Unified Inventory

[sh4unz0r]

Hello,

I have come across references to 'Unified Inventory' in the documentation for XSIAM, Xpanse, and Prisma Cloud. Could anyone please clarify if this is a single offering from Palo Alto Networks or specifically from Cortex? Alternatively, do these products each refer to their own inventory feature as being 'unified'?

Ex: https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/Unified-Ass...

It is unclear to me whether all Cortex products share and enrich a single IT asset inventory. I have been unable to locate any specific documentation on this feature.

I would greatly appreciate any demo links or in-depth documentation on Cortex Inventory that you can share.

Thank you for your assistance!

[afurze · Accepted solution]

Hi Sh4unz0r,

Naming of the various products inventory UIs do cause confusion.  The Unified Asset Inventory is a new feature available for XSIAM customers which presents a revamped view of all your assets with a breakdown on where we are getting the data and aggregation for assets that have data from multiple sources.  It also gives you the capability to ingest asset and vulnerability data from 3rd party solutions (currently Tenable.io and Prisma Cloud are supported).

The Unified Inventory in Cortex Xpanse is just a view of assets discovered by Xpanse.

The Unified Asset Inventory in Prisma Cloud is just a view of hosts, containers, and container images known to Prisma Cloud.

[sh4unz0r]

Thanks @afurze, I have a couple more questions around XSIAM Unified Asset Inventory if you will entertain me.
1. Do you know if it has an API that can accept assets from legacy or other sources 
2. I think I had seen info about ServiceNow integration somewhere?
3. Does the unified asset inventory allow for custom fields/data enrichment?
4. Lastly any demos or documentation on this new feature would be super helpful!

[afurze]

Sh4unz0r,

There is no API available for inserting asset information currently.  As a part of the UAI beta, two integrations from the marketplace have the ability to ingest asset and vulnerability data (Prisma Cloud, and Tenable.io), no other sources are currently supported.  Other sources have been and continue to be able to ingest asset information including NGFW, Cloud Inventory, and ServiceNow CMDB.

No customization is available and, as this is still in beta, no documentation is currently available, you can discuss with your Customer Success team for additional information.