Bring your own keys - Administrator Guide - Cortex XSIAM - Cortex

Bring your own keys - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2024-11-28

Danger

Access to BYOK (Bring Your Own Keys) functionality is restricted to tenants that were initially activated with BYOK.

Bring Your Own Keys (BYOK) enables you to generate your own encryption keys and securely import and manage them via Cortex Gateway to retain greater control over your tenant data and encryption.

BYOK supports the following key management operations. Cortex XSIAM provides detailed audit logs and email notifications on all key management operations.

To import a new encryption key, whether for initial tenant setup or key rotation, use the Bring your own keys (BYOK) setup.

If you're doing the activation for the first time, in the Cortex Gateway, follow the Tenant Activation wizard. In Tenant Activation → Define Tenant Settings, under Advanced, select BYOK (Bring Your Own Keys) and click Create Tenant and Set Up Keys.
The tenant is now initialized, which may take a few minutes. You can set up your keys now, or return at a later stage and click Set Up Encryption Keys next to the tenant in the gateway to continue the process.
If you've already started the activation process and paused, locate your tenant in the Available Tenants list in the Cortex gateway, click Set Up Encryption Keys next to your tenant and set up your keys.

To rotate your encryption keys, in the Cortex gateway, open the more options menu next to the tenant, select Rotate Encryption Key, and follow the Bring your own keys (BYOK) setup.

To resume the process, in the main gateway, open the moremenu next to the tenant, select Continue Rotation, and follow the Bring your own keys (BYOK) setup.

As long as the rotation hasn't been completed, you can cancel the rotation process from the three dot menu next to the tenant.

Note

The new keys you import will serve as primary encryption keys for newly generated data.

To disable your encryption keys, in the main gateway, open the three dot menu next to the tenant, select Disable All Keys & Deactivate Tenant.

Danger

To disable your encryption keys and deactivate a tenant, you must have an Account Admin role.

Caution

Disabling all encryption keys and deactivating the tenant renders the tenant inaccessible and non-operational.

Disabling the keys affects the communication with the agents, may prevent the agents from receiving updates to policies, configurations, and crucial information, and may result in loss of data.

To secure your tenant data and to prevent unauthorized access, re-enabling the keys and re-activating the tenant are strictly controlled and require manual intervention by the Cortex XSIAM Customer Success team.

Bring your own keys (BYOK) setup

Cortex BYOK uses two keys for encrypting your data at rest. One key is for BigQuery and the other is for all the other services within the tenant. You can generate a single key for both or create two separate keys for each service.

After completing the process, the imported keys become the primary keys used for encrypting any newly generated data stored within the tenant.

Note

At any stage, you can select Continue Later to pause the process. To resume the process, in the Cortex gateway, select Continue Setup next to the tenant, and follow the wizard instructions from the point you left off, as detailed below. If you don't use either of your wrapping keys within three days, they expire and you'll have to restart the process.

Import new keys for encrypting your tenant data at rest:

The Generate Key screen helps you generate an encryption key.
Note
BYOK requires a 32-byte, symmetric, unencoded key in binary format.
Generate a key that meets these requirements using your preferred method or use the provided OpenSSL command:
```
openssl rand 32 <FILENAME>
```
When your encryption key is ready, select I have a 32-byte symmetric encryption key ready and click Next.
In the Wrap & Upload screen, repeat the following procedure for both Data lake wrapping key and Services wrapping key.
1. Download the wrapping key.
  The wrapping key is valid for up to three days. After three days, you need to download a new wrapping key.
2. Use an OpenSSL editor to wrap your encryption key using the following code:
```
openssl pkeyutl \  
-encrypt \  
-pubin \  
-inkey <WRAPPING_KEY_FULL_PATH> \  
-in <YOUR_32_BYTE_KEY_FULL_PATH> \ 
-out <TARGET_WRAPPED_KEY_FULL_PATH> \  
-pkeyopt rsa_padding_mode:oaep \  
-pkeyopt rsa_oaep_md:sha256 \  
-pkeyopt rsa_mgf1_md:sha256
```
3. Upload the wrapping key and click Complete Activation.