Beyond Corp configuration to use in Context-Aware Access

mjunior — Wed, 09 Aug 2023 21:23:37 GMT

Hi,

I would like to know how I integrate Cortex XDR with Context-Aware Access from Google's Beyond Corp product.

Analyzing the existing documentation, I got the impression that I need to create a rule like this in CAA:

device.vendors["cortex"].is_managed_device == true && device.vendors["cortex"].data["complianceState"] == "compliant"

device.vendors["PANW"].is_managed_device == true && device.vendors["PANW"].data["complianceState"] == "compliant"

And my first question is: (1) what is the correct form (device.vendors["PANW"] or device.vendors["cortex"])?

My second question is: (2) do I need to enable an enterprise connector for Cortex XDR data to be available? If yes, the configuration step is like https://live.paloaltonetworks.com/t5/general-articles/palo-alto-networks-cortex-xdr-xsiam-integration-with-google/ta-p/550190?

Re: Beyond Corp configuration to use in Context-Aware Access

JayGolf — Wed, 16 Aug 2023 08:09:30 GMT

I've moved your discussion to the Cortex XDR board to get the right set of eyes.