Cortex XDR - Incidents
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊
| Attribute | Value |
|---|---|
| Connector ID | CortexXDRIncidents |
| Publisher | DEFEND Ltd. |
| Used in Solutions | Cortex XDR |
| Collection Method | CCF |
| Connector Definition Files | CortexXDR_DataConnector.json |
| CCF Configuration | PollingConfig.json |
| CCF Capabilities | APIKey, Paging, POST |
Custom Data connector from DEFEND to utilise the Cortex API to ingest incidents from Cortex XDR platform into Microsoft Sentinel.
Tables Ingested
This connector ingests data into the following tables:
| Table | Transformations | Ingestion API | Lake-Only |
|---|---|---|---|
PaloAltoCortexXDR_Incidents_CL |
? | ✓ | ? |
💡 Tip: Tables with Ingestion API support allow data ingestion via the Azure Monitor Data Collector API, which also enables custom transformations during ingestion.
Permissions
Resource Provider Permissions: - Workspace (Workspace): read and write permissions are required. - Keys (Workspace): read permissions to shared keys for the workspace are required. See the documentation to learn more about workspace keys
Custom Permissions: - Cortex API credentials: Cortex API Token is required for REST API. See the documentation to learn more about API. Check all requirements and follow the instructions for obtaining credentials.
Setup Instructions
⚠️ Note: These instructions were automatically generated from the connector's user interface definition file using AI and may not be fully accurate. Please verify all configuration steps in the Microsoft Sentinel portal.
1. Enable Cortex XDR API
Connect Cortex XDR to Microsoft Sentinel via Cortex API to process Cortex Incidents.
📋 Additional Configuration Step: This connector includes a configuration step of type
APIKey. Please refer to the Microsoft Sentinel portal for detailed configuration options for this step.
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · 📊