Palo Alto Cortex Xsiam

introduction this guide tells you how to authenticate the cortex xsiam connector in swimlane using api key authentication you will generate an api key, collect the required identifiers, and configure the connector in swimlane prerequisites cortex xsiam access requirements you must have permissions to access the cortex xsiam console create and manage api keys access the cortex xsiam public api view incidents and alerts manage api integrations required credentials during setup, you will collect api url api key api key id cortex xsiam setup take the following steps to generate an api key log in to your cortex xsiam tenant navigate to settings > configurations > integrations > api keys click + new api key enter a descriptive name for the key select the appropriate role or permissions required for the integration (optional) configure an expiration date for the api key click generate copy and securely save the api key this saved value is your authorization value in swimlane take the following steps to collect the api key id navigate to settings > configurations > integrations > api keys locate the api key you created copy the api key id this value is your x xdr auth id in swimlane take the following steps to collect the api url log in to your cortex xsiam tenant copy your tenant url from the browser example https //api \<tenant> xdr \<region> paloaltonetworks com use your tenant url as the url value in swimlane connector configuration in swimlane log in to turbine from the left hand navigation pane, click orchestration and click assets asset homepage opens click the plus icon to open the configure your connector asset window select cortex xsiam from the asset type list fill in the asset settings and asset input as shown field description required/optional url cortex xsiam tenant api url required authorization api key generated in cortex xsiam required x xdr auth id api key id required verify ssl enable/disable ssl verification optional http proxy optional proxy configuration optional fields with marks are required click create troubleshooting authentication failed (401 unauthorized) verify that the api key is valid the api key has not expired the api key id matches the api key the tenant url is correct permission denied (403 forbidden) verify that the api key has sufficient permissions your role allows access to cortex xsiam apis api access is enabled for your tenant ssl errors if ssl verification fails verify that your cortex xsiam endpoint uses a trusted ssl certificate confirm that any proxy or firewall is not interfering with ssl traffic disable verify ssl only for testing if permitted by your organization's security policy result you have successfully authenticated the cortex xsiam connector in swimlane sources cortex xsiam rest api documentation https //docs cortex paloaltonetworks com/r/cortex xsiam/cortex xsiam api https //docs cortex paloaltonetworks com/r/cortex xsiam/cortex xsiam api cortex xsiam api authentication documentation https //docs cortex paloaltonetworks com/r/cortex xsiam/cortex xsiam api/get started with cortex xsiam apis https //docs cortex paloaltonetworks com/r/cortex xsiam/cortex xsiam api/get started with cortex xsiam apis cortex xsiam api keys documentation https //docs cortex paloaltonetworks com/r/cortex xsiam/cortex xsiam administrator guide/api keys https //docs cortex paloaltonetworks com/r/cortex xsiam/cortex xsiam administrator guide/api keys