Palo Alto Cortex XDR Update

x_deee
Sat, 01 Feb 2025 11:38:30 +0000
Elastic Agent

Recently, Cortex XDR by Palo Alto updated their api endpoint URLs from v1 to v2. This small change prevents data from entering our Elasticstack. So far, I have attempted to change elastic-agent.yml and change the httpjson.yml.hbs file to reflect the new url, and I have even uninstall and reinstalled the package after the changes. The agent still reverts to the v1 version of the url.

The agents make a call to /public_api/v1/alerts/get_alerts_multi_events when they should make a call to /public_api/v2/alerts/get_alerts_multi_events.

We need either an update (1.33.0) on the Cortex XDR integration package or a walk through so that we can change the API endpoint URL to v2.

9 posts - 3 participants