topic Re: Check Point Threat Emulation (SandBlast) integration with cortex in Cortex XDR Discussions

Check Point Threat Emulation (SandBlast) integration with cortex

K.Ganiyev — Wed, 09 Apr 2025 18:20:34 GMT

Hi everyone, i need help to solve this issue. Could you help me?

Re: Check Point Threat Emulation (SandBlast) integration with cortex

nsinghvirk — Fri, 11 Apr 2025 13:58:04 GMT

Are you looking for a way to ingest Check Point Threat Emulation alerts in XDR? If so this case be achieved either using XDR APIs or using a syslog collector. Cortex XDR stitches the external alerts together with relevant endpoint data and displays alerts from external sources in relevant incidents and alerts tables. You can also see external alerts and related artifacts and assets in Causality views.

Reference- https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Ingest-external-alerts

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

Re: Check Point Threat Emulation (SandBlast) integration with cortex

K.Ganiyev — Fri, 11 Apr 2025 14:01:37 GMT

Hi dear Nsinghvirk ,i want to use threat emulator integration for cheking files , like as sandbox.

Re: Check Point Threat Emulation (SandBlast) integration with cortex

aspatil — Wed, 16 Apr 2025 05:33:47 GMT

Hello @K.Ganiyev ,

Integrating Check Point Threat Emulation (SandBlast) directly with Cortex XDR is not natively supported. However, you can achieve interoperability by leveraging Cortex XSOAR as an intermediary platform. Here's how you can set up this integration:

https://xsoar.pan.dev/docs/reference/integrations/check-point-sand-blast

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution". Thank you.