topic Re: Cortex XDR Integration with NGFW in Cortex XDR Discussions

Cortex XDR Integration with NGFW

JahidAliyev — Thu, 28 Nov 2024 12:15:55 GMT

Hello,

I have Cortex Pro per GB license and NGFW. I have successfully created certificate and it is showing as valid in XDR console. I have created a profile which is sending logs to Data Lake. I have applied it on many policies. But I cannot get NGFW logs in Cortex XDR.

This is my log forwarding profile:

I suspect that it can be because of the expiration of data lake in my assets tab in supoort portal:

But I think the data lake is no longer used as the licenses have changed.

Can anybody tell me what is misconfiguration? And, is there latest document or source that is clearly giving instructions for integration steps from zero?

Re: Cortex XDR Integration with NGFW

jmazzeo — Fri, 29 Nov 2024 13:53:58 GMT

Hi @JahidAliyev, thanks for reaching us using the Live Community.

Since a few XDR versions back, the NGFW integration needs to be done from the Firewalls or Panorama, no need of Cortex Data Lake or Strata Logging Service.

You can check all the requires steps here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Ingest-data-from-Next-Generation-Firewall

If this post answers your question, please mark it as the solution.

Re: Cortex XDR Integration with NGFW

JahidAliyev — Tue, 03 Dec 2024 22:19:38 GMT

Hello again,

So we do not need to create a forwarding profile called data lake and apply it on all policies to forward their logs to data lake profile? Can you eloborate more?