Cortex XDR - Sharing IOC with Other Tenant

[A.Faruq]

Hello Palo Alto Team,

I just want to ask a question regarding sharing IOC with other tenant. Is it possible to share continuously IOC with other tenant? If it possible, please share with me, because I have case that need to share IOC to tenant in other region under Pertamina Hulu Energi that have also their Cortex XDR.

Thanks

[susekar]

Hello @A.Faruq ,

Greetings for the day.

While Cortex XDR does not have a native “push-button” feature within the management console to directly synchronize Indicators of Compromise (IOCs) between separate tenants, continuous sharing between tenants in different regions can be achieved using automation through Cortex XSOAR or via the Public API.

Recommended Solution: Automation via Cortex XSOAR:

Palo Alto Networks provides an official Cortex XDR Content Pack for Cortex XSOAR/XSIAM that enables automated synchronization of IOCs from a central repository to one or more XDR tenants, regardless of their geographical region.

How to configure continuous sharing:

1. Centralize Intelligence:
   Manage your threat intelligence within XSOAR (typically using the Threat Intelligence Management/TIM module).]
2. Multi-Instance Setup:
   Configure multiple instances of the Cortex XDR - IOC integration in XSOAR. Each instance must point to the unique URL of the target XDR tenants (e.g., tenants in different regions).
3. Automated Playbooks:
   Use the following official playbooks to push indicators continuously:
   • Cortex XDR IOCs - Push new IOCs to XDR (Main): Automatically synchronizes active indicators from XSOAR to the linked XDR tenants.
   • Cortex XDR IOCs – Disable expired IOCs in XDR: Ensures that when an indicator expires in your central list, it is also disabled in the XDR tenants.
4. Integration Command:
   The underlying command used by these playbooks to programmatically insert indicators is xdr-iocs-push.

Alternative: Public API Synchronization:

If you do not use XSOAR, you can develop a custom script to periodically sync IOCs between tenants using the Cortex XDR Public API.

• Export from Source:
  Use the Get Indicators API to retrieve IOCs from the primary tenant.

• Import to Destination:
  Use the following endpoint to bulk add IOCs to the secondary tenant:

  /public_api/v1/indicators/insert_jsons
• Regional Accessibility:
  API requests are directed to the specific regional FQDN of the tenant (e.g., api-<xdr-tenant>.xdr.<region>.paloaltonetworks.com), allowing synchronization across different geographical boundaries.

This approach provides flexibility but requires custom development and maintenance, whereas XSOAR offers a more structured and scalable automation framework for continuous IOC sharing.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

[A.Faruq]

Hello @susekar ,

Thanks for your answer, I will try it first.

Thanks

[susekar]

Hello @A.Faruq ,

Thank you for the response.

This is Acknowledged. 

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar