topic Incorporating NGFW and Active Directory information into the management console in Cortex XDR Discussions

Incorporating NGFW and Active Directory information into the management console

CraigV123 — Thu, 09 Jun 2022 11:10:21 GMT

We have the Prevent license and I am curious if anyone has been able to take their PA NGFW data and send it to the XDR console? I know this can be done with the Pro license for increased forensics and threat detection but I am not sure if I can do it with Prevent.

Also looking to implement the Cloud Identity solution. Has anyone done that before? What are your thoughts/tips/concerns with the process?

Thanks!

Re: Incorporating NGFW and Active Directory information into the management console

P.Jacob — Thu, 09 Jun 2022 11:59:18 GMT

Also keep in mind you can integrate virus total and autofocus as well. I have the Cloud Identity solution (basically ad integration)

it was super simple.

Re: Incorporating NGFW and Active Directory information into the management console

afurze — Thu, 09 Jun 2022 19:47:32 GMT

Hi CraigV123,

With Cortex XDR Prevent, only the XDR Agent information can be ingested into XDR console, an XDR Pro license allows you to ingest alerts from 3rd party sources (including NGFW) and a Pro per TB license allows you to ingest the raw logs. Please refer to this doc page with detailed information on capabilities per license type (https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-xdr-licenses/features-by-cortex-xdr-license-type#features-by-cortex-xdr-license-type).

Correction: You can use the AD integration feature to bring in data from AD for alerts and incidents. It's the Identity Analytics that you won't be able to utilize. Check out https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr-pro/set-up-cloud-identity-engine for information on configuring this.

Re: Incorporating NGFW and Active Directory information into the management console

CraigV123 — Fri, 10 Jun 2022 10:34:40 GMT

I appreciate the response and additional information. Trying to get our organization to see the benefit in the upgrade. This sort of stuff helps.