Set up and configure Broker VM - Learn more about how to set up and configure a Broker VM as a standalone broker or add the broker to a high availability (HA) cluster. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Select Settings → Configurations → Data Broker → Broker VMs.

Click Add Broker → Generate Token, and copy to your clipboard. The token is valid for 24 hours. A new token is generated each time you select Generate Token.

You'll paste this token after configuring settings and the Broker VM is registered in Task 2. Register your Broker VM.

Define the network interfaces settings.

Review the pre-configured Name, IP address, and MAC Address, and select the Address Allocation: DHCP (default) or Static. If you choose Static, define the static IP address, Netmask, Default Gateway, and DNS Server settings, and then save your configurations.

You can also specify which of the network interfaces is designated as the Admin and can be used to access the Broker VM web interface. Only one interface can be assigned for this purpose from all of the available network interfaces on the Broker VM, and the rest should be set to Disable.

(Optional) Set the internal network settings (requires Broker VM 14.0.42 and later).

Specify a network subnet to avoid the Broker VM dockers colliding with your internal network. By default, the Network Subnet is set to 172.17.0.1/16.

(Optional) Configure a proxy server address and other related details to route Broker VM communication.

1. Select the proxy Type as HTTP, SOCKS4, or SOCKS5.

   For any proxy selected, you must ensure the proxy supports HTTP/2, gRPC-specific headers, and HTTP/2 trailers, and the inspection policies support gRPC traffic. Any devices that you use with this configuration should also support these standards.

   Note

   You can configure another Broker VM as a proxy server for this Broker VM by selecting the HTTP type. When selecting HTTP to route Broker VM communication, you need to add the IP Address and Port number (set when activating the Agent Proxy) for another Broker VM registered in your tenant. This designates the other Broker VM as a proxy for this Broker VM.

2. Specify the proxy Address (IP or FQDN), Port, and an optional User and Password. Select the pencil icon to specify the password. Avoid using special characters in the proxy username and password.

3. Save your configurations.

(Optional) Configure your NTP servers (requires Broker VM 8.0 and later).

Specify the required server addresses using the FQDN or IP address of the server.

(Optional) Allow SSH connections to the Broker VM (Requires Broker VM 8.0 and later).

Enable or disable SSH connections to the Broker VM. SSH access is authenticated using a public key, provided by the user. Using a public key grants remote access to colleagues and Cortex XDR support who need the private key. You must have Instance Administrator role permissions to configure SSH access.

To enable connection, generate an RSA Key Pair, and enter the public key in the SSH Public Key section. Once one SSH public key is added, you can Add Another. When you are finished, Save your configuration.

When using PuTTYgen to create your public and private key pairs, you need to copy the public key generated in the Public key for pasting into OpenSSH authorized_keys file box, and paste it in the Broker VM SSH Public Key section as explained above. This public key is only available when the PuTTYgen console is open after the public key is generated. If you close the PuTTYgen console before pasting the public key, you will need to generate a new public key.

When you SSH the Broker VM using PuTTY or a command prompt, you need to use the admin username. For example:

ssh -i [/path/to/private.key] admin@[broker_vm_address]

(Optional) Update the SSL Server certificates for the Broker VM.

Upload your signed server certificate and key to establish a validated secure SSL connection between your endpoints and the Broker VM. Ensure the Private Key is uploaded in an unencrypted format. When you configure the server certificate and the key files in the Broker VM, Cortex XDR automatically updates them in the tenant UI. Cortex XDR validates that the certificate and key match, but does not validate the Certificate Authority (CA).

Update the Trusted CA Certificate for the Broker VM.

Upload your Certificate Authority (CA) bundle file associated with the public TLS certificates belonging to the applicable firewalls, and click Save. These applicable firewalls include SSL/TLS decryption. For example, when configuring Palo Alto Networks NGFW to decrypt SSL using a self-signed certificate, you need to ensure the Broker VM can validate a self-signed CA by uploading the cert_ssl-decrypt.crt file on the Broker VM.

(Optional) Configure the advanced settings of the Broker VM.

You can decide whether to use a limited set of strong cipher suites for Broker VM communications by setting the toggle to Only use recommended cipher suites. You must enable this option to comply with Spain’s Esquema Nacional de Seguridad (ENS) National Security Framework. It's critical that you configure this option before you register the Broker VM with a tenant for compliance reasons.

(Optional) Collect and Generate New Logs (Requires Broker VM 8.0 and later). Your Cortex XDR logs will download automatically after approximately 30 seconds.