XDR related questions

[JahidAliyev]

Hello all, 

I have a few questions related to Cortex XDR and I would be happy if you answer them. 

1. I have a license of Cortex XDR Pro per GB - 100 GB. But I do not have Cortex Data Lake. I want to integrate firewall with Cortex XDR. For this, I can use Broker VM. In order to keep logs in Broker VM for a month, I need 100*30=3 TB storage, But Broker VM only supports 512 GB. How can I get firewall logs with Broker VM and keep them for a month with this license?
2. Can we integrate DNS and DHCP with XDR with the help of collectors? How can we benefit from this integration? And documentation or video to do it?
3. Our XDR tenant is kept on one of the Amazon server. How can we know which Amazon server it is in and this server URL?
4. Is there any documentation which outlines the benefits of integration of firewalls with XDR? 

Thanks in advance...

[Ariq_Aziz · Accepted solution]

Hi

1. Broker VM doenst store logs as par my understanding. Its a proxy. You can add FW in collection integrations  and it will consume logs.

2. DHCP you can integrate. Follow the Guide: Collection Integrations • Cortex XDR Pro Administrator Guide • Reader • Palo Alto Networks documenta...
For DNS, you have to add WEC (windows Event collector) Azure event hub/Network Watcher. You have to configure these things properly. 

3. XDR is SAAS solution. YOu get the URL from HUB. Login and Check your apps. If you have permissio to access, you can ge the URL. However, im not sure what do u mean by Which Server and the URL or the thing you are looking for.

4. This one is bit tricky . Contact your sales /system engineer for proper documentation. However from my point of view, if you monitor XDR on regular basis and if you have a proper dashboard- A Customized one, you will get proper outputs from XDR. I believe it depends on your skills like which widget you want to add in the dashboard for monitoring purpose.

The summary is , the benefit depends on how you want to monitor things. For Log Analysis XDR will generate incidents/alerts and you have to take a look in to those . We have MDR and they keep 24/7 monitoring. For FW's health monitor We use NG-AIOPS free version. that is enough for us as we have automated Email notifications with some simple policies. 

Hope these helps.