Page Comparison

...

The document includes the following topics:

Supported Versions

A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.

...

Configuring Windows via Palo Alto Cortex XDR

Device configuration for Log collection:

We have to generate the following items from the Cortex XDR app to fetch events from API:

...

The following steps describe how to generate the necessary key values:

Get your Cortex XDR API Key:

1. In Cortex XDR, navigate to Settings > Configurations > Integrations > API Keys.

2. Select + New Key.

3. Choose the type of API Key you want to generate based on your desired security level:

   1. Advanced or Standard. (MxDR recommend to use Advanced API key because the Advanced API key hashes the key using a nonce, a random string, and a timestamp to prevent replay attacks)

4. If you want to define a time limit on the API key authentication, mark Enable Expiration Date and select the expiration date and time.

5. Provide a comment that describes the purpose for the API key, if desired.

6. Select the desired level of access for this key.

7. Select access role as Viewer

8. Generate the API Key

9. Copy the API key, and then click Done. This value represents your unique Authorization:{key}

Note: You will not be able to view the API Key again after you complete this step. Ensure that you copy it before closing the notification.

Get your Cortex XDR API Key ID

1. In the API Keys table, locate the ID field

2. Note your corresponding ID number

Get FQDN:

1. Right-click your API key and select View Examples

2. Copy the CURL Example URL. The example contains your unique FQDN:

https://api-{fqdn}/public_api/v1/{name of api}/{name of call}/

Note: The example contains your unique FQDN:

 Create Target dataset:

• Using present preset consumes higher compute units. To optimize compute unit usage, vendor has recommended to create custom target dataset and use the dataset to pull logs.

• Please create dataset on the console using below XQL query or contact Vendor Support:

...

LCP Configuration Parameters

Table 1-2: The Windows via Palo Alto Cortex XDR event collector (API- 50094017) sensor properties to be configured by MDR are shown in the table.