Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions packages/panw_cortex_xdr/_dev/build/docs/README.md
Original file line number Diff line number Diff line change
@@ -1,15 +1,14 @@
# Palo Alto Cortex XDR Integration

The PANW XDR integration collects events from the Cortex XDR API, specifically reading from the Alert API.
The PANW XDR integration collects alerts with multiple events from the [Cortex XDR API,](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/incident-management/get-alerts).

## Logs

### Alerts

The Cortex XDR Alerts API is used to retrieve alerts generated by Cortex XDR based on raw endpoint data. A single alert might include one or more local endpoint events, each event generating its own document on Elasticsearch.

The Palo Alto XDR integration requires both an API key and API key ID, both which can be retrieved from the Cortex XDR UI:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis.html
The Palo Alto XDR integration requires both an API key and API key ID, both which can be retrieved from the Cortex XDR UI. See: [Get Started with Cortex XDR API](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis.html)

{{event "alerts"}}

Expand Down
5 changes: 5 additions & 0 deletions packages/panw_cortex_xdr/changelog.yml
Original file line number Diff line number Diff line change
@@ -1,4 +1,9 @@
# newer versions go on top
- version: "1.2.1"
changes:
- description: Updated the links in the file to Palo Alto Cortex XDR documentation
type: enhancement
link: https://github.com/elastic/integrations/pull/3144
- version: "1.2.0"
changes:
- description: Update to ECS 8.2 to use new email field set.
Expand Down
5 changes: 2 additions & 3 deletions packages/panw_cortex_xdr/docs/README.md
Original file line number Diff line number Diff line change
@@ -1,15 +1,14 @@
# Palo Alto Cortex XDR Integration

The PANW XDR integration collects events from the Cortex XDR API, specifically reading from the Alert API.
The PANW XDR integration collects alerts with multiple events from the [Cortex XDR API,](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-apis/incident-management/get-alerts).

## Logs

### Alerts

The Cortex XDR Alerts API is used to retrieve alerts generated by Cortex XDR based on raw endpoint data. A single alert might include one or more local endpoint events, each event generating its own document on Elasticsearch.

The Palo Alto XDR integration requires both an API key and API key ID, both which can be retrieved from the Cortex XDR UI:
https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis.html
The Palo Alto XDR integration requires both an API key and API key ID, both which can be retrieved from the Cortex XDR UI. See: [Get Started with Cortex XDR API](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-api/cortex-xdr-api-overview/get-started-with-cortex-xdr-apis.html)

An example event for `alerts` looks as following:

Expand Down
2 changes: 1 addition & 1 deletion packages/panw_cortex_xdr/manifest.yml
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
name: panw_cortex_xdr
title: Palo Alto Cortex XDR Logs
version: 1.2.0
version: 1.2.1
release: ga
description: Collect and parse logs from Palo Alto Cortex XDR API with Elastic Agent.
type: integration
Expand Down