topic Directory Sync usage in Cortex XDR Discussions

Directory Sync usage

CraigV123 — Wed, 23 Dec 2020 17:04:55 GMT

Hello everyone,

Just curious who uses the Directory Sync tool out there? If you use it would you mind sharing a quick like/dislike about it? I really want to incorporate it into our environment but not entirely sold on it... yet. Any feedback about it would be appreciated. Thanks!

Re: Directory Sync usage

dfalcon — Tue, 05 Jan 2021 15:49:00 GMT

Hi @CraigV123-

While I'm not an end-user / admin, I can speak to its functionality. For Cortex XDR Prevent environments, Directory Sync allows the ability to leverage AD OU's and groups to assign policy. This may or may not help much depending on the use of different policy rules for groups. For Cortex XDR Pro -- Directory Sync serves a much deeper role. In addition to the policy benefits, Directory Sync provides the data needed for event context enrichment.

Re: Directory Sync usage

FirewallGuyTwo — Tue, 05 Jan 2021 16:07:09 GMT

For Cortex XDR, can AD sync help with detecting unprotected/not checking-in endpoints? E.g. point AD sync to a specific computer OU and get alerts if endpoint list does not match the OU list?

Thanks!

Re: Directory Sync usage

CraigV123 — Tue, 05 Jan 2021 16:14:10 GMT

Thank you for the additional insight!

Re: Directory Sync usage

CraigV123 — Tue, 05 Jan 2021 16:15:43 GMT

I'd be really curious on the answer to that as well. I'm not sure but it'd be nice to do that in order to find unprotected endpoints out there! Thank you.

Re: Directory Sync usage

WSeldenIII — Tue, 05 Jan 2021 17:24:23 GMT

In terms of network asset visibility, if you have a Cortex XDR Pro per TB or Cortex XDR Pro per Endpoint license, then you may leverage Asset Management distinguish between assets managed and unmanaged by an XDR agent. You may view details about an endpoint to determine the operational status (E.g. protected vs. unprotected) of the endpoint.

Re: Directory Sync usage

dfalcon — Tue, 05 Jan 2021 18:43:24 GMT

@WSeldenIII is correct. You would just need to use the Agent Installed = No filter under Assets > Asset Management.

Re: Directory Sync usage

Balaraju — Tue, 28 Mar 2023 09:59:20 GMT

Greetings ,

We are using Cortex Pro edition and I am keen to find how I can use this feature in Cortex XDR V3.6 ?

My goal is same , to find endpoints which do not have agents installed ?

Thanks in advance

Re: Directory Sync usage

PiyushKohli — Wed, 29 Mar 2023 06:00:23 GMT

Hi @Balaraju

Cloud Identity Engine (previously called Directory Sync Service (DSS)) enables to leverage Active Directory user, group, and computer information in Cortex XDR and provides the data needed for event context enrichment.

Reference Doc: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Set-Up-Cloud-Identity-Engine

For endpoints where XDR agent is not installed but are domain joined you can find the endpoints which doesn't have agent installed in below ways:

1. You would just need to use the Has XDR Agent = No filter under Assets > Assets Inventory.

2. For endpoints where XDR agent is not installed but are domain joined, if Cloud Identity engine is setup and configured you can leverage the Cloud Identity Engine dataset (pan_dss_raw) to cross-reference the data with endpoints data dataset (endpoints) to identify assets which are a part of the organization domain but are not in the endpoints dataset. This can be achieved with a XQL query.

You can run this as a report on a periodic basis to get the list of endpoints without XDR and then leverage organizational processes to get XDR installed on those endpoints. Refer to this Live Community Post

Hope this helps.

Re: Directory Sync usage

Balaraju — Tue, 04 Apr 2023 13:32:22 GMT

Thanks for your reply and information provided , I will check that . Apologies for delay in replying . Thanks again

Re: Directory Sync usage

Rashele-Shoun — Thu, 25 Jul 2024 21:12:36 GMT

Good info! Thank you!