: Integrate IoT Security with Cortex XDR
Focus
Focus

Integrate IoT Security with Cortex XDR

Table of Contents

Integrate
IoT Security
with Cortex
XDR

Integrate
IoT Security
through
Cortex XSOAR
with
Cortex
XDR
.
Cortex is a detection and response app that integrates endpoint, network, and cloud data to detect threats and uncover the cause to accelerate investigations.
XDR
collects endpoint data from agents installed on IT devices such as laptops and desktops, network data from next-generation firewalls, cloud data from Prisma Access and GlobalProtect, and additional data from integrated third-party firewalls.
By integrating
IoT Security
with
Cortex
XDR
,
IoT Security
can import attributes for devices in its inventory.
IoT Security
can receive the following device attributes through an integration with
Cortex
XDR
:
  • – Whether or not a device, or endpoint, is being isolated, a condition in which all network access for the isolated device is blocked except for traffic to
    Cortex
    XDR
  • – The status of the protection that a
    Cortex
    XDR
    agent is providing the device hosting it: Protected, Partially Protected, or Unprotected
  • – The name of the endpoint group to which a device is assigned
  • OS type
    – The type of operating system running on an endpoint
  • OS version
    – The version of the operating system
You can display columns on the Devices page for EDR isolation status, EDR operational status, and EDR group name. For example, the EDR Isolation Status column is shown below.
You can also see the three EDR attributes on the Device Details page.
If there is a conflict between
IoT Security
and
XDR
about the OS type and version of a device,
IoT Security
defers to the information from
XDR
. Because
XDR
has an agent running on each device, it is considered as the more authoritative source.
Integrating with
Cortex
XDR
requires either a full-featured Cortex XSOAR server or the purchase and activation of an
IoT Security
third-party integration add-on license, which comes with a free cohosted Cortex XSOAR instance. The basic plan includes a license for three integration add-ons, one of which can be used for
Cortex
XDR
. The advanced plan includes a license for all supported third-party integrations.
For information about importing alerts and device information from
IoT Security
into
Cortex
XDR
, see Ingest Alerts and Assets from PAN . To accomplish this,
Cortex
XDR
accesses the
IoT Security
API. This does not require an
IoT Security
Third-party Integrations Add-on license and is a different type of integration from the one described here.

Recommended For You