XSOAR Sessions and Submissions option

[pottapitot]

Hi,

I came across this documentation regarding XSOAR

https://docs.paloaltonetworks.com/cortex/cortex-xsoar/6-9/cortex-xsoar-threat-intel-management-guide...

The Sessions & Submissions tab enables you to use your sessions and submissions data for investigation and analysis. Sessions and submissions data is available for customers with a TIM license and at least one of the following products:

• Palo Alto Networks Firewall
• WildFire
• Cortex XDR
• Prisma SaaS
• Prisma Access

  Sessions refers to firewall sessions, while Submissions  refers to logs of samples reported to Wildfire from other Palo Alto Networks products. Sessions data shows you connections from one endpoint to another, and submissions data shows you if a file was found on a specific endpoint.

   

  We are using PaloAlto Firewall. Does this mean I send traffic sessions from the PaloAlto firewall to XSOAR and it checks the IPs (realtime or periodically) e.g. source or destination is in the indicator list present in Threat Intel section on XSOAR?

  How does this integration work?

   

  Thanks

[sramesh-7 · Accepted solution]

Hi, 

No, XSOAR does not process or enrich this info, you will only be able to view and query the sessions data generated from your PAN firewall and listed other products.