Cortex XDR - Ticket system integration or linking options

IREPhil — Wed, 30 Mar 2022 13:39:14 GMT

Hi there,

I am just getting started into what Cortex XDR can do. One item I cannot find a clear answer to so far is how XDR handles alerts forwarding or some API integration between it and, for example, Freshdesk/ServiceNow/Autotask etc.

Is this possible with Cortex XDR?

If you have any links to further reading please point me in the right direction. Thanks.

Kind regards

Phil

Re: Cortex XDR - Ticket system integration or linking options

eluis — Wed, 30 Mar 2022 14:01:38 GMT

Hi @IREPhil ,

you can forward your notifications to syslog receiver, email, or even slack. Please check the following doc on how to do it

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/logs/create-notifications

So you need also this doc to configure it:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/logs/integrate-a-syslog-receiver-for-outbound-notifications.html#forward-logs-to-a-syslog-receiver

Additionally you can use API, please check the following doc:

https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/incident-management/get-incidents.html#id990df1b2-5bca-4c61-8e12-0f0bae5194b8

The difference is that you can be more granular/selective via API and might more informative sending the alerts/incidents than just a notification. Depends on your scenario/use case.

Please if this was helpful feel free to like, rate it or mark it as a solution.

KR,
Luis

topic Cortex XDR - Ticket system integration or linking options in Cortex XDR Discussions

Cortex XDR - Ticket system integration or linking options

Re: Cortex XDR - Ticket system integration or linking options