Abstract
Learn how to pair Prisma Cloud Compute with Cortex XSIAM for use with Cortex XDR Agent for Cloud.
Cortex XSIAM and Prisma Cloud Compute are offering a unified cloud security agent for Linux. The Cortex XDR Agent for Cloud provides end to end prevention and vulnerability coverage on Linux cloud environments.
Cortex XDR Agent for Cloud has a single management server that is based on a Cortex XSIAM tenant. Policy management, data, and alerts are first managed between the Cortex XSIAM tenant and Cortex XDR Agent for Cloud, and then runtime protection and vulnerability coverage can be provided on Prisma Cloud Compute and Cortex XSIAM.
To enable the capabilities of Cortex XDR Agent for Cloud, the Prisma Cloud Compute tenant must be paired with an existing Cortex XSIAM tenant. Pairing is one to one, with the two tenants being in the same region.
Pairing Prisma Cloud Compute to Cortex XSIAM can only be done when both Cortex XSIAM and Prisma Cloud Compute tenants are already active.
From the Prisma Cloud Compute console, copy the access pairing key.
Select → , and scroll to Pair Cortex XDR Tenant.
Click the copy icon to copy the Access Key, which is the pairing key used in Cortex XSIAM.
Paste the pairing key in Cortex XSIAM.
Select → → , and scroll to Prisma Cloud Compute Tenant Pairing.
Paste the Prisma Cloud pairing key and click Pair.
After a few seconds, the Cortex XSIAM and Prisma Cloud Compute tenants are paired.
A Successfully paired with <Prisma Tenant URL> message will be shown.
The two paired tenants can be unpaired from either console.
In Cortex XSIAM, select → → , and scroll to Prisma Cloud Compute Tenant Pairing.
In Prisma Cloud Compute, select → , and scroll to Pair Cortex XDR Tenant.
Click Unpair.
Note
Note that all Advanced Vulnerability settings (under the Agent Settings profile) will be reset and all Agent Installations created via the Prisma Cloud Compute console will be deleted.
Confirm the unpairing by clicking Yes at the warning message.
After a few seconds, the Cortex XSIAM and Prisma Cloud Compute tenants are unpaired.
Note
When unpairing, the Active Vulnerability Analysis Module under the Agent Settings profile is reset to Disable mode.
If Prisma Cloud and Cortex XSIAM are to be paired again, the Active Vulnerability Analysis Module must be enabled manually.