...
The document includes the following topics:
| Table of Contents |
|---|
Supported Versions
A list of supported versions is available in the Accenture MDR Supported Products List document (Accenture_MDR_Supported_Products_List.xlsx) which can be found in Accenture MDR Portal.
...
Configuring Windows via Palo Alto Cortex XDR
Device configuration for Log collection:
We have to generate the following items from the Cortex XDR app to fetch events from API:
...
The following steps describe how to generate the necessary key values:
Get your Cortex XDR API Key:
In Cortex XDR, navigate to Settings > Configurations > Integrations > API Keys.
Select + New Key.
Choose the type of API Key you want to generate based on your desired security level:
Advanced or Standard. (MxDR recommend to use Advanced API key because the Advanced API key hashes the key using a nonce, a random string, and a timestamp to prevent replay attacks)
If you want to define a time limit on the API key authentication, mark Enable Expiration Date and select the expiration date and time.
Provide a comment that describes the purpose for the API key, if desired.
Select the desired level of access for this key.
Select access role as Viewer
Generate the API Key
Copy the API key, and then click Done. This value represents your unique
Authorization:{key}
Note: You will not be able to view the API Key again after you complete this step. Ensure that you copy it before closing the notification.
Get your Cortex XDR API Key ID
In the API Keys table, locate the ID field
Note your corresponding ID number
Get FQDN:
Right-click your API key and select View Examples
Copy the CURL Example URL.
...
Create Target dataset:
Using present preset consumes higher compute units. To optimize compute unit usage, vendor has recommended to create custom target dataset and use the dataset to pull logs.
Please create dataset on the console using below XQL query or contact Vendor Support:
...