Ctrlk
Go to Workbench
For the complete documentation index, see llms.txt. This page is also available as Markdown.

Palo Alto Networks Cortex XDR Pro Setup for Workbench

This guide is for XDR Pro only. Expel does not support XDR Prevent.

Integrating your technology with Expel Workbench requires advanced user privileges that some products don't offer. PAN Cortex XDR Prevent has limitations on read/write privileges that prevent full communication with Expel Workbench.

Step 1: Enable Console Access

Having read-only access to the interface of your technology allows Expel to dig deeper during incident investigations. Our device health team uses this access to investigate potential health issues with your tech. For more information, see Why Expel Asks for Console Access.

  1. Log in to Cortex XDR Pro.

  2. In a new tab, open the Palo Alto Customer Support Portal.

  3. Navigate to Members > Create New User.

  4. Create a new user for the Expel SOC:

    • Display Name - enter "Expel SOC".

    • Password - enter a temporary password.

    • First Name - enter "Expel".

    • Last Name - enter "SOC".

    • Email address - enter "soc+<Your_Organization_Name>@expel.io.

      • For example, if your organization were Acme Corp, the format would be "soc+acme_corp@expel.io".

  5. Expel receives the account activation email and sets a new password.

  6. In the Cortex XDR console, navigate to Settings > Configuration > Access Management > Users.

  7. Confirm that the newly created Expel SOC user is present and edit the user to add the Privileged Security Admin role from the list of predefined roles.

Step 2: Generate API credentials

To integrate the technology with Workbench, you must create secure credentials to the API.

  1. In the Cortex XDR Pro console, navigate to Settings > Configurations > Integrations > API Keys.

  2. Select Copy URL and save the output in a safe place for use in a later step.

  3. In the upper right corner, select New Key.

  4. In the Generate API Key window, make sure that the Security Level is set as Advanced. Make sure that the role includes all “Investigation” options selected. We recommend Instance Administrator as it selects all of the options that we need to complete investigative action.

    • Note: If you plan to enable alert status syncing between PAN Cortex XDR Pro and Workbench, you must also enable View/Edit permissions for Alerts & Incidents within the Incident Response section.

      Select View/Edit for the Alerts and Incidents permission in the Incident Response section.

  5. Select Generate.

  6. Copy and save the following credentials for use in the next section:

    • URL

    • API Key

  7. In the API Keys table, locate the ID field and copy and save the value as your API Key ID. You will also need this value in the next section.

Step 3: Add PAN Cortex XDR Pro as a Security Device in Workbench

Now that you have the correct access configured and noted the credentials, you can integrate your tech with Workbench.

  1. Log in to Workbench.

  2. Navigate to Settings and select Security Devices.

  3. At the top of the page, select Add Security Device.

  4. Search for and select Cortex XDR Pro.

    PAN Cortex XDR Pro security device configuration form in Workbench.

  5. Complete the fields as follows:

    • Name - enter a name that might help you more easily identify this integration, such as "CompanyName PAN Cortex XDR Pro"; this name will display in Workbench under the Name column, and is a text string that you can filter on.

    • Location - enter the location of your integration, for example "cloud." This is also a text string that you can filter on, so we recommend being consistent with location naming across your Expel integrations.

    • URL - enter your Cortex XDR Pro URL.

    • API key - the API key generated in Step 2.

    • API key ID - enter the Key ID noted in Step 2.

    • Enable 1way status syncing & comments for Expel alerts? - select Yes if you wish to enable status syncing. Learn more in the Reference section.

  6. Select Save.

Your device should be created successfully within a few seconds. A few reminders:

  • After your connection is healthy, it will take some time for your device to begin polling and receiving data.

  • To check on the status, select the downward arrow for your device in the first column and choose View details.

  • Polling will happen first; data will be received after that. You must refresh the page to see updates.

  • If your device does not begin polling within 15 minutes, and does not begin receiving data within 30 minutes, contact our support team for help.

  • To check if alerts are coming through, navigate to Dashboards > Alert Analysis. Scroll to the device you want to check, and select the Expel Alerts tab to reveal more alert information. It can take 36 to 72 hours for alerts to appear after setup, as we tune your device.

Reference

Status Syncing

Expel supports alert status syncing between Workbench and PAN Cortex XDR Pro security devices. If status syncing is enabled, when an ingested alert or incident from Cortex XDR results triggers the creation of an Expel Alert, the Expel Alert status (e.g. Open, Investigating, Closed) is reflected back into the Cortex XDR device as Expel's SOC works the Expel Alert. Comments are also included for every state change, or for any action taken by Expel's SOC (e.g. a Verify Action is sent).

Syncing is currently one-way and Workbench serves as the source of truth. This means statuses in PAN Cortex XDR Pro are updated by Workbench, but Workbench is not informed or updated by status changes made in PAN.

Workbench status syncing is available for any healthy PAN Cortex XDR Pro security device configured in Workbench.

Configuring Cortex XDR Status Syncing

Syncing can be enabled or disabled by editing your PAN Cortex XDR Pro Security Device in Workbench.

  1. Navigate to Organization Settings > Security Devices.

  2. Select the dropdown for your Cortex XDR device.

  3. Select Edit to open the Edit Security Device screen.

  4. For Enable 1-way status syncing & comments for Expel alerts?, select Yes to enable or No to disable.

    Configuration option reads Enable 1-way status syncing & comments for Expel alerts? with radio buttons to select Yes or No.

Limitations

  • Status syncing behaviors are limited to alert status and commenting. Expel Alert assignment metadata (i.e. assigned to Expel, assigned to your organization) does not map back to Cortex XDR alerts.

  • Status syncing only applies to Cortex XDR alerts that produce an Expel Alert. If a Cortex XDR alert is ingested, but does not meet Expel's detections (i.e. remains a “vendor alert”), then nothing "happens" in Cortex XDR. We acknowledge this creates a possible blind spot with regard to what our SOC is or is not triaging, and we are committed to supporting this use case in the future.

Object Mappings

Workbench Object
Syncing Key
Cortex XDR Object

Expel Alert

Cortex XDR alert ID

Alert

Expel Alert

Cortex XDR alert ID

Incident

Investigation

N/A

N/A

Incident

N/A

N/A

State Mappings

Expel Alert State or Action
Cortex XDR Status

New / Open

New

Investigating

Under Investigation

Closed

See below Close (Reason) mappings

Expel Alert (Close Reason)
Cortex XDR Alert - Close Status
Cortex XDR Incident - Close Status

Attack Failed

resolved_other

resolved_threat_handled

Benign

resolved_false_positive

resolved_false_positive

False Positive

resolved_false_positive

resolved_false_positive

Incident

resolved_true_positive

resolved_true_positive

IT Misconfiguration

resolved_other

resolved_other

Other

resolved_other

resolved_other

Phishing Simulation

resolved_security_testing

resolved_security_testing

Policy Violation

resolved_other

resolved_other

PUP/PUA

resolved_other

resolved_other

Suppressed

Suppressed (New Device)

resolved_other

resolved_other

Testing

resolved_security_testing

resolved_security_testing

Comments

In addition to the above state syncing, the “close reason” and associated analysis is added as a comment to the PAN's Cortex XDR alert or incident upon closure.

Supported Events

Event
Triggers Status Sync?
Triggers Comment?

Expel Alert Created

✅

✅

Expel Alert Closed

✅

✅

Expel Alert Reopened

✅

✅

Investigation Created

✅

✅

Investigation Closed

✅

✅

Investigation Promoted

✅

Investigation Reopened*

✅

Incident Created

✅

✅

Incident Closed

✅

✅

Incident Promoted

✅

Incident Reopened

✅

Investigative Actions

Comment Created

✅

Expel Alert Assigned

✅

Investigation Assigned

✅

Investigation Alert Added

✅

Incident Assigned

✅

Incident Downgraded

✅

Investigative Action Analysis Assigned

✅

Investigative Action Manual Action

✅

Investigative Action Assigned

✅

Notify Action Assigned

✅

Verify Action Assigned

✅

Verify Action Approved

✅

Verify Action Denied

✅

Incident Finding Created

✅

Incident Finding Updated

✅

Incident Finding Completed

✅

Remediation Action Automated

✅

Remediation Action Assigned

✅

Remediation Action Completed

✅

Remediation Action Automated Failed

✅

*Re-opening a Workbench Investigation/Incident today only impacts the “parent” object and does not trigger a state change for the included Expel Alert(s). As a result, when an Investigation/Incident is re-opened, the Expel Alert(s) remains Closed and does not trigger a sync.

Cortex API Routes Expel Uses

Route
Permission

/public_api/v1/incidents/get_incidents

VIEW PRIVILEGES:Investigation

/public_api/v1/incidents/get_incident_extra_data

VIEW PRIVILEGES:Investigation

/public_api/v1/endpoints/get_endpoint

VIEW PRIVILEGES:Investigation

Last updated

Was this helpful?