Set up Network Analysis - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Set up your network sensors.

1. If you use unmanaged Palo Alto Networks firewalls and did not configure log-forwarding on your firewalls before activating Cortex XSIAM, start sending logs to Cortex XSIAM.

2. (Optional) Set up External Data Ingestion.

   If you have external (non-Palo Alto Networks) network sensors, you can set up a Syslog collector to receive alerts or logs from them. If you send external alerts, Cortex XSIAM can include any of them in relevant incidents for a more complete picture of the activity involved. If you send logs and alerts from external sources such as Check Point firewalls, Cortex XSIAM can apply analytics analysis and raise analytics alerts on the external logs and include the external alerts in incidents for additional context.

3. (Optional) If you use a third-party authentication service, you can Ingest Authentication Logs and Data into authentication stories. After you set up log collection, you can search for authentication data using the Query Builder.

4. (Optional) If you want to use Pathfinder to examine unmanaged network hosts, servers, and workstations for malicious or risky software, Activate Pathfinder.

Configure the internal networks that you want Cortex XSIAM to monitor.

If you use GlobalProtect or Prisma Access, add the GlobalProtect VPN IP address pool for the VPN traffic that you want to monitor.

If you selected a Cloud Identity Engine (Directory Sync instance) during the Cortex XSIAM activation process, Set Up Cloud Identity Engine.