Cortex XDR and Data Lake activation

[grenzi]

Hi everyone,

  sorry if posting in the wrong place.

I'm reading through the XDR and Data Lake documentation to understand how to proceed with the product activation. About Data Lake (formerly logging service), the documentation states that:

• if you are using Traps Management Service and/or firewalls that are not managed by Panorama, you should activate Cortex Data Lake on the Hub (formerly Cortex Hub)
• if you are using Panorama managed firewalls and/or Global Protect Cloud service you should activate Cortex Data Lake using the Customer Support Portal.

The problem here is that one of my customers bought the Traps Management Service and also needs to send Panorama managed firewalls' logs to Data Lake. They are using PAN-OS 8.0 on their firewall, so there is no chance to directly onboard the firewalls on Data Lake. In this case, which is the correct procedure to activate Cortex Data Lake?

Thank you in advance.

[FrankBussink · Accepted solution]

Hi,

if you are running a 8.x version, I think then to onboard the LS (logging service) on those Firewall, you HAVE to go through Panorama.

In Panorama, deploy the plugin Cloud_Services. (bear in mind the version of Panorama, I think you need at least a 9.x but that doesn't mean you have to run your Firewalls at version 9.x)

Create a profile to log to Logging Service

and then deploy this profile to the Firewall.

Fairly straight forward

Regards

Frank