Dropbox - Learn more about the Dropbox standard data source and content pack integrations in Cortex XDR. - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR 5.x Documentation
Product
Cortex XDR
License
XDR + Cloud
Creation date
2025-07-13
Last date published
2026-06-11
Category
Administrator Guide
Abstract

Learn more about the Dropbox standard data source and content pack integrations in Cortex XDR.

You can configure collecting Dropbox logs and data using a standard data source or with a content pack integration:

Dropbox vendor

Description

Standard data source overview

Forward different types of data from Dropbox Business accounts to Cortex XDR using the Dropbox data source.

Link to standard data source instructions

The following types of data can be ingested from Dropbox:

  • Log collection

    • Events

  • Directory and metadata

    • Member Devices

    • Users

    • Groups

For more information, see Ingest logs and data from Dropbox.

Links to content pack/ integration details

The Dropbox content pack fetches and collects security events from Dropbox logs. It includes Correlation Rules, Modeling Rules, Parsing Rules, a Playbook, and a Cortex XDR Dashboard. It also includes the following integration:

  • Dropbox Event Collector: Use this integration to collect events from Dropbox logs. It contains commands such as dropbox-auth-start to initiate the authorization process, dropbox-auth-complete to finish authorization, dropbox-auth-test to check connectivity, dropbox-auth-reset to reset authentication, and dropbox-get-events to retrieve events.