Xsoar - XDR Public API Unauthorised

[michaelsysec242]

I am having difficulty integrating the XDR Integration. I have followed the instructions and have generated an "Advanced Key", copied the Key and the Key ID + URL. I have inserted the relevant details on the Instance Settings. When I perform "Test" I receive "401 Public API Unauthorised". I have tested multiple different roles of API including the Public API "edit" but the system does not budge. Connecting two Cortex Products should be quite straight forward yet I am encountering this error. There is no custom API Request or any custom configuration just a simple instance. I have attempted to configure both the IOC and XQL integration but to no avail. Anyone have an idea on how to fix this ?

Cortex XSOAR 

Cortex XDR 

[RahulVijaydev]

@michaelsysec242 Do you have access to the PaloAltoNetworks support portal? We will need to look at logs, and possibly get on a call to troubleshoot this further. 

[michaelsysec242 · Accepted solution]

Many thanks Rahul,

this error was resolved through the support channel. Initially they recommended a few Permissions on the API Role in XDR. The issue was directly resolved by ensuring that the Time on the Xsoar was up to date and synchronised.   

[RahulVijaydev]

Perfect! Glad you got it resolved.

[Josep]

Hello Michael,

I've the same problem. How did you update and synchronised the XSOAR to solve the problem?

Could be enough to reset the integration? or just clicking on "Reset the "last run" timestamp? 

[michaelsysec242]

No, creating a new integration helped. It appears that the previous one was not allowing the API requests to be authenticated.