Cortex XSIAM
Leak events are sent to your Cortex XSIAM tenant as alerts.
How it works
The connection runs over the HTTP Log Collector. The collector key alone is the authentication; there is no other field. The body is sent as newline-delimited JSON.
Delivery is one-way. Incidents, assets and playbooks in the tenant are not read.
Severity mapping
| Dark Radar | Cortex |
|---|---|
| Critical · High | HIGH |
| Medium | MEDIUM |
| Low | LOW |
| Info | INFORMATIONAL |
Limits
Requests go only to the Palo Alto domain.
The collector has to be created with the JSON format.
The leaked value itself is not in the alert.
Setup
The setup steps are in the panel, on the integration’s own screen. What to do on the provider side and which value goes where is written there.