For the complete documentation index, see llms.txt. Markdown versions of documentation pages are available by appending .md to page URLs; this page is available as Markdown.

Palo Alto Cortex

Palo Alto Cortex XSIAM/XDR

The Dropzone AI Platform integrates with the Palo Alto Cortex platform to monitor endpoints, gather data from cloud, network and identity sources, as well as analyze alerts.

Create an API Key

Palo Alto Cortex requires an API key to enable. You’ll need access to a Cortex user account with the ability to generate and manage API keys. If you don’t have the necessary permissions, please get in touch with your Cortex administrator for assistance.

To obtain an API Key, do the following:

• Log in to your Palo Cortex console
• In the bottom left corner, navigate to Settings > Configurations

• In the Search bar, input "API Keys," then click "API Keys"

• In the upper right, click "+ New Key"

• Under "Role," assign the API Key the Privileged Investigator role

{% hint style="info" %} If you wish to allow Dropzone to use the Automatic Scanning feature in its Data Source integration, you will need to create a custom user role with additional permissions. See the "Create a Custom User Role" section for information. {% endhint %}

• Under "Comment," name the API key something memorable, such as "Dropzone AI"
• Select your desired Security Level: Advanced or Standard

{% hint style="info" %} The Advanced API key hashes the key using a nonce, a random string, and a timestamp to prevent replay attacks. Dropzone does not require the advanced security level. {% endhint %}

• If you wish to assign the key an expiration date, check the box labeled "Enable Expiration Date" and input your desired expiration date

• In the bottom left corner, click "Generate"

• Copy the API Key shown for use later in the Dropzone UI where it is called "API Key"

• In the API Keys table, locate the ID number for the newly generated API Key. Copy it for use later in the Dropzone UI where it is called "API Key ID"

• In the top right hand corner, click "Copy API URL"

• Save the URL for use later in the Dropzone UI where it is called "API FQDN"

Create a Custom User Role

To create a custom role in Palo Alto Cortex, do the following:

• Navigate to Settings > Configurations

• In the search bar, search Roles

• In the upper left, click "+ New Role"

• Under "Role Name," name the Role something memorable, such as Dropzone AI Investigator

• In the "Components" section, click the arrow next to "Configurations"

• Assign the Role the following permissions:
  • Data Management: View/Edit
  • Public API: View

• In the bottom left corner, click "Save"

• When creating your API key, assign it both the Privileged Investigator Role and the custom role

Enable Palo Alto XSIAM

To enable the Alert Source integration, you will need the following information:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app
• In the bottom left hand corner, navigate to Settings > Integrations

• Click "Available"

• In the Search bar, search Palo Alto Cortex XSIAM, then click "Configure"

• Under the Alert Source heading, input the API FQDN, API Key ID, and API Key
• Select your authentication method

{% hint style="info" %} This must be the same as the security level you configured for the API key generated earlier. {% endhint %}

• Under "Enabled Severities," select the severity levels you wish Dropzone to ingest
• Under "Enabled Types," select whether you wish to ingest alerts, cases, and/or incidents

• If you selected incidents, under "Incident Statuses," select which incident statuses you want Dropzone to ingest

• If you selected cases, under "Case Statuses," select which case statuses you want Dropzone to ingest
• Under "Case Domains," select which case domains you want Dropzone to ingest

• If you wish, you may further filter your alerts, incidents and cases
  • To filter via the description field, click "Add Item" under "Description Regex Filters," then input a custom regex pattern to filter results. Under "Description Filter Mode," choose whether to include or exclude items matching the filters
  • To filter via alert type, click "Add Item" under "Alert Type Regex Exclusions," then input a custom regex pattern to filter results. Alerts with these fields will be excluded from Dropzone's analysis
  • To filter via tag, click "Add Item" under "Tag Regex Filters," then input a custom regex pattern to filter results. Under "Tag Filter Mode," choose whether to include or exclude items matching the filters

{% hint style="info" %} See the Palo Alto XSIAM Alerts and Incidents overviews for the definitions of type, name, and tag {% endhint %}

• For more information on these features, engage your Dropzone AI support representative

• Input your desired log ingestion delay, poll interval and poll lookback

• Click "Test & Save" to finish

If you have any errors, engage your Dropzone AI support representative.

Enable Palo Alto Cortex XDR

To enable the Alert Source integration, you will need the following information:

• Navigate to your Dropzone AI tenant home page e.g. https://mycompany.dropzone.app
• In the bottom left hand corner, navigate to Settings > Integrations

• Click "Available"

• In the Search bar, search Palo Alto Cortex XDR, then click "Configure"

• Under the Alert Source heading, input the API FQDN, API Key ID, and API Key
• Select your desired authentication method

{% hint style="info" %} This must be the same as the security level you configured for the API key generated earlier. {% endhint %}

• Under "Enabled Severities," select which severity levels you want Dropzone to ingest
• Under "Enabled Incident Types," choose whether to ingest alerts and/or incidents from Cortex XDR

• If you selected incidents, under "Incident Statuses," select which incident statuses you wish Dropzone to ingest

• If you wish, you may further filter your alerts and incidents
  • To filter via alert type, click "Add Item" under "Alert Type Regex Exclusions," then input a custom regex pattern to filter results. Alerts with these fields will be excluded from Dropzone's analysis
  • To filter via name, click "Add Item" under "Name Regex Filters," then input a custom regex pattern to filter result. Under "Name Filter Mode," choose whether to include or exclude items matching the filters
  • To filter via tag, click "Add Item" under "Tag Regex Filters," then input a custom regex pattern to filter results. Under "Tag Filter Mode," choose whether to include or exclude items matching the filters

{% hint style="info" %} See the Palo Alto XDR Alerts and Incidents overviews for the definitions of type, name, and tag {% endhint %}

• For more information on these features, engage your Dropzone AI support representative

• Input your desired log ingestion delay, poll interval and lookback

• If you wish to further filter alerts using the Python CEL package, check the box labeled "Use advanced filtering"
• Input your CEL expression, then select whether to include or exclude alerts matching that filter. Add each filter individually using the "Add Item" button
• Contact your Dropzone AI support representative for more information about this feature

• Click "Test & Save" to finish

If you have any errors, engage your Dropzone AI support representative.