topic Re: ITDR Honey Users for Cloud Identities in Cortex XDR Discussions

ITDR Honey Users for Cloud Identities

Rocky-25 — Fri, 11 Oct 2024 09:35:49 GMT

Hi Everyone

We're using ITDR module and are manually assigning asset role as described here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Asset-Roles

Only on-premises identities from AD can be assigned to asset roles. The cloud identities from Entra-ID are not available and therefore can't be assigned. Both directories are integrated with Cloud Identity Engine separately (no Entra hybrid setup) and authentication logs are also ingested into Cortex.

What am I missing here? Is the asset role feature not available for cloud only identities?

Thanks & Best Regards

Re: ITDR Honey Users for Cloud Identities

neelrohit — Fri, 11 Oct 2024 09:57:36 GMT

https://www.paloaltonetworks.com/blog/security-operations/boosting-identity-security-with-cortex-xdr-honey-users/

Re: ITDR Honey Users for Cloud Identities

Rocky-25 — Fri, 11 Oct 2024 11:09:33 GMT

I'm aware of this article, but it doesn't describe how to add a cloud identities to asset roles. The format only supports AD users:

Re: ITDR Honey Users for Cloud Identities

Rocky-25 — Mon, 02 Dec 2024 09:01:57 GMT

Hi Everyone

Finally received a statement from TAC support, although disappointing: "About allowing Cloud identities to be added to the Asset Roles through the CIE, it seems that only managed endpoints can be added to roles currently."

Best Regards