Activate Pathfinder - Administrator Guide - Cortex XDR - Cortex XSIAM - Cortex - Security Operations

In Cortex XDR, select Settings → Configurations → Data Broker → Broker VMs and locate your broker VM.

You can either right-click the broker VM and select Add App → Pathfinder, or hover in the APPS column, and select Add → Pathfinder.

In the Pathfinder Activation wizard, complete the following steps:

1. Define the Pathfinder Credentials used by the applet to access and deploy the data collector. The Data Collector is deployed only within the ranges of your defined IP address ranges. You can either select to define the domain access credentials or alternatively, as of broker VM version 9.0 and later, you can define Pathfinder to access target hosts using credentials stored in your CyberArk vault.

   Note

   The Broker VM requires an SA account that has administrator privileges on all Windows workstations and servers in your environment. Due to this, Cortex XDR recommends you limit the number of users granted access to the SA account as it poses a credential compromise security threat.

   • Domain—Domain name of your network.

   • Domain Suffixes—(Optional) Domain suffixes required for DNS resolving within your network. The domain suffixes list is read-only and populated by your defined Network Configurations.

   • Authentication Method—Select either Kerberos or NTLM.

     Tip

     When selecting Kerberos, the Broker has access to domain controllers over port 88 and is able to acquire the authentication ticket. It is recommended to use Kerberos for better security.

   • Define the access credentials using either Domain Credentials or your CyberArk AAM parameters.

     To define the access credentials, enter:

     • User Name—User name used by Pathfinder to access your target host.

     • Password—Password used by Pathfinder to access your target host.

       Note

       Only encrypted credentials are stored on the broker VM.

     To allow Pathfinder to use credentials stored in your CyberArk vault, enter the following parameters. Make sure you are following the CyberArk guidelines.

     • URL—Your CyberArk AAM URL address.

     • Port—Your CyberArk AAM port number.

     • App ID—The application ID configured in your CyberArk AAM. The ID allows you to access the path to where credentials are stored in the CyberArk vault.

     • Query—Define the CyberArk AAM path to the credentials required by Pathfinder to access the host. Make sure you are following the CyberArk formatting guidelines.

     • Browse for your Client Certificate, Client Key, and CA Certificate you use to identify. Cortex XDR will notify you when your certificates are about to expire.

     Note

     Credentials are not stored on the broker VM, Pathfinder queries CyberArk each time according to the defined parameters.

   • Test the credentials and pathfinder permissions to ensure the broker VM can successfully collect data from your defined hosts.

     Note

     Testing may take a few minutes to complete but ensures that pathfinder can indeed deploy a data collector.

   Select Next.

2. Define the data collector settings.

   • Select on which Targets to deploy the data collector. Target types are detected according to your operating system.

     • All—Deploy on all assets within your network.

     • Servers—Deploy only on servers.

     • Workstations—Deploy only on workstations.

   • Define the Proxy Settings.

     By default the proxy settings are disabled, data collected is sent directly to the cloud. If you want to enable the proxy, select one of the following options:

     • Use Agent Proxy Settings—Data collected will be routed using the settings provided in the Agent Proxy Applet must be enabled for this settings to work.

     • Use Custom Proxy—Define the IP address and port to route the data.

   Select Next.

3. Select the IP Address Ranges to scan from your defined Network Configurations and deploy the data collector. You can Add IP Address Ranges if you don’t see a range in the populated list.

   By default, every IP address range will use the Pathfinder credentials and settings you defined in the Credentials section and is labeled as an Applet Configuration.

   If you want configure other credentials for a specific range, use the right pane to override the settings. IP address ranges you edit are labeled as a Custom Configuration. Make sure to Test the credentials for this specific range.

   Note

   The Pathfinder configuration must contain at least one IP address range to run. To avoid a collision, IP address ranges can only be associated with one pathfinder applet.

4. Activate your Pathfinder.

   After a successful activation, the APPS field displays Pathfinder with a green dot indicating a successful connection.

(Optional) To view metrics about the Pathfinder applet, hover over the Pathfinder connection displayed in the APPS field for your broker VM:

Manage the Pathfinder.

Hover over the Pathfinder connection in the APPS column to display the Pathfinder settings, and select:

Track the Pathfinder Data Collector.

After the Pathfinder collector has been triggered, when an analytics type alert is triggered on an unmanaged host, the data collector is deployed to unmanaged assets within the defined IP address ranges and domain names.

To track the data collector:

1. In Cortex XDR , select Settings → Configurations → Data Broker → Broker VMs → Pathfinder Collection Center.

   The Pathfinder Collection Center table displays the following fields about each of the deployed collectors:

   Field	Description
   Collector Install Time	Timestamp of when the collector was installed in the host.
   Initiating Alert ID	Displays the Alert ID of the analytics alert that triggered the collector.
   Initiating VM	Name of the broker VM initiating the collector.
   Last Seen	Timestamp of the last collector heartbeat.
   Result	Status of the collection process. Can be: Collection Completed Collection Completed
   Start Time	Timestamp of when the collector was triggered.
   Status	Status of the collector on the host, which can be one of the following: Pending Running Completed Failed Removed
   Target IP	IP Address of the host scanned by the collector.

2. Manage the collector.

   • Set the number of collectors you want deployed. Set Collectors Number to limit the number of collectors you want to deploy in your environment.

   • Locate the collector, right-click and select:

     • Remove Collector—Uninstall the collector from the host.

     • View Initiating alert—Pivot to the Alerts Table filtered according to the initiating alert.

     • Retrieve Logs—Upload logs from the collector

     • Download Logs—Download the collector logs to your local machine.

     When you select and right-click the Target IP field, you can choose to view the IP address in the IP View or Open in Quick Launcher.

Query the collector data.

Data gathered by the data collector can be queried and investigated from the Query Center. To run a query on the EDR data from an unmanaged host:

1. Navigate to Investigation → Query Center.

2. Select the type of query you want to run and enter the search criteria.

   When defining the Host attributes, for INSTALLATION TYPE make sure to select Data Collector.

3. View your query results.