Integrate IoT Security with Cortex XDR

Integrate IoT Security through Cortex XSOAR with Cortex XDR.
Cortex XDR is a detection and response app that integrates endpoint, network, and cloud data to detect threats and uncover the cause to accelerate investigations. XDR collects endpoint data from agents installed on IT devices such as laptops and desktops, network data from next-generation firewalls, cloud data from Prisma Access and GlobalProtect, and additional data from integrated third-party firewalls.
By integrating IoT Security with Cortex XDR, IoT Security can import attributes for devices in its inventory.
IoT Security can receive the following device attributes through an integration with Cortex XDR:
  • – Whether or not a device, or endpoint, is being isolated, a condition in which all network access for the isolated device is blocked except for traffic to Cortex XDR
  • – The status of the protection that a Cortex XDR agent is providing the device hosting it: Protected, Partially Protected, or Unprotected
  • – The name of the endpoint group to which a device is assigned
  • OS type
    – The type of operating system running on an endpoint
  • OS version
    – The version of the operating system
You can display columns on the Devices page for EDR isolation status, EDR operational status, and EDR group name. For example, the EDR Isolation Status column is shown below.
You can also see the three EDR attributes on the Device Details page.
If there is a conflict between IoT Security and XDR about the OS type and version of a device, IoT Security defers to the information from XDR. Because XDR has an agent running on each device, it is considered as the more authoritative source.
Integrating with Cortex XDR requires the purchase and activation of a third-party integration add-on. The basic integration plan includes a license for three integration add-ons, one of which can be used for Cortex XDR. The advanced plan includes a license for all supported third-party integrations.
For information about importing alerts and device information from IoT Security into Cortex XDR, see Ingest Alerts and Assets from PAN IoT Security. To accomplish this, Cortex XDR accesses the IoT Security API. This does not require an IoT Security Third-party Integrations Add-on license and is a different type of integration from the one described here.

Recommended For You