topic Re: Cortex XSOAR queries in Cortex XSOAR Discussions

Cortex XSOAR queries

Vinothkumar_SBA — Tue, 30 Jan 2024 05:27:55 GMT

Hi Team,

We planned to integrate the IOC push from Cortex XSOAR to other tools, for example, Palo Alto firewalls, other firewalls, SIEM tools, and XDR tools. Is this possible? If so, could you please share any documentation or guidance?

Re: Cortex XSOAR queries

yuki_sato — Tue, 30 Jan 2024 15:16:38 GMT

Hi @Vinothkumar_SBA

You should use External Dynamic List for this.

How-to Video: https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-8-how-to-video-external-dynamic-list/ta-p/568283

Integration Document: https://xsoar.pan.dev/docs/reference/integrations/edl

Re: Cortex XSOAR queries

Vinothkumar_SBA — Wed, 31 Jan 2024 07:18:40 GMT

Hi@Ysato,

Thank you for your response and valuable feedback. If possible, could you suggest another method of integration that doesn't require expertise in EDL?

Re: Cortex XSOAR queries

yuki_sato — Wed, 31 Jan 2024 17:13:45 GMT

The other option is to utilize integration for platforms that you want to push IOCs from XSOAR.

For XDR, there is an integration called "Cortex XDR - IOC" that you can use to push IOCs.

For the firewall, you can see if there is any command for integration called "PAN-OS by Palo Alto Networks".