External integrations - Administrator Guide - Cortex XDR - Cortex

External integrations - Administrator Guide - Cortex XDR - Cortex - Security Operations

Cortex XDR Documentation

Product

Cortex XDR

Creation date

2024-03-06

Last date published

2024-12-02

Notice

External integrations are available in Cortex XDR Pro only.

You can integrate external threat intelligence services with Cortex XDR that provide additional verification sources for each key artifact in an incident. Cortex XDR supports the following integrations:

Threat intelligence

Integration	Description
WildFire	Cortex XDR automatically includes WildFire threat intelligence in the incident and alert investigation. WildFire detects known and unknown threats, such as malware. The WildFire verdict contains detailed insights into the behavior of identified threats. The WildFire verdict is displayed next to relevant Key Artifacts in the incidents details page. See Review WildFire analysis details for more information.
VirusTotal	VirusTotal provides aggregated results from over 70 antivirus scanners, domain services included in the block list, and user contributions. The VirusTotal score is represented as a fraction. For example, a score of 34/52 means out of 52 queried services, 34 services determined the artifact to be malicious. To view VirusTotal threat intelligence in Cortex XDR incidents, you must obtain the license key for the service and add it to the Cortex XDR Configuration. When you add the service, the relevant VirusTotal (VT) score is displayed in the incident details page under Key Artifacts.

Integration

Description

WildFire

Cortex XDR automatically includes WildFire threat intelligence in the incident and alert investigation.

WildFire detects known and unknown threats, such as malware. The WildFire verdict contains detailed insights into the behavior of identified threats. The WildFire verdict is displayed next to relevant Key Artifacts in the incidents details page. See Review WildFire analysis details for more information.

VirusTotal

VirusTotal provides aggregated results from over 70 antivirus scanners, domain services included in the block list, and user contributions. The VirusTotal score is represented as a fraction. For example, a score of 34/52 means out of 52 queried services, 34 services determined the artifact to be malicious.

To view VirusTotal threat intelligence in Cortex XDR incidents, you must obtain the license key for the service and add it to the Cortex XDR Configuration. When you add the service, the relevant VirusTotal (VT) score is displayed in the incident details page under Key Artifacts.

Incident management

Integration	Description
Third-party ticketing systems	To manage incidents from the application of your choice, you can use the Cortex XDR API Reference to send alerts and alert details to an external receiver. After you generate your API key and set up the API to query Cortex XDR, external apps can receive incident updates, request additional data about incidents, and make changes such as setting the status and changing the severity or assigning an owner. To get started, see the Cortex XDR API Reference guide.

Integration

Description

Third-party ticketing systems

To manage incidents from the application of your choice, you can use the Cortex XDR API Reference to send alerts and alert details to an external receiver. After you generate your API key and set up the API to query Cortex XDR, external apps can receive incident updates, request additional data about incidents, and make changes such as setting the status and changing the severity or assigning an owner. To get started, see the Cortex XDR API Reference guide.