splunk
Palo Alto Cortex XDR Alert Retriever
Splunk Cloud
This app is NOT supported by Splunk. Please read about what that means for you here.
Overview
Details
App to pull alert information from Palo Alto's Cortex XDR Get Alerts API endpoint.
Description
Addon to pull alert information from Palo Alto's Cortex XDR Get Alerts API endpoint.
- Built for Splunk Enterprise 8.0.0 or higher
- Ready for Enterprise Security
Constraints / Requirements
The app can be installed on a forwarder or a search head (in the case of Cloud Victoria Experience).
The default sourcetype for this addon is cortex:xdr:alerts, which by default will poll the Cortex XDR API once per minute.
INSTALLATION AND CONFIGURATION
Installation Instructions
- Install the app on a forwarder or search head, depending on your environment configuration.
- Enter your API credentials, organization name, and authentication settings on the Configuration page. Your organization name can be found in your Cortex XDR console.
- Configure your input under the Inputs tab as needed. By default, the input runs once every 5 minutes.
New features
Version 1.4.4 is the eighth release.
Fixed issues
Updates Splunk Python SDK to version 2.0.2
Known issues
None
Third-party software attributions
DEV SUPPORT
This app is provided as-is. No additional support is provided
Release Notes
Version 1.4.4
Sept. 25, 2024
Updates Splunk Python SDK to version 2.0.2
Version 1.4.3
Dec. 8, 2023
Updates Add-On Builder files to version 4.1.4 and adds ability to change XDR region in configuration.
Version 1.4.1
Aug. 4, 2023
- Addon updated to use server_response_time, which fixes issue of missing events.
- Contains field extractions, event types, and tags to make events CIM compliant with Alerts datamodel. By default, this will work only when installed with Cloud Victoria Experience, but can be used as a template for non-Victoria and on-prem installs.