Configure Cortex XDR for Arctic Wolf Active Response

With the Active Response service, Arctic Wolf® can perform host-based response actions in your network using Palo Alto Networks Cortex XDR®.

Cortex XDR supports these response actions:
  • Contain a host/Remove from containment
  • Quarantine a file/Remove from quarantine

For more information, see Response action descriptions.

These resources are required:

  • Administrator permissions for Cortex XDR.
  • One of these licenses:
    • Cortex XDR Prevent
    • Cortex XDR Pro per Endpoint
    • Cortex XDR Pro per GB
  • Contact your CST to validate the Active Response integration. Have a device or environment ready that Arctic Wolf can use to validate the desired response actions without causing interruptions.

Create the Cortex XDR Active Response role

  1. Sign in to the Cortex XDR console as an administrator.
  2. In the Cortex XDR console, click Settings, and then click Configurations > Access Management > Roles.
  3. Click +New Role.
  4. In the Role Name field, enter a unique and descriptive name for the role, for example, Arctic Wolf Active Response Role.
  5. In the Role Description field, enter a description for the role.
  6. Select Components > Incident Response.
  7. For the Action Center permission, select View/Edit.
    1. Select the Isolate checkbox.
    2. Select the Quarantine checkbox.
  8. Select Components > Endpoints.
  9. For the Endpoint Administration permission, select View.
  10. Click Save.

Generate the Cortex XDR API key for Active Response

  1. In Cortex XDR, click Settings, and then click Configurations > Integrations > API Keys.
  2. Click +New Key.
  3. In the Generate API Key window, configure these settings:
  4. Clear the Enable Expiration Date checkbox.
  5. Click Generate.

    The Generated Key value displays.

    Note:
    This value only displays once. Copy the value, and then save it in a safe, encrypted location.

    You will provide this value to Arctic Wolf later.

  6. Click Close.
  7. Copy the ID value for the new API key, and then save it in a safe, encrypted location.

    You will provide this value to Arctic Wolf later.

  8. Click Copy API URL to copy the API base URL, and then save it in a safe, encrypted location.

    You will provide this value to Arctic Wolf later.

Provide Cortex XDR Active Response credentials to Arctic Wolf

  1. Sign in to the Arctic Wolf Unified Portal.
  2. In the navigation menu, click Organization Profile > Integrations.
  3. On the Active Response tab, click New Active Response Integration +.
  4. Click Cortex XDR.
  5. On the New Active Response Integration page, configure these settings:
  6. Click Save Integration.