Set up IoT Security and XSOAR for SIEM Integration
Table of Contents
Expand all | Collapse all
-
- Integrate IoT Security with AIMS
- Set up AIMS for Integration
- Set up IoT Security and XSOAR for AIMS Integration
- Send Work Orders to AIMS
- Integrate IoT Security with Microsoft SCCM
- Set up Microsoft SCCM for Integration
- Set up IoT Security and XSOAR for SCCM Integration
- Integrate IoT Security with Nuvolo
- Set up Nuvolo for Integration
- Set up IoT Security and XSOAR for Nuvolo Integration
- Send Security Alerts to Nuvolo
- Send Vulnerabilities to Nuvolo
- Integrate IoT Security with ServiceNow
- Set up ServiceNow for Integration
- Set up IoT Security and XSOAR for ServiceNow Integration
- Send Security Alerts to ServiceNow
- Send Vulnerabilities to ServiceNow
-
- Integrate IoT Security with Cortex XDR
- Set up Cortex XDR for Integration
- Set up IoT Security and XSOAR for XDR Integration
- Integrate IoT Security with CrowdStrike
- Set up CrowdStrike for Integration
- Set up IoT Security and XSOAR for CrowdStrike Integration
- Integrate IoT Security with Tanium
- Set up Tanium for Integration
- Set up IoT Security and XSOAR for Tanium Integration
-
- Integrate IoT Security with Aruba Central
- Set up Aruba Central for Integration
- Set up IoT Security and XSOAR for Aruba Central Integration
- Integrate IoT Security with Cisco DNA Center
- Set up Cisco DNA Center to Connect with XSOAR Engines
- Set up IoT Security and XSOAR for DNA Center Integration
- Integrate IoT Security with Cisco Meraki Cloud
- Set up Cisco Meraki Cloud for Integration
- Set up IoT Security and XSOAR for Cisco Meraki Cloud
- Integrate IoT Security with Cisco Prime
- Set up Cisco Prime to Accept Connections from IoT Security
- Set up IoT Security and XSOAR for Cisco Prime Integration
- Integrate IoT Security with Network Switches for SNMP Discovery
- Set up IoT Security and Cortex XSOAR for SNMP Discovery
- Integrate IoT Security with Switches for Network Discovery
- Set up IoT Security and Cortex XSOAR for Network Discovery
-
- Integrate IoT Security with Aruba WLAN Controllers
- Set up Aruba WLAN Controllers for Integration
- Set up IoT Security and XSOAR for Aruba WLAN Controllers
- Integrate IoT Security with Cisco WLAN Controllers
- Set up Cisco WLAN Controllers for Integration
- Set up IoT Security and XSOAR for Cisco WLAN Controllers
-
- Integrate IoT Security with Aruba ClearPass
- Set up Aruba ClearPass for Integration
- Set up IoT Security and XSOAR for ClearPass Integration
- Put a Device in Quarantine Using Aruba ClearPass
- Release a Device from Quarantine Using Aruba ClearPass
- Integrate IoT Security with Cisco ISE
- Set up Cisco ISE to Identify IoT Devices
- Set up Cisco ISE to Identify and Quarantine IoT Devices
- Configure ISE Servers as an HA Pair
- Set up IoT Security and XSOAR for Cisco ISE Integration
- Put a Device in Quarantine Using Cisco ISE
- Release a Device from Quarantine Using Cisco ISE
- Apply Access Control Lists through Cisco ISE
- Integrate IoT Security with Cisco ISE pxGrid
- Set up Integration with Cisco ISE pxGrid
- Put a Device in Quarantine Using Cisco ISE pxGrid
- Release a Device from Quarantine Using Cisco ISE pxGrid
- Integrate IoT Security with Forescout
- Set up Forescout for Integration
- Set up IoT Security and XSOAR for Forescout Integration
- Put a Device in Quarantine Using Forescout
- Release a Device from Quarantine Using Forescout
-
- Integrate IoT Security with Qualys
- Set up QualysGuard Express for Integration
- Set up IoT Security and XSOAR for Qualys Integration
- Perform a Vulnerability Scan Using Qualys
- Get Vulnerability Scan Reports from Qualys
- Integrate IoT Security with Rapid7
- Set up Rapid7 InsightVM for Integration
- Set up IoT Security and XSOAR for Rapid7 Integration
- Perform a Vulnerability Scan Using Rapid7
- Get Vulnerability Scan Reports from Rapid7
- Integrate IoT Security with Tenable
- Set up Tenable for Integration
- Set up IoT Security and XSOAR for Tenable Integration
- Perform a Vulnerability Scan Using Tenable
- Get Vulnerability Scan Reports from Tenable
Set up IoT Security and XSOAR for SIEM Integration
IoT Security
and XSOAR for SIEM IntegrationSet up
IoT Security
and Cortex XSOAR
to integrate with
SIEM.To set up
IoT Security
to integrate through Cortex XSOAR
with SIEM,
configure XSOAR with one or more syslog sender integration instances and jobs to
export device data, security alerts, and vulnerabilities from IoT Security
to
the SIEM server. You can configure XSOAR to perform incremental exports
automatically at regular intervals and you can perform bulk exports manually on
demand. The configuration requires the following information about the SIEM
server:- IP address, port number, and protocol of the server
- Digital certificate or username and password of the user account thatCortex XSOARuses when securely connecting to the SIEM server
When using a cohosted XSOAR instance, a cloud-hosted XSOAR server, or an on-premises
XSOAR server that cannot reach part of the network, you must also add a
Cortex XSOAR
engine to your network. This engine receives syslog
notifications in CEF format from IoT Security
and sends them on to the SIEM
server.Cortex XSOAR Engine Installation
Cortex XSOAR
Engine InstallationWhen using a cohosted XSOAR instance, a cloud-hosted XSOAR server, or an on-premises XSOAR server
that cannot reach part of the network, XSOAR initiates connections to the SIEM
server through an on-premises XSOAR engine. Although it's possible to install an
XSOAR engine on machines running Windows, macOS, and Linux operating systems,
only an engine on a Linux machine supports
IoT Security
integrations. For
more information about operating system and hardware requirements, see the Cortex
.We
recommend downloading the XSOAR engine using the shell installer
script and installing it on a Linux machine. This simplifies the
deployment by automatically installing all required dependencies
and also enables remote engine upgrades.
When placing the XSOAR engine on your network, make sure it can reach your SIEM server on port
514 for UDP or TCP or on port 6514 for TLS, or whatever port on which the SIEM
server is configured to listen for incoming syslog event notifications.
You can see the URL of your XSOAR instance when you log in to the . It’s visible in the address bar of the web page displaying the
XSOAR interface. When using a cloud-hosted
IoT Security
portal and
click Integrations
Launch
Cortex XSOAR
Cortex
server or a
server deployed on-premises with an engine, make sure the engine can reach an
equivalent URL on your server. The firewall must also allow the engine to form
HTTPS connections on TCP port 443 to the Cortex
cloud at
https://<your-domain>.iot.demisto.live/.To create an XSOAR engine, access the ). Click . Choose
Cortex XSOAR
interface (from the IoT Security
portal, click Integrations
Launch
Cortex XSOAR
Settings
Engines
+ Create New Engine
Shell
as the type.For installation instructions, see Install .
For
help troubleshooting
Cortex XSOAR
engines, including installations,
upgrades, connectivity, and permissions, see Troubleshoot and Troubleshoot Integrations Running
on Engines.Configure IoT Security and Cortex XSOAR
IoT Security
and Cortex XSOAR
- Log in toIoT Securityand from there access SIEM settings inCortex XSOAR.
- Log in toIoT Securityand then clickIntegrations.
- IoT SecurityusesCortex XSOARto integrate with SIEM, and the settings you must configure to integrate with SIEM are in the XSOAR interface. To access these settings, clickLaunch.Cortex XSOARTheCortex XSOARinterface opens in a new browser window.
- ClickSettingsin the left navigation menu, search forsiemto locate it among other instances.
- Configure the SIEM integration instance.
- For a cloud-based cohosted XSOAR instance, click the SIEM instance settings icon ( ) to open the settings panel for the predefined integration instance: PANW IoT 3rd Party SIEM Integration Instance. If you leave the default name unmodified, the predefined job for incremental updates, which references the default instance name, begins working automatically as soon as you save and enable the integration instance. If you change the default name of the predefined integration instance or if you create a new instance, you must modify the predefined job or create a new job so that it references the name of the instance.For a full-service XSOAR server, clickAdd instanceand create a new integration instance with a unique name.
- Enter the SIEM server IP address and the protocol and port number on which it listens for syslog notification messages.For closed, private networks where the privacy of the syslog messages is assured, you can safely use UDP or TCP on port 514. When sending syslog messages over networks where privacy is a concern, you can use TLS. (XSOAR supports TLS 1.2 and 1.3.) When using TLS, also choose a certificate for authenticating the connection. The certificate can either be signed by a Certificate Authority (CA) or self-signed. For information about using certificates in XSOAR, see HTTPS with a Signed Certificate.
- Set the severity level of the alerts and vulnerabilities for which you wantIoT Securityto send syslog messages.By default, XSOAR sends syslog messages for alerts and vulnerabilities at all severity levels. However, you can remove any severity levels from the lists to exclude them. XSOAR will then only send messages with the alerts and vulnerabilities at the severity levels remaining in the lists.
- Choose the XSOAR engine that you want to communicate with the SIEM server.
- When done, clickTest.XSOAR sends the following test message in Common Event Format (CEF) to the server:<timestamp> <server-ip-address> 1 <utc-timestamp> SysLogLogger 1 - - {‘CEF:0|PaloAltoNetworks|PANWIOT|1.0|Test Connection’}If the test is successful, a Success message appears. If not, check that the settings were entered correctly and then test the configuration again.After the test succeeds, clickSave & exitto save your changes and close the settings panel.
To enable PANW IoT 3rd Party SIEM Integration Instance, clickEnable.Return to theIoT Securityportal and check the status of the Syslog Server integration.XSOAR automatically runs a preconfigured job for SIEM integration (PANW IoT 3rd Party Integration - Syslog Sender) and reports the integration instance toIoT Security, which displays it on the Integrations page. The integration instance can be in one of the following four states, whichIoT Securitydisplays in the Status column on the Integrations page:- Disabledmeans that either the integration was configured but intentionally disabled or it was never configured and a job that references it is enabled and running.
- Errormeans that the integration was configured and enabled but is not functioning properly, possibly due to a configuration error or network condition.
- Inactivemeans that the integration was configured and enabled but no job has run for at least the past 60 minutes.
- Activemeans that the integration was configured and enabled and is functioning properly.
When you see that the status of the integration instance has changed fromDisabledtoActive, its setup is complete.Cloud-based co-hosted: If you configure and enable the default integration instance (with its name,Cortex XSOARinstancePANW IoT 3rd Party SIEM Integration Instance, unmodified), XSOAR immediately begins an automated export process. A predefined job calledPANW IoT SIEM Integrationis already enabled. There’s no need to enable it or configure and enable another job.Cortex XSOARsends the specified SIEM server incremental syslog updates fromIoT Securityabout changes to device attributes, new alerts, and new vulnerabilities occurring within the last polling interval, which is 15 minutes by default and is configurable.On the other hand, if you create and enable a new SIEM integration instance, you must next create and enable a job that references the new instance. Only after you configure and enable both an integration instance and job does XSOAR begin the automated export process.Full-featured: You must configure and enable an integration instance for SIEM and a job that references the instance for the XOAR server to begin sending the SIEM server incremental syslog updates about new device attributes, alerts, and vulnerabilities that occurred within the last polling interval.Cortex XSOARserverTo integrate with other SIEM servers, repeat the previous steps to add more integration instances.WhenIoT Securityintegrates with SIEM through a cohostedCortex XSOARinstance and you use the predefined integration instance with its default name (PANW IoT 3rd Party SIEM Integration Instance), you don’t have to configure any jobs. The predefined jobs—PANW IoT SIEM IntegrationandPANW IoT Bulk Export to SIEM—reference the default name of the predefined integration instance and simply work when you enable or run them.WhenIoT Securityintegrates with SIEM through a full-featuredCortex XSOARserver in the cloud or on premises, there aren’t any predefined integration instances and jobs. You must always configure them. Also, if you create additional integration instances and jobs, you must make sure that each job references a specific instance; otherwise, if a job doesn’t specifically reference the name of an integration instance, it will use the default instance.Export data about devices, security alerts, and device vulnerabilities incrementally fromIoT Securityto SIEM.- ClickLaunchto return to theCortex XSOARCortex XSOARinterface. ClickJobs, search forsiem, selectPANW IoT SIEM Integration, and then clickEdit.If you have another integration instance (besides the default) and you want the job to reference that one, you can create a new job with similar settings to these but that references the instance with the non-default name.
- Check that the following predefined settings are correct for the predefined incremental import job or enter similar settings for a new job:Time triggered: (select)Recurring: (select) If the Every field is empty, XSOAR applies an interval of 15 Minutes by default. If you want, you can change it to another value.Name:PANW IoT SIEM IntegrationPlaybook:Incremental Export to SIEM - PANW IoT 3rd Party IntegrationIntegration Instance Name: If the field is empty, the job references the default integration instance:PANW IoT 3rd Party SIEM Integration Instance. If you’ve changed the default integration instance name or want the job to use a different instance that you created, make sure its name appears here.Playbook Poll Interval: If the field is empty, XSOAR applies a default 15-minute interval so that it collects data about devices, security alerts, and device vulnerabilities that occurred during the last 15 minutes. If you want to change the interval, enter a numerical value, which although unstated is in minutes.
- If you make any updates to the default job, clickUpdate Job. If not, clickCancel. If you create a new job, clickCreate new job.
Export the data about all devices, security alerts, and device vulnerabilities fromIoT Securityto SIEM in bulk.When using a cohostedCortex XSOARinstance with the default integration instance and job or when creating and enabling a new integration instance and job, XSOAR starts exporting incremental updates to the SIEM server. However, SIEM doesn’t yet have a complete list of devices, security alerts, and device vulnerabilities fromIoT Security. This requires a bulk data export fromIoT Securityto SIEM that you initiate from the XSOAR interface at a time that’s suitable for network operations. To shorten the time required for the bulk export to complete, plan to run it during off-peak hours on a slow day such as a holiday or weekend. Exporting an inventory of 30,000-40,000 devices takes up to 12 hours when a network is under normal usage. Doing this when network traffic is light can shorten the time needed to complete the job.- On the Jobs page in theCortex XSOARinterface. ClickJobs, selectPANW IoT Bulk Export to SIEM, and then clickRun now.If you have another integration instance (besides the default) and you want the job to reference that one, you can create a new job with similar settings to these but that references the instance with the non-default name.
- Before starting the bulk export, check that the following predefined settings are correct for the predefined bulk import job or enter similar settings for a new job:Time triggered: (select)Recurring: (select) If the Every field is empty, XSOAR applies an interval of 15 Minutes by default. If you want, you can change it to another value.Name:PANW IoT Bulk Export to SIEMPlaybook:Bulk Export to SIEM - PANW IoT 3rd Party IntegrationIntegration Instance Name: If the field is empty, the job references the default integration instance:PANW IoT 3rd Party SIEM Integration Instance. If you’ve changed the default integration instance name or want the job to use a different instance that you created, make sure its name appears here.Run Once:YesThis stops the job after it completes.
- If you made any changes to the default job, clickUpdate Job. If not, clickCancel. If you create a new job, clickCreate new job.
- To perform a bulk update of device details, security alerts, and unresolved vulnerabilities to the SIEM server, select the bulk export job and then clickRun now.When you manually start the bulk export job,Cortex XSOARexports device attributes for a maximum of 1000 devices, a maximum of 1000 security alerts, and a maximum of 1000 device vulnerabilities every 15 minutes until it exports them all to the SIEM server identified in the integration instance. These settings instructCortex XSOARto run the job every 15 minutes until it exports everything and then stops.During the bulk export and after the job completes, the automated incremental update will continue running every 15 minutes or for whatever recurring interval you set.Although it’s possible to run multiple bulk export jobs in parallel, doing so can affect the XSOAR engine performance. Therefore, we advise not running more than one at a time.