cancel
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Announcements
Please sign in to see details of an important advisory in our Customer Advisories area.

Who Me Too'd this topic

Cortex XDR and Splunk.

L3 Networker

Does anyone have a working solution to export Cortex XDR alerts into Splunk?

 

We have tried to use Syslog but support was dropped by the PAN Splunk App Team for that in favor of the API which only pulls Incident data(no alerts) and a link back to the XDR console, none of the data is able to be mapped in Splunk ES for alerting. 

 

We have tired to write a custom microservice to pull Alert Data only to find there is no correlation or wildfire verdict data in the alerts table. When then tried to pull 'extended' incident data only to get blocked as the API limits you to 10 requests / min. 

 

We have tried to forward the data over the CDL like we do with our firewalls and HEC, but that was blocked as well since you don't have access to XDR data from the CDL. 

 

Do we have any options? 

Who Me Too'd this topic