Connector from XDR and AWS portal

NivedaR — Mon, 15 Aug 2022 15:08:44 GMT

Hello,

Is there a way to create a connector between cortex console and AWS portal that can fetch EC2 information as soon as the agent comes online and then populate the data received by this connector into the XDR.

Thanks !

Re: Connector from XDR and AWS portal

bbarmanroy — Tue, 16 Aug 2022 01:42:56 GMT

Hi @NivedaR it is not clear from your question what you're referring to - whether it is about XDR agents running on EC2 instances in AWS within a private subnet, or metadata about EC2 instances.

If it is the former, I believe you have AWS instances that have no route to internet (private subnet).

In this case, you can leverage a NAT instance or a Broker VM (link here). I'd recommend using the Broker VM as it provides additional functionalities that a NAT instance cannot (caching, proxying etc.). Keep in mind that you need to configure the agents to leverage the proxy. You can do it in one of the following ways:
1. during installation - use the proxy_list parameter (link here)

2. post-installation - use cytool proxy set <IP:port> (link here) or set a system-wide proxy

If it is the latter, here you go: https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/external-data-ingestion/ingest-cloud-assets/ingest-cloud-assets-from-aws

Re: Connector from XDR and AWS portal

NivedaR — Tue, 16 Aug 2022 14:51:21 GMT

Thank you !

topic Connector from XDR and AWS portal in Cortex XDR Discussions

Connector from XDR and AWS portal

Re: Connector from XDR and AWS portal

Re: Connector from XDR and AWS portal