topic Re: XSOAR Community Edition -> Cortex Data Lake integration in Cortex XSOAR Discussions

XSOAR Community Edition -> Cortex Data Lake integration

Netwerx — Wed, 15 Dec 2021 20:03:41 GMT

I'm trying to get Cortex Data Lake integrated with our Cortex XSOAR Community Edition instance, and getting nowhere very quickly.

Reviewing the documentation: https://xsoar.pan.dev/docs/reference/integrations/cortex-data-lake

I am completely lost finding the Token, ID, and Key values to tie it to our Cortex Data Lake instance.

The documentation states:

Insert the license ID and the Customer Name in the required fields and complete the authentication process in order to get the Authentication Token Registration ID Encryption Key

Anybody know what they mean by this?

Re: XSOAR Community Edition -> Cortex Data Lake integration

asawyer — Sat, 18 Dec 2021 01:05:51 GMT

Hi @Netwerx – Improved setup instructions for the Cortex Data Lake integration are in the works and can be reviewed here: https://github.com/demisto/content/blob/master/Packs/CortexDataLake/Integrations/CortexDataLake/CortexDataLake_description.md

The changes will be reflected on the integration's Help page within XSOAR and on its documentation page soon.

Let us know if you have further questions about the setup!

Re: XSOAR Community Edition -> Cortex Data Lake integration

Netwerx — Mon, 20 Dec 2021 13:56:34 GMT

The github documentation also just states "from the authentication process".

I'm trying to integrate our Cortex Data Lake instance with an on premises, community edition of Cortex XSOAR. Is this not possible or the community edition / on prem to ingest Cortex Data Lake logs?

I checked with Palo Alto support on this, and they wouldn't assist as it was an implementation issue, and would require they bill us to get it working.

Re: XSOAR Community Edition -> Cortex Data Lake integration

asawyer — Tue, 21 Dec 2021 04:40:29 GMT

As far as I know, this should work with the Community Edition. When logged into the HUB, do you have an activated instance of the Cortex XSOAR app? Once you have activated an instance of the Cortex XSOAR app and select it, you will get a screen where you can enter the License ID and Customer Name.

Re: XSOAR Community Edition -> Cortex Data Lake integration

Netwerx — Tue, 21 Dec 2021 13:42:17 GMT

Ah, just to clarify, you need a paid for cloud / palo alto xsoar instance to be able to get your paid for cortex data lake data into your community edition, on premises cortex xsoar instance?

Re: XSOAR Community Edition -> Cortex Data Lake integration

laurence64 — Tue, 21 Dec 2021 15:01:38 GMT

I am just looking at the hub now, it seems that the activation of the Cortex XSOAR requires the data lake configuration before continuing, @Netwerx have you tried entering the details there?

I have to admit I have not used Data Lake up until now but the community edition of XSOAR only has a few restrictions so I would have thought this would have been permitted.