Configure and manage long-running integrations to export internal data from Cortex XSIAM.
Some long-running integrations provide internal data via API calls to your third-party software, such as a firewall. You can set up Cortex XSIAM to allow third-party software to access long-running integrations installed either on the Cortex XSIAM tenant or on an engine.
Long-running integrations provide internal data via API calls such as:
Integration | Description | See More |
|---|---|---|
O365 Teams (Using Graph API) | Get authorized access to a user's Teams app in a personal or organizational account. | |
Generic Webhook | Creates cases on event triggers. The trigger can be any query posted to the integration. | |
Generic Export Indicators Service | Use the Generic Export Indicators Service integration to provide an endpoint with a list of indicators as a service for the system indicators. You can set up the tenant to export internal data to an endpoint. NoteThis integration replaces the External Dynamic list integration, which is deprecated. For more information about how to set up the integration, see Manage external dynamic lists. | |
Microsoft Teams | Send messages and notifications to team members. | |
TAXII Server | Provides TAXII Services for system indicators (Outbound feed). | |
TAXII2 Server | Provides TAXII2 Services for system indicators (outbound feed). You can choose to use TAXII v2.0 or TAXII v2.1. | |
PingCastle | Listens for PingCastle XML reports. | |
Publish List | Publishes Cortex XSIAM lists for external consumption. | |
Simple API Proxy | Provides a simple API proxy to restrict privileges or minimize the number of credentials issued at the API. | |
Syslog v2 | Opens cases automatically from Syslog clients. | |
Web File Repository | Make your environment ready for testing purposes for your playbooks or automations to download files from a web server. |
Note
When running on the tenant, you can only use long-running integrations provided by Cortex XSIAM, you cannot create custom ones. Custom long-running integrations are supported only on engines at this time.
Configuring custom certificates or private API Keys in the long-running integration instance is supported only on engines, not on the Cortex XSIAM tenant.
If you have configured a range of Approved IP Ranges under Allowed Sessions on the Security Settings page, any incoming communication must be from approved IP addresses.