Set up IoT Security and Cortex XSOAR for SoftPro Medusa Integration

Table of Contents

Set up IoT Security and Cortex XSOAR to integrate with SoftPro Medusa.

Where Can I Use This?	What Do I Need?
IoT Security (Managed by IoT Security)	IoT Security subscription for an advanced IoT Security product (Enterprise Plus, Industrial OT, or Medical) One of the following Cortex XSOAR setups: An IoT Security Third-party Integration Add-on license that includes a cohosted, limited-featured Cortex XSOAR instance AND A Cortex XSOAR Engine (on-premises integration) A full-featured Cortex XSOAR server

Configure Cortex XSOAR with a SoftPro Medusa integration instance and jobs to sync device details with SoftPro Medusa or send alerts and vulnerabilities to SoftPro Medusa. You can set the jobs to run at regular intervals or on-demand. The configuration requires the following information from SoftPro Medusa:

Server URL or hostname for a SoftPro Medusa instance
Server port for connecting to SoftPro Medusa
Username and password of the account that Cortex XSOAR uses when logging in to SoftPro Medusa

The username and password might be different if you have multiple SoftPro Medusa instances or multiple IoT Security tenants. Work with the SoftPro Medical Solutions team to provision the correct login credentials for each integration instance.

To set up IoT Security to integrate through a cloud-hosted Cortex XSOAR instance with an on-premises SoftPro Medusa instance, you must also add a Cortex XSOAR engine to your network.

Cortex XSOAR Engine Installation

An on-premises Cortex XSOAR engine facilitates communications between the Cortex XSOAR cloud and SoftPro Medusa. Although it's possible to install an Cortex XSOAR engine on machines running Windows, macOS, and Linux operating systems, only an engine on a Linux machine supports IoT Security integrations. For more information about operating systems and hardware requirements, see the Cortex XSOAR Administrator Guide.

We recommend downloading the Cortex XSOAR engine using the shell installer script and installing it on a Linux machine. This simplifies the deployment by automatically installing all required dependencies and also enables remote engine upgrades.

The on-premises firewall must allow the Cortex XSOAR engine to form HTTPS connections on TCP port 443 to the Cortex cloud at https://<your-domain>.iot.demisto.live/. You can see the URL of your Cortex XSOAR instance when you log in to the IoT Security portal and click Integrations and then click Launch Cortex XSOAR. It’s visible in the address bar of the web page displaying the Cortex XSOAR interface.

To create an Cortex XSOAR engine, access the Cortex XSOAR interface (from the IoT Security portal, click Integrations and then click Launch Cortex XSOAR). In the Cortex XSOAR UI, click SettingsEngines+ Create New Engine. Choose Shell as the type.

For Cortex XSOAR engine installation instructions, see Engine Installation.

For help troubleshooting Cortex XSOAR engines, including installations, upgrades, connectivity, and permissions, see Troubleshoot Engines and Troubleshoot Integrations Running on Engines.

Configure IoT Security and Cortex XSOAR

Log in to IoT Security, and from there access the SoftPro Medusa integration settings in Cortex XSOAR.
1. Log in to IoT Security and select Integrations.
2. Launch Cortex XSOAR from the IoT Security portal.
  
  IoT Security uses Cortex XSOAR to integrate with SoftPro Medusa. The settings you must configure are in the Cortex XSOAR interface. When you Launch Cortex XSOAR, the Cortex XSOAR interface opens in a new browser tab or window.
3. Find the SoftPro Medusa integration.
  
  Click Settings in the left navigation menu. Search for SoftPro Medusa to locate it among other integrations.
Configure the SoftPro Medusa integration instance.
1. Click Add instance to open the settings panel.
2. In the settings panel, configure the following settings:
  Name: Use the default name of the instance or enter a new one.
  Server URL or Hostname: Enter the domain URL of a cloud-hosted SoftPro Medusa instance or the FQDN of an on-premises SoftPro Medusa server.
  Server Port: Enter the server port for the connection. The default port is 443.
  Username: Enter the username of the SoftPro Medusa account for Cortex XSOAR to use when connecting to SoftPro Medusa.
  Password: Enter the password associated with the user account.
  Customer or Tenant ID: Enter the customer or tenant ID of your IoT Security tenant.
  Use single engine: When using a cloud-based Cortex XSOAR instance and an on-premises SoftPro Medusa server, choose the Cortex XSOAR engine that you want to communicate with the SoftPro Medusa server.
3. When finished, click Test or Test resultsRun test to test the integration instance.
  
  If the test is successful, a Success message appears. If not, check that the settings were entered correctly, and then test the configuration again.
4. After the test succeeds, click Save & exit to save your changes and close the settings panel.
Create a job for Cortex XSOAR to send and receive information from SoftPro Medusa.

Depending on whether you want to sync device details between IoT Security and SoftPro Medusa, or send alert or vulnerability tickets to SoftPro Medusa, select the appropriate playbook when configuring the job. You can create multiple jobs if you want to use different playbooks or if you have multiple integration instances.
1. Click Jobs in the left navigation menu, and then click New Job at the top of the page to create a new Cortex XSOAR job.
2. Set up a new Cortex XSOAR job by configuring the following settings in the New Job panel:
  Recurring: Select this if you want to periodically run the job. Clear it if you want to run the job on-demand.
  Every: If you select Recurring, enter a number and set the interval value (Minutes, Hours, Days, or Weeks) and select the days on which to run the job. If you don't select specific days, then the job will run every day by default. This determines how often Cortex XSOAR queries SoftPro Medusa to send and receive information.
  Name: Enter a name for the job.
  Playbook: Select the playbook depending on the type of job you're configuring. You can select one of the following playbooks when integrating with SoftPro Medusa:
  Sync Devices from SoftPro Medusa - PANW IoT 3rd Party Integration
  Send Alert to SoftPro Medusa - PANW IoT 3rd Party Integration
  Send Vulnerability to SoftPro Medusa - PANW IoT 3rd Party Integration
  Integration Instance Name: Enter the instance name of the integration instance you created.
3. Click Create new job and verify that the job appears in the Jobs list.
Enable the job and run it.
1. Check the Job Status for the job you created. If it's Disabled, select its check box and then click Enable.
2. If you enabled the sync job, keep the check box selected and click Run now. The Run Status changes from Idle to Running.
  
  If you selected Recurring, Cortex XSOAR queries SoftPro Medusa at the defined interval and sends information to or from IoT Security, depending on the job's playbook.
  
  If you cleared Recurring, Cortex XSOAR immediately queries SoftPro Medusa.
Return to the IoT Security portal and check the status of the SoftPro Medusa integration.
An integration instance can be in one of the following four states, which IoT Security displays in the Status column on the Integrations page:
- Disabled — either the integration was configured but intentionally disabled or it was never configured and a job that references it is enabled and running.
- Error — the integration was configured and enabled but is not functioning properly, possibly due to a configuration error or network condition.
- Inactive — the integration was configured and enabled but no job has run for at least the past 60 minutes.
- Active — the integration was configured and enabled and is functioning properly.
When you see that the status of an integration instance is Active, its setup is complete.