XDR 4 - Integrations AD Query

[tlmarques]

Hi everyone, on Cortex XDR 4 ,we can build small playbooks, and one of the available actions is AD Query.
My question is: what is required to configure this integration?

I see that the integration asks for the IP address, domain user, and other parameters, but if the Active Directory is on-premises, how does Cortex XDR establish the connection?
What does the workflow look like?

Is a Broker VM required?

[susekar]

Hello @tlmarques ,

Greetings for the day!

To configure the AD Query (specifically the Active Directory Query v2) action within Cortex XDR 4 playbooks, you must integrate your on-premises Active Directory through the Automation and Feed Integrations section.

Configuration Requirements:
The integration requires the following parameters to be configured in the instance settings:
* IP Address/FQDN: The internal address of your Domain Controller.
* Credentials: A domain user and password with sufficient permissions to perform LDAP queries.
* Port: Typically TCP 636 for LDAPS (LDAP over SSL).
* Engine selection: You must select an Engine (Broker VM) for the integration instance to run on if you are reaching an on-premises resource.

Connection and Workflow:
Cortex XDR establishes the connection to an on-premises Active Directory using one of two methods:

-Via Broker VM (Recommended):
The Broker VM acts as the Engine (execution point) for the playbook integration.
Workflow: When a playbook triggers an AD Query action, the Cortex XDR cloud sends the request to the assigned Broker VM. The Broker VM then performs the LDAP/S query locally within your network to the Domain Controller and returns the results to the cloud console.

Direct Cloud Connection:
In some configurations, Cortex XDR can initiate a direct connection from the cloud to your on-premises AD via its public IP.
This requires you to whitelist specific Cortex XDR egress IP addresses on your external firewall (e.g., 34.147.67.188 and 34.90.16.31 for the EU region) to allow inbound traffic on port 636.

Is a Broker VM required?
Yes, a Broker VM is required if you want to use it as an Engine to securely bridge the communication between the cloud playbook and your internal network without opening inbound ports (like 636) on your perimeter firewall to the entire internet or specific cloud ranges.

To set this up:
1. Deploy a Broker VM and ensure it has the Automation capabilities enabled .
2. In Settings > Configurations > Integrations > Automation & Feed Integrations, find the Active Directory Query v2 pack.
3. Add an instance and select your Broker VM in the Engine field .

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar