Integration between CDL and Rapid7 InsightIDR not working

tamara.gm — Thu, 22 Dec 2022 22:00:29 GMT

I am working on the integration between CDL and R7 IDR SIEM and this is not working. I don't get pass the test connection on CDL.

https://docs.rapid7.com/insightidr/palo-alto-cortex-data-lake/

https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/forward-logs-from-logging-service-to-syslog-server

I am getting connection time out, I have followed these steps but the syslog server seems to be missing the trsuted certificate needed for communication with CDL. The machine is an Ubuntu machine and I have generated a cert using openssl req -x509 command.

Can anyone share if have don this integration before, and how can I get a cert from the trusted certificates for CDL? https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/trusted-root-ca-log-forwarding-app#id943bec2e-b271-4999-af50-634bf8b503f2

Thank you

Re: Integration between CDL and Rapid7 InsightIDR not working

etugriceri — Wed, 28 Dec 2022 08:45:43 GMT

Hi Tamara

https://docs.paloaltonetworks.com/cortex/cortex-data-lake/cortex-data-lake-getting-started/get-started-with-log-forwarding-app/forward-logs-from-logging-service-to-syslog-server

Check Step 11. You can download client and CA cert and use them in NXLog app.

topic Integration between CDL and Rapid7 InsightIDR not working in Cortex XDR Discussions

Integration between CDL and Rapid7 InsightIDR not working

Re: Integration between CDL and Rapid7 InsightIDR not working