Palo Alto Cortex Broker Virtual Machine (Broker VM) security understanding

M.Sylos — Thu, 22 May 2025 13:05:50 GMT

Following my company's compliance guidelines, we are looking for some confirmations about the Palo Alto Cortex Broker Virtual Machine (Broker VM). Could you, please, confirm that we have correct understanding on how the product works?
1- It is not possible do an integration with an external authorization/authentication mechanism in Broker VM itself. Since only local password for User Interface (UI) is set.
2- Even with SSH using local admin is not possible to set a password for admin user or have privileges access (root) to the VM. Only login as SSH public/private keys and it is recommended that SSH should be disabled.
3- It is not possible to customize syslog or Business Use Notice, install anti-virus, endpoint detection or any other software inside the VM since no privileges to change the VM.
4- In case of upgrade or patching, need to deploy a new version Broker VM.
Thank you for confirmation.

Re: Palo Alto Cortex Broker Virtual Machine (Broker VM) security understanding

jmazzeo — Thu, 22 May 2025 13:19:15 GMT

Hi @M.Sylos ,

1,2 and 3 are correct.

4- You can enable the "Auto Upgrade" feature to allow the Broker VM to apply new versions and patches automatically.

If this post answers your question, please mark it as the solution.

topic Re: Palo Alto Cortex Broker Virtual Machine (Broker VM) security understanding in Cortex XDR Discussions

Palo Alto Cortex Broker Virtual Machine (Broker VM) security understanding

Re: Palo Alto Cortex Broker Virtual Machine (Broker VM) security understanding