Cortex XSOAR integration

Views:

Set up the Cortex XSOAR connector to view Workbench alerts and automate incident response in the Cortex XSOAR console.

The steps below provide instructions on how to create a new user account and which information is needed to complete setup in Cortex XSOAR.

Note

Cortex XSOAR integration requires a user account with certain permissions including generating an authentication token. TrendAI™ recommends creating a new user role and user account specifically for Cortex XSOAR integration.

For more information, see Creating a User Role for Cortex XSOAR Integration.

Procedure

Download TrendAI™ Vision One from the Cortex XSOAR Marketplace and open the app settings in the Cortex XSOAR console.
Create a TrendAI Vision One™ user account to integrate with Cortex XSOAR:
1. In the TrendAI Vision One™ console, go to Administration → User Accounts.
2. Click Add Account to create a new user account.
  
  The Add Account panel opens.
3. Set Role to a user role configured with the recommended permissions for integration with Cortex XSOAR.
  
  For more information, see Creating a User Role for Cortex XSOAR Integration.
4. Set Access level to APIs only.
5. Click Add.
Copy the user account authentication token:
1. Click the name of the user account you created.
  The Edit Account panel opens.
2. Click Generate a new authentication token.
3. Copy the Authentication token and paste into Cortex XSOAR.
Go to Workflow and Automation → Third-Party Integrations, and locate and click the Cortex XSOAR card.

Copy the Endpoint URL and paste into Cortex XSOAR.

Cortex XSOAR begins syncing with TrendAI Vision One™.

Note

After successfully installing the Cortex XSOAR connector, Cortex XSOAR begins pulling data from TrendAI Vision One™. The add-on does not pull preexisting data. You may need to allow some time before new data starts to appear.