XSOAR Sessions and Submissions option

pottapitot — Mon, 31 Oct 2022 14:17:28 GMT

Hi,

I came across this documentation regarding XSOAR

https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-9/cortex-xsoar-threat-intel-management-guide/unit42-intel/unit42-sessions-and-submissions

The Sessions & Submissions tab enables you to use your sessions and submissions data for investigation and analysis. Sessions and submissions data is available for customers with a TIM license and at least one of the following products:

Palo Alto Networks Firewall
WildFire
Cortex XDR
Prisma SaaS
Prisma Access

Sessions refers to firewall sessions, while Submissions refers to logs of samples reported to Wildfire from other Palo Alto Networks products. Sessions data shows you connections from one endpoint to another, and submissions data shows you if a file was found on a specific endpoint.

We are using PaloAlto Firewall. Does this mean I send traffic sessions from the PaloAlto firewall to XSOAR and it checks the IPs (realtime or periodically) e.g. source or destination is in the indicator list present in Threat Intel section on XSOAR?
How does this integration work?

Thanks

Re: XSOAR Sessions and Submissions option

sramesh-7 — Mon, 21 Nov 2022 12:24:02 GMT

Hi,

No, XSOAR does not process or enrich this info, you will only be able to view and query the sessions data generated from your PAN firewall and listed other products.

topic Re: XSOAR Sessions and Submissions option in Cortex XSOAR Discussions

XSOAR Sessions and Submissions option

Re: XSOAR Sessions and Submissions option