Integrate IoT Security with Cortex XDR

Integrate IoT Security through Cortex XSOAR with Cortex XDR.
Cortex XDR is a detection and response app that integrates endpoint, network, and cloud data to detect threats and uncover the cause to accelerate investigations. XDR collects endpoint data from agents installed on IT devices such as laptops and desktops, network data from next-generation firewalls, cloud data from Prisma Access and GlobalProtect, and additional data from integrated third-party firewalls.
By integrating IoT Security with Cortex XDR, IoT Security can import attributes for devices in its inventory.
IoT Security can receive the following device attributes through an integration with Cortex XDR:
  • – Whether or not a device, or endpoint, is being isolated, a condition in which all network access for the isolated device is blocked except for traffic to Cortex XDR
  • – The status of the protection that a Cortex XDR agent is providing the device hosting it: Protected, Partially Protected, or Unprotected
  • – The name of the endpoint group to which a device is assigned
  • OS type
    – The type of operating system running on an endpoint
  • OS version
    – The version of the operating system
You can display columns on the Devices page for EDR isolation status, EDR operational status, and EDR group name. For example, the EDR Isolation Status column is shown below.
You can also see the three EDR attributes on the Device Details page.
If there is a conflict between IoT Security and XDR about the OS type and version of a device, IoT Security defers to the information from XDR. Because XDR has an agent running on each device, it is considered as the more authoritative source.
Integrating with Cortex XDR does not require the purchase and activation of a third-party integration add-on. The only requirement is a subscription to IoT Security and a subscription to Cortex XDR.

Recommended For You