This article leads you through the process of integrating Cortex with Red Canary. Follow the procedure from beginning to end.

Requirements

Cortex Tenant licensed with
- Pro Per Endpoint (PAN-XDR-ADV-EP)
- Event Forwarding EP (PAN-XDR-EP-FRWRD)
Cortex Version 3.3 or later

Step 1: Cortex–Create a new Cortex profile

Create a Cortex configuration profile to begin collecting endpoint data in the Cortex Data Lake.

Login to the Cortex tenant that you want to connect to Red Canary.
From your address bar, copy the URL, and then save your Cortex Tenant Url. You’ll use this in a later step.
From your Cortex Homepage, click Endpoints, and then click Policy Management.
From the Prevention dropdown, click Profiles.
Scroll down, and then find the default Agent Setting profile.
Right-click the default Agent Settings profile.
Click Save As New.
Enter a name for your Cortex Profile.
Scroll down to the XDR Pro Endpoints section, and then uncheck Use Default.
From the XDR Pro Endpoints Capabilities, select Enabled.
Click Create.
To apply this security profile to Endpoints, follow these steps. For more information on Endpoint Data Collected by Cortex XDR, click here.

Step 2: Cortex–Create API Key for your Service Account

Create a service account API key to allow Red Canary to pull Indicator of Compromise (IOC) and Behavioral Indicator of Compromise (BIOC) alert data, monitor endpoint health, and respond to threats with Cortex XSOAR capabilities.

From your Cortex Homepage, click Settings, and then click Configurations.
From the Integrations dropdown, click API Keys.
Click Copy URL, and then save your Cortex API Url. You’ll use this in a later step.
Click +New Key.
From the Security Level section, select Advanced.
From the Role dropdown, select Instance Administrator.
Click Save.
Click Copy, and then save the API Key for your Service Account. You’ll use this in a later step.
From the list of API keys, search for the key you just created and copy the key ID number. Save the Cortex API Key ID. You’ll use this in a later step.

Step 3: Cortex–Download your Service Account JSON WEB Token

Download a consolidated package of credentials and tokens which Red Canary uses to authenticate and ingest telemetry data from the Cortex Data Lake hosted in Google Cloud Platform (GCP).

From your Cortex Homepage, click Settings, and then click Configurations.
From the Data Management dropdown, click Event Forwarding.
From the Activation section, click Enable Endpoints Event Forwarding.
From the Destination section, click Copy, and then save your Cortex GCP Path. You’ll use this in a later step.
From the Destination section, click Generate and download. You’ll use this file in a later step.

Step 4: Red Canary–Input your Cortex information

Enter your Cortex information into Red Canary to start sending Cortex telemetry to Red Canary.

From your Red Canary homepage, click Integrations.
From the Integrations section, locate and then click the security product you want to integrate with Red Canary.
Note: If you do not see your security product listed, click See all integrations.
In the search bar, type and then select your third-party security source.
Continue onto the next step by configuring your third-party security source in Red Canary.
Note: Your third-party security source may require that you contact Red Canary to configure.
Enter a Description.
Enter your Cortex Tenant URL from Step 1.2.
Enter your Cortex API URL from Step 2.3.
Enter your Cortex API Key - Service Account from Step 2.8.
Enter your Cortex API Key ID from Step 2.9.
Enter your Cortex GCP Path from Step 3.4.
Click Choose File, and then upload your Cortex Service Account JSON Web Token from Step 3.5.
Click Test.
If you followed the steps correctly a success message will display. If there's an error, you can follow the help text in the message and make your corrections.
Click Save.

Step 5: Cortex Support Portal–Provide Red Canary your Account Registration Link

Provide Red Canary with your Account Registration Link so we can request that a new user be added to your account. Once provided, we will use it to request user creation, and you will need to approve.

Login to your Cortex Customer Support Portal.
Click Account Management and then click Account Details.
Copy and then save the Account Registration Link.
Email this link to your Red Canary contact who is supporting your integration experience.
Note: Red Canary will use this link to request one to two users. If you have purchased Active Remediation, two user requests will be submitted.

Step 6: Cortex Support Portal–Approve the new user notification(s)

Red Canary needs you to approve the new user notification(s).

Note: You will receive two separate user approval notifications if you are an Active Remediation user. These users will default to the “Standard User” support portal role, which Red Canary requires.

The Red Canary contact who is supporting your integration experience will notify you that the user request(s) have been submitted for your approval.
Login to your Cortex Customer Support Portal.
Click the Notification bell.
Click Approve for the notification titled “New user RC Viewer has requested access to your account.”
If you have purchased Active Remediation, click Approve for the notification titled “New user RC Active Remediation has requested access to your account.”

Step 7: Cortex Gateway–Create a Red Canary Security Operations role

A custom role must be created in Cortex to enable Red Canary’s customer security operations team to support your security needs.

Navigate to your Cortex Gateway from the Customer Support Portal.
Click Resources.
Click XDR Gateway.
Click Permission Management, and then click Roles.
Click New Role.
In the ROLE NAME field, enter Red Canary Security Operations.
Select the permissions shown in the following images:
Click Save.

Step 8: Cortex Gateway–Update the Red Canary integration user permissions

The Red Canary integration user created in Step 5 will automatically populate within your Cortex Gateway, however it is not given a role by default. You'll need to update the user’s role to the custom Red Canary Security Operations role you created in Step 6.

Navigate to your Cortex Gateway from the Customer Support Portal.
Click Resources.
Click XDR Gateway.
Click Permission Management.
Click Permissions.
Search for the new Red Canary user and then click the pencil to edit.
From the Role section, select the role that was created in Step 6.
Click Save.
Click Yes on the validation window.

Step 9: Cortex Gateway–Update the Red Canary Active Remediation user permissions

Note: This step is only applicable for users who have purchased Active Remediation.

The Red Canary Active Remediation user created in Step 7 will automatically populate within your Cortex Gateway, however it is not given a role by default. You'll need to update the user’s role to Privileged Responder.