Palo Alto Networks integrations - Administrator Guide - Cortex XSIAM - Cortex

Palo Alto Networks integrations - Administrator Guide - Cortex XSIAM - Cortex - Security Operations

Cortex XSIAM Documentation

Product

Cortex XSIAM

Creation date

2024-03-06

Last date published

2024-10-07

Category

Administrator Guide

Abstract

Cortex XSIAM supports Palo Alto Networks data ingestion.

Cortex XSIAM supports streaming data directly from Prisma Access accounts, Next-Generation Firewalls (NGFW), and Panorama devices to your Cortex XSIAM tenants using the Strata Logging Service.

New tenants (and tenants upgraded from XDR to XSIAM) will work with the new direct integration of Next-Generation Firewall and Panorama into Cortex. For such tenants, there’s no option to use the Strata Logging Service integration.

For tenants where a Strata Logging Service license exists, the configured integrations, such as Next-Generation Firewall and Prisma Access, can be migrated to Cortex XSIAM in either of the following ways before the license expires:

More than two weeks before the license for existing integrations with Strata Logging Service expires, manually migrate the integrations, using the corresponding Migrate Devices buttons on the Data Sources page. Make sure you select all your devices to connect directly to Cortex XSIAM.
Two weeks prior to the end of your Strata Logging Service license, Cortex XSIAM will automatically migrate your integrations to your Strata Logging Service.
Note
Roll-back of Strata Logging Service integration migration is not supported.

Note