Automation Integrations - User Guide - 2 - Cortex XPANSE - Cortex - Security Operations

Cortex Xpanse Expander User Guide

Product
Cortex XPANSE
Version
2
Creation date
2024-03-28
Last date published
2024-04-17
Category
User Guide
Solution
Cloud
Abstract

Set up automation integrations to enable Active Response to enrich an alert or respond to an alert with an action, such as sending notifications or directly modifying the configuration of an asset, service, or networking infrastructure.

Automation Integrations are a class of integrations utilized solely by Active Response playbooks to either enrich an alert or respond to an alert with an action, such as sending notifications or directly modifying the configuration of an asset, service, or networking infrastructure.

The supported automation integrations are listed on the Automation Integrations page in Expander (go to AutomationConfigurationAutomation Integrations). They are also listed in the Automated Remediation Capabilities Matrix.

Configure Automation Integrations Using the Configuration Wizard

The Configuration Wizard simplifies the task of configuring automation integrations by walking you through the process step-by-step.

  1. Navigate to AutomationConfiguration to open the Automation Integrations page.

    launch-configuration-wizard.png
  2. Click Launch Configuration Wizard and follow the prompts.

    integration-wizard.png
Install and Configure Automation Integrations Manually

Note

We recommend using the Configuration Wizard to configure your automation integrations, but if you choose to do it manually, use the following procedure.

Some automation integrations are pre-installed and only need to be configured. Integrations that are not pre-installed must be installed from the Marketplace first and then configured. Perform the following steps to install (if necessary) and configure an automation integration in Expander.

  1. Navigate to AutomationConfiguration to open the Automation Integrations page.

  2. Locate the integration you want to configure.

    Pre-installed integrations appear on the Automation Integrations page by default. If you do not see your integration listed, perform these steps to install the integration from the Marketplace.

    1. Go to MarketplaceBrowse and locate the content pack for the integration you want to install.

    2. Select the content pack and review the information on the Details, Content, Dependencies, and Version History tabs.

    3. Click Install to add the content pack to the Cart.

      The Cart will display with the required and optional content packs for the integration.

    4. (Optional) Optional Content Packs appear in the Cart below the required content. Select the optional content you want to add.

      The Cart displays the number of items you are installing, including any required packs. You can log in and out, but the content remains in the Cart until you click either Empty cart or Install.

    5. Click Install. If you receive an error message, you need to fix the error before installing. In case of a warning message, you can install and fix it later.

  3. When you've located the integration on the Automation Integrations page, click Add Instance for that integration.

  4. Add the appropriate credentials, typically a URL and API key or username and password.

  5. Click Test to verify that the integration has been configured correctly.

  6. Click Save & Exit to save the configuration.

  7. Repeat these steps for all integrations to be installed and configured.