topic Re: Broker VM in Cortex XDR Discussions

Broker VM

weejh — Tue, 26 Oct 2021 06:58:40 GMT

Hi everyone

From the Ingest Logs from Elasticsearch Filebeat documentation, it mentioned "use the broker VM to proxy Filebeat communication". May I know how to configure the broker VM as proxy for Filebeat communication?

Re: Broker VM

jcandelaria — Tue, 26 Oct 2021 15:30:27 GMT

Hi Weejh,

Basically you need to setup/configure the Broker VM first, (1st link below) then once you configure the Broker VM, then you can activate/configure the Local Agent Settings app inside the Broker VM (2nd link below)

1. https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/broker-vm/set-up-broker-vm/configure-your-broker-vm.html

2. https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/broker-vm/set-up-broker-vm/activate-the-agent-proxy-for-closed-networks.html

Re: Broker VM

weejh — Wed, 27 Oct 2021 05:37:28 GMT

Thanks for your reply.

Yes, the broker VM is setup according to links you've shared. I guess the next step is "When using the broker VM, ensure that you activate the Local Agent Settings applet with the Agent Proxy enabled."

May I know how validate that Agent Proxy is enabled?

Re: Broker VM

jcandelaria — Thu, 28 Oct 2021 19:27:59 GMT

Click on gear icon (top right corner) --> configurations --> Broker VM list (left side) then select the deployed broker vm and should be able to see if you configured and activated it.

Re: Broker VM

weejh — Fri, 29 Oct 2021 08:50:25 GMT

Thanks for the reply.

from the screenshot, is this the proxy setup that we should use to proxy Filebeat communication?

If yes, what should be the address and port?

Re: Broker VM

jcandelaria — Fri, 29 Oct 2021 19:14:10 GMT

Hi Weejh,

the screenshot you attached is the configuration of broker VM itself. If your broker vm doesnt have restriction going to internet then you dont need to configure the proxy server. But if your broker vm need proxy to go out then you need to configure this setting.

But back to your question on filebeat.

once you deploy and configure broker, you need to configure the local agent setting app on the broker.

Then once its activated, now you can use the broker ip and port in your filebeat configuration