security through Cortex XSOAR with Cortex XDR.
Cortex is a detection
and response app that integrates endpoint, network, and cloud data
to detect threats and uncover the cause to accelerate investigations.
XDR collects endpoint data from agents installed on IT devices such
as laptops and desktops, network data from next-generation firewalls,
cloud data from Prisma Access and GlobalProtect, and additional
data from integrated third-party firewalls.
By integrating IoT Security with Cortex XDR, IoT Security can
import attributes for devices in its inventory.
IoT Security can receive the following device attributes through
an integration with Cortex XDR:
- Endpoint Detection Response (EDR) isolation status – Whether or not a device, or endpoint, is being isolated, a condition in which all network access for the isolated device is blocked except for traffic to Cortex XDR
- EDR operational status – The status of the protection that a Cortex XDR agent is providing the device hosting it: Protected, Partially Protected, or Unprotected
- EDR group name – The name of the endpoint group to which a device is assigned
- OS type – The type of operating system running on an endpoint
- OS version – The version of the operating system
You can display columns on the Devices page for EDR isolation
status, EDR operational status, and EDR group name. For example,
the EDR Isolation Status column is shown below.
You can also see the three EDR attributes on the Device Details
page.
If there is a conflict between IoT Security and XDR about
the OS type and version of a device, IoT Security defers to the information
from XDR. Because XDR has an agent running on each device, it is
considered as the more authoritative source.
Integrating with Cortex
XDR requires either a full-featured Cortex XSOAR server or the purchase
and activation of an IoT Security
third-party integration add-on license, which comes with a free cohosted Cortex XSOAR instance. The basic plan
includes a license for three integration add-ons, one of which can be used for Cortex
XDR. The advanced plan includes a license for all supported third-party
integrations.
For information about importing alerts and device information
from IoT Security into Cortex XDR, see Ingest Alerts and Assets from PAN . To accomplish this, Cortex XDR accesses the IoT Security API. This does not require an IoT Security Third-party
Integrations Add-on license and is a different type of integration
from the one described here.