Configure the Broker VM - Administrator Guide - Cortex XDR - Cortex - Security Operations

In Cortex XDR , select Settings → Configurations → Data Broker → Broker VMs.

Add Broker and install the Broker VM images for your corresponding infrastructure:

Select Add Broker → Generate Token, and copy to your clipboard.

Navigate to either of the following URLs, which is dependent on the Broker VM version you are using:

Log in with the default password !nitialPassw0rd and then define your own unique password.

Configure your Broker VM settings:

1. In the Network Interface section, review the pre-configured Name, IP address, and MAC Address, and select the Address Allocation: DHCP (default) or Static. You can also specify which of the network interfaces is designated as the Admin and can be used to access the Broker VM web interface. Only one interface can be assigned for this purpose from all of the available network interface on the Broker VM, and the rest should be set to Disable.

   • If you choose Static, define the following and Save your configurations:

     • Static IP address

     • Netmask

     • Default Gateway

       Important

       When configuring more than one network interface, ensure that only one Default Gateway is defined. The rest must be set to 0.0.0.0, which configures them as undefined.

     • DNS Server

2. (Requires Broker VM 14.0.42 and later) (Optional) Internal Network

   Specify a network subnet to avoid the Broker VM dockers colliding with your internal network. By default, the Network Subnet is set to 172.17.0.1/16.

   Note

   Internal IP must be:

   • Formatted as prefix/mask, for example 192.0.2.1/24.

   • Must be within /8 to /24 range.

   • Cannot be configured to end with a zero.

   For Broker VM version 9.0 and lower, Cortex XDR will accept only 172.17.0.0/16.

3. (Optional) Configure a Proxy Server address and other related details to route Broker VM communication.

   • Select the proxy Type as HTTP, SOCKS4, or SOCKS5.

     Note

     You can configure another Broker VM as a Proxy Server for this Broker VM by selecting the HTTP type. When selecting HTTP to route Broker VM communication, you need to add the IP Address and Port number (set when activating the Agent Proxy) for the other Broker VM registered in your tenant that you want to designate as a proxy for this Broker VM.

   • Specify the proxy Address (IP or FQDN), Port, and an optional User and Password. Select the pencil icon to specify the password.

     Important

     Avoid using special characters in the proxy username and password.

   • Save your configurations.

4. (Optional) (Requires Broker VM 8.0 and later) Configure your NTP servers.

   Specify the required server addresses using the FQDN or IP address of the server.

5. (Requires Broker VM 8.0 and later) (Optional) In the SSH Access section, Enable or Disable SSH connections to the Broker VM. SSH access is authenticated using a public key, provided by the user. Using a public key grants remote access to colleagues and Cortex XDR support who the private key. You must have Instance Administrator role permissions to configure SSH access.

   To enable connection, generate an RSA Key Pair, enter the public key in the SSH Public Key section. Once one SSH public key is added, you can +Add Another. When you are finished, Save your configuration.

   When using PuTTYgen to create your public and private key pairs, you need to copy the public key generated in the Public key for pasting into OpenSSH authorized_keys file box, and paste it in the Broker VM SSH Public Key section as explained above. This public key is only available when the PuTTYgen console is open after the public key is generated. If you close the PuTTYgen console before pasting the public key, you will need to generate a new public key.

   When you SSH the Broker VM using PuTTY or a command prompt, you need to use the admin username. For example:

   ssh -i [/path/to/private.key] admin@[broker_vm_address]

6. (Requires Broker VM 10.1.9 and later) (Optional) In the SSL Server Certificate section, upload your signed server certificate and key to establish a validated secure SSL connection between your endpoints and the Broker VM. When you configure the server certificate and the key files in the Broker VM UI, Cortex XDR automatically updates them in the tenant UI. Cortex XDR validates that the certificate and key match, but does not validate the Certificate Authority (CA).

   Note

   The Palo Alto Networks Broker supports only strong cipher SHA256-based certificates. MD5/SHA1-based certificates are not supported.

7. In the Trusted CA Certificate section, upload your signed Certificate Authority (CA) certificate or Certificate Authority chain file in a PEM format with the associated key, and click Save. If you use SSL decryption in your firewalls, you need to add a trusted self-signed CA certificate on the Broker VM to prevent any difficulties with SSL decryption. For example, when configuring Palo Alto Networks NGFW to decrypt SSL using a self-signed certificate, you need to ensure the Broker VM can validate a self-signed CA by uploading the cert_ssl-decrypt.crt file on the Broker VM.

   Note

   If adding a CA certificate to the Broker VM is not possible, ensure that you’ve added the Broker Service FQDNs to the SSL Decryption Exclusion list on your firewalls. See Enable Access to Cortex XDR.

8. (Requires Broker VM 8.0 and later) (Optional) Collect and Generate New Logs. Your Cortex XDR logs will download automatically after approximately 30 seconds.

Register and enter your unique Token, created in the console.

After a successful registration, Cortex XDR displays a notification.

You are directed in Cortex XDR to Settings → Configurations → Data Broker → Broker VMs. The Broker VMs page displays your Broker VM details and allows you to edit the defined configurations.