Cortex XSOAR queries

[Vinothkumar_SBA]

Hi Team,

We planned to integrate the IOC push from Cortex XSOAR to other tools, for example, Palo Alto firewalls, other firewalls, SIEM tools, and XDR tools. Is this possible? If so, could you please share any documentation or guidance?

[ysato]

Hi @Vinothkumar_SBA 

You should use External Dynamic List for this.

How-to Video: https://live.paloaltonetworks.com/t5/cortex-xsoar-how-to-videos/cortex-xsoar-8-how-to-video-external...

Integration Document: https://xsoar.pan.dev/docs/reference/integrations/edl

[Vinothkumar_SBA]

Hi@Ysato,

Thank you for your response and valuable feedback. If possible, could you suggest another method of integration that doesn't require expertise in EDL?

[ysato]

The other option is to utilize integration for platforms that you want to push IOCs from XSOAR.

For XDR, there is an integration called "Cortex XDR - IOC" that you can use to push IOCs.

For the firewall, you can see if there is any command for integration called "PAN-OS by Palo Alto Networks".