Collect Palo Alto Cortex XDR alerts logs

This document describes how you can collect Palo Alto Cortex XDR alerts logs by setting up a Chronicle feed.

For more information, see Data ingestion to Chronicle.

An ingestion label identifies the parser which normalizes raw log data to structured UDM format. The information in this document applies to the parser with the CORTEX_XDR ingestion label.

Configure Palo Alto Cortex XDR alerts

To configure Palo Alto Cortex XDR alerts, complete the following tasks:

Get the Palo Alto Cortex XDR alerts API key

  1. Sign in to the Cortex XDR portal.
  2. In the Settings menu, click Settings.
  3. Select +New key.
  4. In the Security level section, select Standard.
  5. In the Roles section, select Viewer.
  6. Click Generate.
  7. Copy the API key, and then click Done. The API key represents your unique authorization key and is displayed only at the time of creation. It is required when you configure the Chronicle feed.

Get the Palo Alto Cortex XDR alerts API key ID

In the Configurations section, navigate to API keys > ID. Note your corresponding ID number, which represents the x-xdr-auth-id:{key_id} token.

Get FQDN

  1. Navigate to API keys.
  2. Click Copy URL. Save the URL, which is required when you configure the Chronicle feed.

Configure a feed in Chronicle to ingest Palo Alto Cortex XDR alerts logs

  1. Click Feeds.
  2. Click Add new.
  3. Select Third party API as the Source type.
  4. Select Palo Alto Cortex XDR alerts as the Log type.
  5. Click Next.
  6. Configure the following input parameters:
    • Authentication HTTP headers: provide the authorization key and authorization key ID that you obtained previously.
    • API hostname: provide the URL that you obtained previously.
    • Endpoint: specify the endpoint.
  7. Click Next and then click Submit.

For more information about Chronicle feeds, see Chronicle feeds documentation. For information about requirements for each feed type, see Feed configuration by type. If you encounter issues when you create feeds, contact Chronicle support.

What's next