Focus

IoT Security Integration Guide

Check XSOAR Integration Activity

Table of Contents

Check XSOAR Integration Activity

Access

Cortex XSOAR

logs and playbooks from the

IoT Security

portal.

You can use these tools to check on integration activity within

Cortex XSOAR

from the convenience of the

IoT Security

UI:

XSOAR Logs

XSOAR Playbooks

XSOAR Logs

IoT Security

provides a simple mechanism to download logs from your cloud-hosted

Cortex XSOAR

instance so you can check data exchanges with third-party integrations and XSOAR engine connectivity. The logs are particularly useful for troubleshooting. For example, if you imported device attributes from a wireless controller, you can look at logs showing all the device attributes that XSOAR imported. If you sent alerts or vulnerabilities to an asset management system like Nuvolo or ServiceNow or device updates to a NAC system like Aruba Clearpass, you can see when they were sent.

The logs might contain data for devices that aren't in the

IoT Security

inventory but that XSOAR received from the wireless controller.

Download XSOAR logs.

IoT Security

, navigate to

Integrations

, and then

Download XSOAR logs

IoT Security

downloads a zip file containing a compressed set of XSOAR logs. The download takes approximately 10 seconds to complete and the file name consists of the name

xsoar_log

+ a timestamp, such as

xsoar_log_2022-April-20-19_26.zip

Save the zip file on your management system and extract the files within it.

Each log file can be up to 10 MB and typically contain data for the past two or three days.

Refer to the logs to check on various XSOAR server and engine activities.

The

server.log

contains an historical record of the various integration activities in which the hosted XSOAR server engaged such as device quarantines, vulnerability scans, and alert notifications.

When an integration requires an XSOAR engine, the

d1.log

inside the

<engine-name>-log.tar.gz

file contains a similar record of integration activities running on an XSOAR engine.

The

<engine-name>-<date>-log.tar.gz

file also contains useful information for resolving issues with XSOAR engine installations.

Depending on whether an integration is between a hosted XSOAR instance and a cloud-based third-party system or between an on-premises XSOAR engine and an on-premises third-party system, you can find all the device attributes that XSOAR imported for each MAC address listed in either the

server.log

d1.log

Currently you can see log data for Aruba ClearPass, Cisco Prime, and Cisco DNA Center.

In the above screen capture, there are two d1.log files. When a file reaches its maximum size of 10 MB, XSOAR saves the first d1.log file with a timestamp as part of its filename and starts making a new d1.log file.

XSOAR Playbooks

When you initiate an action in

IoT Security

that involves a third-party integration–for example sending an alert or vulnerability or quarantining a device—the pop-up panel includes a link that takes you to an XSOAR playbook to see an overview of the task (referred to as "incident" in XSOAR) and the status of each step in the flow.

For the link in

IoT Security

to open the corresponding playbook in Cortex XSOAR, you must already be logged in to your XSOAR instance before clicking it.

The green boxes in the playbook indicate that a particular step was successfully performed. Following the path through the playbook gives you feedback about whether an action was carried out successfully or, if not, where the process changed course.