Integrate IoT Security with Cortex XDR
Integrate IoT Security through Cortex XSOAR with Cortex
XDR.
Cortex XDR is a detection
and response app that integrates endpoint, network, and cloud data
to detect threats and uncover the cause to accelerate investigations.
XDR collects endpoint data from agents installed on IT devices such
as laptops and desktops, network data from next-generation firewalls,
cloud data from Prisma Access and GlobalProtect, and additional
data from integrated third-party firewalls.
By integrating IoT Security with Cortex XDR, IoT Security can
import attributes for devices in its inventory.
IoT Security can receive the following device attributes through
an integration with Cortex XDR:
- – Whether or not a device, or endpoint, is being isolated, a condition in which all network access for the isolated device is blocked except for traffic to Cortex XDR
- – The status of the protection that a Cortex XDR agent is providing the device hosting it: Protected, Partially Protected, or Unprotected
- – The name of the endpoint group to which a device is assigned
- OS type– The type of operating system running on an endpoint
- OS version– The version of the operating system
You can display columns on the Devices page for EDR isolation
status, EDR operational status, and EDR group name. For example,
the EDR Isolation Status column is shown below.
You can also see the three EDR attributes on the Device Details
page.
If there is a conflict between IoT Security and XDR about
the OS type and version of a device, IoT Security defers to the information
from XDR. Because XDR has an agent running on each device, it is
considered as the more authoritative source.
Integrating with Cortex XDR requires the purchase and activation of
a third-party integration add-on. The basic integration plan includes
a license for three integration add-ons, one of which can be used
for Cortex XDR. The advanced plan includes a license for all supported
third-party integrations.
For information about importing alerts and device information
from IoT Security into Cortex XDR, see Ingest Alerts and Assets from
PAN IoT Security. To accomplish this, Cortex XDR accesses
the IoT Security API. This does not require an IoT Security Third-party
Integrations Add-on license and is a different type of integration
from the one described here.
