topic Unified Inventory in Cortex XSIAM Discussions

Unified Inventory

sh4unz0r — Wed, 29 May 2024 19:55:38 GMT

Hello,

I have come across references to 'Unified Inventory' in the documentation for XSIAM, Xpanse, and Prisma Cloud. Could anyone please clarify if this is a single offering from Palo Alto Networks or specifically from Cortex? Alternatively, do these products each refer to their own inventory feature as being 'unified'?

Ex: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Unified-Asset-Inventory

It is unclear to me whether all Cortex products share and enrich a single IT asset inventory. I have been unable to locate any specific documentation on this feature.

I would greatly appreciate any demo links or in-depth documentation on Cortex Inventory that you can share.

Thank you for your assistance!

Re: Unified Inventory

afurze — Wed, 29 May 2024 20:24:16 GMT

Hi Sh4unz0r,

Naming of the various products inventory UIs do cause confusion. The Unified Asset Inventory is a new feature available for XSIAM customers which presents a revamped view of all your assets with a breakdown on where we are getting the data and aggregation for assets that have data from multiple sources. It also gives you the capability to ingest asset and vulnerability data from 3rd party solutions (currently Tenable.io and Prisma Cloud are supported).

The Unified Inventory in Cortex Xpanse is just a view of assets discovered by Xpanse.

The Unified Asset Inventory in Prisma Cloud is just a view of hosts, containers, and container images known to Prisma Cloud.

Re: Unified Inventory

sh4unz0r — Wed, 29 May 2024 22:20:01 GMT

Thanks @afurze, I have a couple more questions around XSIAM Unified Asset Inventory if you will entertain me.
1. Do you know if it has an API that can accept assets from legacy or other sources
2. I think I had seen info about ServiceNow integration somewhere?
3. Does the unified asset inventory allow for custom fields/data enrichment?
4. Lastly any demos or documentation on this new feature would be super helpful!

Re: Unified Inventory

afurze — Mon, 10 Jun 2024 13:42:40 GMT

Sh4unz0r,

There is no API available for inserting asset information currently. As a part of the UAI beta, two integrations from the marketplace have the ability to ingest asset and vulnerability data (Prisma Cloud, and Tenable.io), no other sources are currently supported. Other sources have been and continue to be able to ingest asset information including NGFW, Cloud Inventory, and ServiceNow CMDB.

No customization is available and, as this is still in beta, no documentation is currently available, you can discuss with your Customer Success team for additional information.