topic Re: Getting Wildfire Events into Playbooks in Cortex XSOAR Discussions

Getting Wildfire Events into Playbooks

r_buchwalder — Wed, 26 May 2021 05:50:47 GMT

Hello

Is there a way to get Wildfire Events in Panorama as a feed into XSOAR and there into a Playbook?

Right now I get those events as Mail and parse them that way - but I guess there is a more elegant way to do so...

Thanks

roger

Re: Getting Wildfire Events into Playbooks

gfilippov — Tue, 15 Jun 2021 09:40:32 GMT

Hi,
Please review the following articles:
https://docs.paloaltonetworks.com/search.html#q=PAN-OS%20EDL&sort=relevancy&layout=card&numberOfResults=25&f:@panproductcategory=[Cortex%20XSOAR]
thanks.

Re: Getting Wildfire Events into Playbooks

r_buchwalder — Fri, 02 Jul 2021 11:44:17 GMT

Hello Gfilippov

Thanks for your answer.

But I can't find any info, what to do on Panorama and what to do on XSOAR.

Right now, I do it via syslog...

thanks

roger

Re: Getting Wildfire Events into Playbooks

bkatzir — Sun, 04 Jul 2021 07:15:04 GMT

Hey @r_buchwalder , We are currently working on a solution to ingest WF events/threat logs of PANOS to Cortex XSOAR as incidents. We are working our way through that, as we are limited to the number of logs we can get using the export API, contrary to syslog.
for reference: https://github.com/demisto/etc/issues/16695

Re: Getting Wildfire Events into Playbooks

r_buchwalder — Tue, 13 Jul 2021 12:04:21 GMT

Hello @bkatzir

I'm not able to follow your github link - I do get a 404 message...

thanks for the Info anyway. Will have an eye on oncoming release notes.

thanks

roger