--- title: "Cortex XDR collector" canonical: "https://docs.devo.com/space/latest/645726232/Cortex%20XDR%20collector" format: markdown --- > Macro (excerpt-include) > Macro (toc) ## Purpose An analyst wants to detect malicious behavior in endpoints. Using the [Cortex XDR](https://www.paloaltonetworks.com/cortex/cortex-xdr) collector to send endpoint security logs to Devo, the analyst will find unauthorized endpoint configuration changes. As a result, the analyst will isolate compromised endpoints, preventing infections from engaging in lateral movement. ## Example tables | **Table** | **Description** | | --- | --- | | `edr.cortex_xdr.alerts_multi` | Alert details with multiple events | | `edr.cortex_xdr.incidents` | Security incidents information | | `edr.cortex_xdr.incident_alert` | Alerts associated with incidents | | `edr.cortex_xdr.all_alert` | Complete list of alerts | | `edr.cortex_xdr.audit_management` | Audit management logs | | `edr.cortex_xdr.violation` | Security violations | | Union tables that uses these tags: `edr.all.threats` | Union tables collect information for monitoring purposes. | ## Required configuration | **Setting** | **Details** | | --- | --- | | `api_key` | The API Key is your unique identifier for Cortex XDR. | | `api_key_id` | The API Key ID is your unique token used to authenticate the API key for Cortex XDR. | | `api_fqdn` | API FQDN is a unique host and domain name associated with each tenant for Cortex XDR. | ## Authorize it 1. Log in to the **Cortex XDR **console with and administrative account. 2. Go to the **“Settings”** menu (gear icon). 3. Go to **API Keys** under the **“Integrations” **section. 4. Click **“Add Key”** to generate a **new API key** and select the roles or permissions for the key. 5. Enable **"Read"** for these scopes, if available: *Incidents, Alerts, Audit Management.* 6. Click **“Create”** for generating the **API Key** along with an **API Key ID**. 7. Save these securely, as you may not be able to retrieve them later. 8. Make note of your **API FQDN** (Fully Qualified Domain Name), found in the URL when logging your Cortex XDR console, typically in the format: `https://.xdr.paloaltonetworks.com` ## Run it In the Cloud Collector App, [create](https://devodocs.atlassian.net/wiki/spaces/latest/pages/409305131) a **Corte XDR** collector instance. Insert this parameters template, replacing the values enclosed in `< >`. The `id` must be a unique [five digit number](https://www.random.org/integers/?num=1&min=10000&max=99999&col=5&base=10&format=html&rnd=new). ``` "inputs": { "cortex_xdr": { "id": "", "services": { "incidents": { "api_fqdn": "" }, "credentials": { "api_key": "", "api_key_id": "" } } } } ``` ## Secure it Use the [EDR](https://devodocs.atlassian.net/wiki/spaces/latest/pages/2206367761/Query+and+alert+library#THREATSYS%2FEDR) queries from the library. ## Monitor it Create an [inactivity alert](https://devodocs.atlassian.net/wiki/spaces/latest/pages/95126785) to detect interruptions of transfer of data from the source using the query ``` from edr.cortex_xdr.incidents where toktains(hostchain,"collector-") select split(hostchain,"-",1) as collector_id ``` Set the inactivity alert to keep track of the `collector_id`. ## Parameters ### Example ``` { "global_overrides": { "debug": false }, "inputs": { "cortex_xdr": { "id": "", "enabled": true, "credentials": { "api_key": "", "api_key_id": "" }, "services": { "incidents": { "api_fqdn": "" }, "alerts": { "api_fqdn": "" }, "all_alerts": { "api_fqdn": "" }, "audit_managements": { "api_fqdn": "" } } } } } ``` ### Details | | | | | | --- | --- | --- | --- | | **Parameter** | **Data type** | **Necessity** | **Details** | | `id` | `integer` | `Mandatory` | **Unique** five digits | | `input` | `boolean` | `Mandatory` | Use this param to enable or disable the given input logic when running the collector. If the value is `true`, the input will be run. If the value is `false`, it will be ignored. | | `api_key` | `string` | `Mandatory` | The API Key is your unique identifier used as the `Authorization:{key}`. | | `api_key_id` | `string` | `Mandatory` | The API Key ID is your unique token used to authenticate the API Key. It is used in headers as `x-xdr-auth-id:{key_id}` | | `api_fqdn` | `string` | `Mandatory` | The FQDN is a unique host and domain name associated with each tenant. When you generate the API Key and Key ID, you are assigned an individual FQDN. ex: `https://{api-fqdn}/public_api/v1/incidents/get_incidents` | | `request_period_in_seconds` | `integer` | `Optional` | Period in seconds used between each data pulling, this value will overwrite the default value 60 seconds | | `override_devo_tag` | `string` | `Optional` | This parameter allows to define a custom devo tag. ex: `my.app.devo.service` | | `override_incident_alert_tag` | `string` | `Optional` | This Tag is only applicable for **Incidents** **service** to override the tag of **Incident alerts(** Extra incident endpoint). Ex: `my.app.devo.Incident_alert` | | `include_incident_alerts` | `boolean` | `Optional` | By default the value of this boolean is ‘**true’**. If given ‘**false**’ we will not be able to get incident alerts data
(Extra incidents data **for endpoint**: `v1/incidents/get_incident_extra_data`). Ex : `true, false`
Note: For This endpoint, the data gets ingested in the table `edr.cortex_xdr.incident_alert` and this table may contains duplicates because we are using `incident_id` to get the data and these `incident_ids` can be duplicates. We are using `modification_time` instead of `creation_time` to filter the `incident_ids` causing duplicates. | | `start_time` | `string` | `Optional` | This parameter allows to get the data from provided start time. If not provided it will take current-time as time. Ex:- `2024-01-01T01:50:00Z` | ## Troubleshooting | **Error type** | **Error message** | **Cause** | **Solution** | **Details** | | --- | --- | --- | --- | --- | | `SetupError` | 100 | `HTTP Error occurred while checking the server health for cortex from remote source: {e}` | You will get the status code with error msg. | Ensure that the collector has the necessary permissions and proper credentials to access the Cortex xdr API and contact the developer with exact error message | | `PullError` | 300 | `Error while fetching the event data for service {service_name} and error: {e}` | You will get the status code with error msg. | This is an internal issue. Contact with Devo Support team. | | `ApiError` | 400 | `HTTP ERROR 400: Bad request: The server could not understand the request` | Bad Request | Kindly reach out to the developer | | 401 | `HTTP ERROR 401: Unauthorized: Authentication is required and has failed or has not been provided` | Credentials provided is not correct | Please check and provide the correct credentials | | 402 | `Unauthorized access. User does not have the required license type to run this API` | User doesn't have the required permission | Kindly get required permission and reach the developer with the exact msg. | | 403 | `HTTP ERROR 500: Server Error: An error occurred on the server` | Internal server error. An unverified status of API communication type error | Kindly reach the developer with the exact msg. | | 404 | `Request Error: Received status code {status_code}` | You will get the status code with error msg. | Kindly reach the developer with the exact msg. | | 405 | `HTTP ERROR 429: Too Many Requests: The user has sent too many requests in a given amount of time.` | Number of request has exceeded for the cortex api | Kindly reach the developer with the exact msg. | | 406 | `HTTP ERROR 429: Too Many Requests: The user has sent too many requests in a given amount of time.` | Number of request has exceeded for the cortex api | Kindly reach the developer with the exact msg. | | 407 | `HTTP ERROR 429: Too Many Requests: The user has sent too many requests in a given amount of time.` | Number of request has exceeded for the cortex api | Kindly reach the developer with the exact msg. | | 408 | `HTTP Error occurred while retrieving events from cortex server, summary: {str(e)}, details: {details_str}` | You will get the status code with error msg | Kindly reach the developer with the exact msg. | | 409 | `Some error occurred while retrieving events from cortex server. Error details {str(e)}` | You will get the status code with error msg | Kindly reach the developer with the exact msg. | ## API Endpoints | **Endpoint** | **Service** | **Table** | | --- | --- | --- | | `/public_api/v2/alerts/get_alerts_multi_events` | `alerts` | `edr.cortex_xdr.alerts_multi` | | `/public_api/v1/incidents/get_incidents` | `incidents` | `edr.cortex_xdr.incidents` | | `/public_api/v1/incidents/get_incident_extra_data` | `incidents` | `edr.cortex_xdr.incident_alert` | | `/public_api/v1/alerts/get_alerts` | `all_alerts` | `edr.cortex_xdr.all_alert` | | `/public_api/v1/audits/management_logs` | `audit_management` | `edr.cortex_xdr.audit_management` | ## Devo collector features | **Feature** | **Details** | | --- | --- | | Allow parallel downloading (`multipod`) | `not allowed` | | Running environments | `collector server` | | Populated Devo events | `table` | | Flattening preprocessing | `no` | | Requires IP Whitelisting | `no` | ## Release Notes - **Version 2.3.0** (2025-08-12) - The DevoCollectorSDK Python package (devo-collector-sdk) has been updated to "1.16.3" - Upgraded the docker base image to 1.6.0 - Added timeout in the requests call to fix the unresposive API issue. - **Version 2.2.0** (2025-06-03) - Updated DCSDK Docker base image to 1.5.1 and DevoCollectorSDK Python package to 1.16.2 - **Version 2.1.0** (2025-05-20) - The DCSDK Docker base image has been updated from "1.3.1" to "1.5.0" - The DevoCollectorSDK Python package (devo-collector-sdk) has been updated from "1.13.1" to "1.16.1" - **Version 2.0.4 **(2025-01-16) - Fixed duplication issue related to @devo_pulling_id - **Version 2.0.3 **(2024-12-04) - Updated documentation - **Version 2.0.0 **(2024-09-06) - Added new services (all_alerts, audit_managements), changed `devo_tag `from edr.cortex_xdr.alerts to edr.cortex_xdr.incident_alert, migrated alerts data from edr.cortex_xdr.alerts_multi_event to edr.cortex_xdr.alerts_multi, updated API endpoint from v1 to v2 for alerts service. - **Version 1.2.0** (2024-03-20) - Added 'start_time' in config file for alerts service - Added logs