Check Point Threat Emulation (SandBlast) integration with cortex

[K.Ganiyev]

Hi everyone, i need help to solve this issue. Could you help me?

[nsinghvirk]

Hello @K.Ganiyev 

Are you looking for a way to ingest Check Point Threat Emulation alerts in XDR? If so this case be achieved either using XDR APIs or using a syslog collector. Cortex XDR stitches the external alerts together with relevant endpoint data and displays alerts from external sources in relevant incidents and alerts tables. You can also see external alerts and related artifacts and assets in Causality views.

Reference- https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Ingest-external-alert...

Please click Accept as Solution to acknowledge that the answer to your question has been provided.

[K.Ganiyev]

Hi dear Nsinghvirk ,i want to use threat emulator integration for cheking files , like as sandbox.

[aspatil]

Hello @K.Ganiyev ,

Integrating Check Point Threat Emulation (SandBlast) directly with Cortex XDR is not natively supported. However, you can achieve interoperability by leveraging Cortex XSOAR as an intermediary platform. Here's how you can set up this integration:

https://xsoar.pan.dev/docs/reference/integrations/check-point-sand-blast

If you feel this has answered your query, please let us know by clicking like and  on "mark this as a Solution". Thank you.