03-29-2022 03:59 PM
Does anyone have a working solution to export Cortex XDR alerts into Splunk?
We have tried to use Syslog but support was dropped by the PAN Splunk App Team for that in favor of the API which only pulls Incident data(no alerts) and a link back to the XDR console, none of the data is able to be mapped in Splunk ES for alerting.
We have tired to write a custom microservice to pull Alert Data only to find there is no correlation or wildfire verdict data in the alerts table. When then tried to pull 'extended' incident data only to get blocked as the API limits you to 10 requests / min.
We have tried to forward the data over the CDL like we do with our firewalls and HEC, but that was blocked as well since you don't have access to XDR data from the CDL.
Do we have any options?
