Enter the following, leave the other fields at their default
values:
Time triggered: (select)
Recurring:
Select this because you want to periodically import device attributes
from Cortex XDR.
Every: Enter a number
and set the interval value (Minutes, Hours, Days, or Weeks) and
select the days on which to run the job. (If you don’t select anything,
the job runs everyday.) This determines how often XSOAR imports
data from Cortex XDR. It’s important to set an interval that provides
enough time for the job to complete, considering factors such as
the number of devices that are active on the network.
You can see the run status of a recurring job on the Jobs page.
When in progress, its status is Running. When
done, its status changes to Completed.
Name: Type a name for the job.
Playbook: Select the playbook for the type of job
you’re configuring. If you want to run both playbooks, create separate
jobs, one for each:
Import Cortex XDR Endpoints to PANW IoT
— Import endpoint attributes from Cortex XDR.
Import Cortex XDR XQL Data to Device Security
— Import host inventory, application inventory, KB article, and CVE data
via XQL queries. Requires XQL options to be enabled in the integration
instance settings.
Integration
Instance Name: Paste the integration instance name that
you copied in the previous step. If this field is empty or an entered
name does not match an instance, the job won’t run successfully.
Site Names:
Leave the field empty to import device attributes for all sites.
To limit imports to devices at one or more sites, enter comma-separated site
names.
