Device Security
Integrate Device Security with Cortex XDR
Table of Contents
Integrate Device Security with Cortex XDR
Integrate Device Security through Cortex XSOAR with
Cortex XDR.
| Where Can I Use This? | What Do I Need? |
|---|---|
|
One of the following subscriptions:
One of the following Cortex XSOAR setups:
|
Cortex XDR is a detection
and response app that integrates endpoint, network, and cloud data
to detect threats and uncover the cause to accelerate investigations.
XDR collects endpoint data from: agents installed on IT devices such
as laptops and desktops; network data from next-generation firewalls;
cloud data from Prisma Access and GlobalProtect™; and additional
data from integrated third-party firewalls.
By integrating Device Security with Cortex XDR, Device Security can
import attributes for devices in its inventory. You can integrate Device Security
with Cortex XDR in two ways:
- Direct API integration – Integrating with Cortex XDR through a direct API integration does not require a Third-party Add-on License.
- Integration through Cortex XSOAR – Integrating with Cortex XDR through Cortex XSOAR requires either a full-featured Cortex XSOAR server or the purchase and activation of an Device Security third-party integration add-on license, which comes with a free cohosted Cortex XSOAR instance. The basic plan includes a license for three integration add-ons, one of which can be used for Cortex XDR. The advanced plan includes a license for all supported third-party integrations.The diagram below illustrates how Device Security integrates with Cortex XDR through Cortex XSOAR.
![]()
This integration describes how to import information from Cortex XDR
into Device Security. For information about importing alerts and
device information from Device Security into Cortex XDR, see
Ingest Alerts and Assets from Device Security.
Device Security can receive the following device attributes through
an integration with Cortex XDR:
- Endpoint Detection Response (EDR) isolation status – Whether or not a device, or endpoint, is being isolated, a condition in which all network access for the isolated device is blocked except for traffic to Cortex XDR
- EDR operational status – The status of the protection that a Cortex XDR agent is providing the device hosting it: Protected, Partially Protected, or Unprotected
- EDR group name – The name of the endpoint group to which a device is assigned
- OS type – The type of operating system running on an endpoint
- OS version – The version of the operating system
You can display columns on the Devices page for EDR isolation
status, EDR operational status, and EDR group name. For example,
the EDR Isolation Status column is shown below.
You can also see the three EDR attributes on the Device Details
page.
If there is a conflict between Device Security and XDR about
the OS type and version of a device, Device Security defers to the information
from XDR. Because XDR has an agent running on each device, it's
considered as the more authoritative source.