Sending cases of MDR Unit 42 Managed Services cortex XDR to tickiting system

[A.BELKAHLA]

Hello,

I hope you all doing well, i want to send case investigated by MDR to our internal tickiting system (regardless of it, the importing that it support API, webhook ...).

Can you please share a refference or documentation on how to do it on cortex side, and the configuration i need to deploy on Cortex XDR.

Best regards,

[susekar · Accepted solution]

Hello @A.BELKAHLA ,

Greetings for the day.

To send incidents investigated by Cortex XDR (and the MDR team) to your internal ticketing system, you can use the Cortex XDR Public API.

Cortex XDR Public API

If your ticketing system retrieves incidents instead of receiving them, use the Cortex XDR Public API.

Useful API endpoints:

• POST /incidents/get_incidents/ – Retrieves incidents based on filters.
• POST /incidents/get_incident_extra_data/ – Retrieves detailed information for a specific incident.
  
  

To use the API, generate an API Key and API Key ID under:

Settings → Configurations → Integrations → API Keys

Ensure the API key has the required permissions, such as Security Admin or Instance Administrator.

For additional details, refer to:

• Cortex XDR API Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-5.x-Documentation/Cortex-XDR-API-Re...
• Data and Log Forwarding: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-5.x-Documentation/Data-and-log-forw...

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar