Palo Alto Cortex XDR - IIS

About The Device

Cortex XDR is the detection and response app that natively integrates network, endpoint, and cloud data to stop sophisticated attacks. It accurately detects threats with behavioral analytics and reveals the root cause to speed up investigations.

Device Information

Collection Method

Port Requirements

Device Configuration

1. Click Start > Administrative Tools > Internet Information Services (IIS) Manager.

2. In the Internet Information Services (IIS) Manager, right-click on Sites, then click the Web Site you want to monitor.

3. In Home page, click Logging.

Open

4. In Logging, in Log File select W3C in Format.

Open

5. In Log File, click Select Fields.

6. In W3C Logging Fields dialog, click to select all fields, then click OK.

7. To get the real source IPs in the IIS hit logs for servers, create a new custom field (Optional Step)

   Field Name = Source-IP Source

Type = Request Header

Source = X-FORWARDED-FOR

6. Perform IIS reset after this. Now we will start seeing the IP address of the client PCs in our IIS logs rather than the IP of the load balancer. 

 To Configure Cortex XDR app

We need to generate the following items from the Cortex XDR app to fetch events from API:

1. API Key: The API Key is your unique identifier used as the Authorization:{key} header required for authenticating API calls.

2. API Key ID: The API Key ID is your unique token used to authenticate the API Key

3. FQDN: The FQDN is a unique host and domain name associated with each tenant. When you generate the API Key and Key ID, you are assigned an individual FQDN.

The following steps describe how to generate the necessary key values:

To Get your Cortex XDR API Key

1. In Cortex XDR, navigate to Settings > Configurations > Integrations > API Keys.

2. Select + New Key

3. Choose the type of API Key you want to generate based on your desired security level: Advanced or Standard. (MxDR recommend to use advanced API key because the Advanced API key hashes the key using a nonce, a random string, and a timestamp to prevent replay attacks)

4. If you want to define a time limit on the API key authentication, mark Enable Expiration Date and select the expiration date and time.

5. Provide a comment that describes the purpose for the API key, if desired.

6. Select the desired level of access for this key. Please select access role as Viewer

7. Generate the API Key

8. Copy the API key, and then click Done. This value represents your unique Authorization:{key} (You will not be able to view the API Key again after you complete this step. Ensure that you copy it before closing the notification.)

To Get your Cortex XDR API Key ID

1. In the API Keys table, locate the ID field

2. Note your corresponding ID number

To Get FQDN

1. Right-click your API key and select View Examples

2. Copy the CURL Example URL. The example contains your unique FQDN:

https://api-{fqdn}/public_api/v1/{name of api}/{name of call}/

Integration Parameters

Parameters required from customer for Integration.