Incorporating NGFW and Active Directory information into the management console

[CraigV123]

We have the Prevent license and I am curious if anyone has been able to take their PA NGFW data and send it to the XDR console? I know this can be done with the Pro license for increased forensics and threat detection but I am not sure if I can do it with Prevent. 

Also looking to implement the Cloud Identity solution. Has anyone done that before? What are your thoughts/tips/concerns with the process? 

Thanks! 

[PeteJacobCF]

Also keep in mind you can integrate virus total and autofocus as well. I have the Cloud Identity solution (basically ad integration)

it was super simple. 

[afurze · Accepted solution]

Hi CraigV123,

With Cortex XDR Prevent, only the XDR Agent information can be ingested into XDR console, an XDR Pro license allows you to ingest alerts from 3rd party sources (including NGFW) and a Pro per TB license allows you to ingest the raw logs.  Please refer to this doc page with detailed information on capabilities per license type (https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/cortex-xdr-overview/cortex-...).

Correction: You can use the AD integration feature to bring in data from AD for alerts and incidents.  It's the Identity Analytics that you won't be able to utilize.  Check out https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/get-started-with-cortex-xdr... for information on configuring this.

[CraigV123]

I appreciate the response and additional information. Trying to get our organization to see the benefit in the upgrade. This sort of stuff helps.