Cortex XDR Integration with NGFW

[JahidAliyev]

Hello, 

I have Cortex Pro per GB license and NGFW. I have successfully created certificate and it is showing as valid in XDR console. I have created a profile which is sending logs to Data Lake. I have applied it on many policies. But I cannot get NGFW logs in Cortex XDR. 

This is my log forwarding profile:

I suspect that it can be because of the expiration of data lake in my assets tab in supoort portal:

But I think the data lake is no longer used as the licenses have changed. 

Can anybody tell me what is misconfiguration? And, is there latest document or source that is clearly giving instructions for integration steps from zero? 

[jmazzeo]

Hi @JahidAliyev, thanks for reaching us using the Live Community.

Since a few XDR versions back, the NGFW integration needs to be done from the Firewalls or Panorama, no need of Cortex Data Lake or Strata Logging Service.

You can check all the requires steps here: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Ingest-data-from-Next...

If this post answers your question, please mark it as the solution.

[JahidAliyev]

Hello again, 

So we do not need to create a forwarding profile called data lake and apply it on all policies to forward their logs to data lake profile? Can you eloborate more?