Integrate Cortex XDR with the SIEM (Microsoft Azure) solution

Shashanksinha — Thu, 08 Dec 2022 14:33:41 GMT

Integration of Cortex XDR with the SIEM (Microsoft Azure) solution
Had a few queries regarding it:-
1. Supported integration methods & recommended integration methods for integration with Microsoft Sentinel.
2. What all logs can be forwarded (eg: Alerts, Incidents, Audit, management logs and endpoint/server logs, etc.)
3. How do we evaluate disk space requirements for such events?
4. Reference documents for this integration

Re: Integrate Cortex XDR with the SIEM (Microsoft Azure) solution

neelrohit — Thu, 08 Dec 2022 15:01:07 GMT

Hi @Shashanksinha ,

Thank you for writing to live community!

SIEM integration with Cortex XDR can be done in two mechanisms:

Using syslog receiver
API keys

Depending upon your used case, you can integrate syslog receiver as mentioned in the guide here: Integrate a Syslog receiver

This will require you to whitelist the IP as per your region in which the XDR tenant is hosted and then navigate to Settings> Configurations> Integrations>External Applications. Add your syslog reciever public IP and certificate.

For API based integration, please create a curl or a python based API as supported by Microsoft Azure Sentinel and configure it in the app.

topic Re: Integrate Cortex XDR with the SIEM (Microsoft Azure) solution in Cortex XDR Discussions

Integrate Cortex XDR with the SIEM (Microsoft Azure) solution

Re: Integrate Cortex XDR with the SIEM (Microsoft Azure) solution