Check XSOAR Integration Activity

Access XSOAR logs and playbooks from the IoT Security portal.
You can use these tools to check on integration activity within Cortex XSOAR from the convenience of the IoT Security UI:


IoT Security provides a simple mechanism to download logs from your cloud-hosted Cortex XSOAR instance so you can check data exchanges with third-party integrations and XSOAR engine connectivity. The logs are particularly useful for troubleshooting. For example, if you imported device attributes from a wireless controller, you can look at logs showing all the device attributes that XSOAR imported. If you sent alerts or vulnerabilities to an asset management system like Nuvolo or ServiceNow or device updates to a NAC system like Aruba Clearpass, you can see when they were sent.
The logs might contain data for devices that aren't in the IoT Security inventory but that XSOAR received from the wireless controller.
  1. Download XSOAR logs.
    1. Log in to IoT Security, navigate to
      , and then
      Download XSOAR logs
      IoT Security downloads a zip file containing a compressed set of XSOAR logs. The download takes approximately 10 seconds to complete and the file name consists of the name
      + a timestamp, such as
    2. Save the zip file on your management system and extract the files within it.
      Each log file can be up to 10 MB and typically contain data for the past two or three days.
  2. Refer to the logs to check on various XSOAR server and engine activities.
    • The
      contains an historical record of the various integration activities in which the hosted XSOAR server engaged such as device quarantines, vulnerability scans, and alert notifications.
    • When an integration requires an XSOAR engine, the
      inside the
      file contains a similar record of integration activities running on an XSOAR engine.
    • The
      file also contains useful information for resolving issues with XSOAR engine installations.
    • Depending on whether an integration is between a hosted XSOAR instance and a cloud-based third-party system or between an on-premises XSOAR engine and an on-premises third-party system, you can find all the device attributes that XSOAR imported for each MAC address listed in either the
      Currently you can see log data for Aruba ClearPass, Cisco Prime, and Cisco DNA Center.
      In the above screen capture, there are two d1.log files. When a file reaches its maximum size of 10 MB, XSOAR saves the first d1.log file with a timestamp as part of its filename and starts making a new d1.log file.

XSOAR Playbooks

When you initiate an action in IoT Security that involves a third-party integration–for example sending an alert or vulnerability or quarantining a device—the pop-up panel includes a link that takes you to an XSOAR playbook to see an overview of the task (referred to as "incident" in XSOAR) and the status of each step in the flow.
For the link in IoT Security to open the corresponding playbook in Cortex XSOAR, you must already be logged in to your XSOAR instance before clicking it.
The green boxes in the playbook indicate that a particular step was successfully performed. Following the path through the playbook gives you feedback about whether an action was carried out successfully or, if not, where the process changed course.
Clicking a box in a playbook opens a side panel in the Cortex XSOAR UI with an explanation of that step.
This gives you visibility into the integration workflow and assists you in making changes if required.

Recommended For You