Long Running Integration

[bridgetlitt]

Is it possible in xsiam to make a custom data collection integration use the long running integration option (https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Developer-Guide/Long-Running-Co...) or is that only available for integrations that palo alto networks provides? Is this an effective way to get over the 10min docker timeout limit and if yes what is the new limit? will it work without an engine? Also, any detailed documentation on what to include in the integration code would be great too? Thanks! Cortex XSIAM 

[susekar]

Hello @bridgetlitt ,

Greetings for the day.

Yes, it is possible to create a custom data collection integration in Cortex XSIAM using the long-running integration option, but it has specific requirements and restrictions.

Support and Engine Requirements

• Custom long-running integrations are supported only on engines.
• On the Cortex XSIAM tenant, only Palo Alto Networks long-running integrations are supported; custom ones cannot run there.
• The "No engine" option is not supported for custom long-running integrations.
  
  

Important Restrictions:

• send_events_to_xsiam() works only with system/official integrations and is not supported for custom integrations.
• For custom data collection, use the XSIAM ingestion APIs, Syslog forwarding to a Broker VM, or createIncidents if the data is intended as an incident.

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar