Learn more about enabling network access to the Cortex XSIAM resources.
After you receive your account details, enable and verify access to Cortex XSIAM communication servers, storage buckets, and various resources in your firewall configuration.
Some of the IP addresses required for access are registered in the United States. As a result, some GeoIP databases do not correctly pinpoint the location in which IP addresses are used. All customer data is stored in your deployment region, regardless of the IP address registration, and restricts data transmission through any infrastructure to that region.
Keep in mind the following guidelines:
If you use the specific Palo Alto Networks App-IDs indicated in the tables, you do not need to allow access to the resource.
A dash (—) indicates there is no App-ID coverage for a resource. Enable access from the agent to the console; this does not need to be bidirectional.
For IP address ranges in Google Cloud Platform (GCP), refer to these lists for IP address coverage for your deployment:
https://www.gstatic.com/ipranges/goog.json: IP address subnet ranges
https://www.gstatic.com/ipranges/cloud.json: IP address ranges associated with your region
If you use SSL decryption and experience difficulty in connecting the Cortex XDR agent to the server, we recommend that you add the FQDNs required for access to your SSL Decryption Exclusion list.
In PAN-OS 8.0 and later releases, you can configure the list in → → .
Note
refers to the selected subdomain of your Cortex XSIAM tenant, and <xsiam-tenant><region>
The following table lists the required resources by region, including FQDNs, IP addresses, ports, and App-ID coverage for your deployment:
FQDN | IP Addresses and Port | App-ID Coverage |
|---|---|---|
Used to connect to the Cortex XSIAM tenant. | IP address by region:
Port: 443 |
|
Used for the first request in registration flow where the agent passes the distribution id and obtains the |
|
|
Used in live terminal flow. | IP address by region:
Port: 443 |
|
Used to download installers for upgrade actions from the server. This storage bucket is used for all regions. |
|
|
Used to download the executable for live terminal for XDR agents earlier than version 7.1.0. This storage bucket is used for all regions. |
|
|
Used to download content updates. |
|
|
Used to download extended verdict request results in scanning. |
|
|
Used to download the Kubernetes image from the registry for Kubernetes agents installation. |
| |
Used for EDR data upload. | IP address by region:
Port: 443 |
|
Used for all other requests between the agent and its tenant server including heartbeat, uploads, action results, and scan reports. | IP address by region:
Port: 443 |
|
Used for API requests and responses and to connect to an engine. | IP address by region:
Port: 443 | — |
Used for get-verdict requests. | IP address by region:
Port: 443 |
|
Broker VM Resources Required for deployments that use Broker VM features | ||
xdr-ova-installers-prod-us.storage.googleapis.com Used to download Broker VM images from the server. This storage bucket is used for all regions. |
|
|
| IP address by region:
Port: 443 | — |
|
|
|
| UDP port: 123 | — |
App Login and Authentication | ||
identity.paloaltonetworks.com (SSO) |
| — |
login.paloaltonetworks.com (SSO) |
| — |
In-App Help Center and Notifications | ||
data.pendo.io | Port: 443 | — |
pendo-static-5664029141630976.storage.googleapis.com | Port: 443 | — |
Email Notifications | ||
— | IP address for all regions: 159.183.150.248 | — |
Egress Used for communication between Cortex XSIAM and customer resources. | ||
|
| |
To Collect 3rd Party Data from Customer's SaaS and Cloud resources | ||
— | IP address by region.
|
|
Log Forwarding to a Syslog Receiver | ||
The following table lists the required resources for the federal government of the United States, including FQDNs, IP addresses, ports, and App-ID coverage for your deployment:
FQDN | IP Addresses and Port | App-ID Coverage |
|---|---|---|
Used for the first request in registration flow where the agent passes the distribution ID and obtains the |
|
|
Used in live terminal flow. |
|
|
Used to download installers for upgrade actions from the server. |
|
|
Used to download the executable for live terminal for Cortex XDR agents earlier than version 7.1.0. |
|
|
Used to download content updates. |
|
|
Used to download extended verdict request results in scanning. |
|
|
|
| — |
Used for EDR data upload. |
|
|
Used for all other requests between the agent and its tenant server including heartbeat, uploads, action results, and scan reports. |
|
|
Used for API requests and responses. |
| — |
Used for get-verdict requests. |
|
|
Broker VM Resources Required for deployments that use Broker VM features | ||
|
| — |
|
| — |
|
|
|
UDP port: 123 | — | |
App Login and Authentication | ||
identity.paloaltonetworks.com (SSO) |
| — |
login.paloaltonetworks.com (SSO) |
| — |
To Collect 3rd Party Data from Customer's SaaS and Cloud resources | ||
— | IP addresses
|
|
Log Forwarding to a Syslog Receiver | ||