Add an integration instance

Add and configure Cortex AgentiX integration instances for third-party security tools, issue ingestion, and automation.

Configure Cortex AgentiX integration instances to connect with third-party security and incident management products.

When you define an integration instance for your third-party security and incident management vendors, events triggered by this integration instance can become cases in Cortex AgentiX. When cases are created, you can run playbooks on them to enrich them with information from other products in your system. For indicators, you can enrich those indicators depending on the integration instance and add them to a case if required.

Although you can view the integration documents when adding an instance, the Developer Hub has more detailed information about the integrations, including commands, outputs, and recommended permissions. You can also see more information about content packs, playbooks, scripts, and Marketplace documentation.

Note

This procedure describes how to add an integration instance from the Data Sources & Integration page. Some integration instances can also be configured on the Data Sources page. For more information, see Add a new data source or instance.

Before you configure an integration instance

• From Marketplace, download and install the relevant content pack, which includes your integration. Content packs containing integrations are also downloaded, in some cases, when you adopt playbooks and configure playbook tasks.
• Consider whether you want to add credentials, which enable you to save login information without exposing usernames, passwords, certificates, and SSH keys. For more information, see Manage credentials.

1. Navigate to Settings → Data Sources & Integrations and search for the integration for which you want to add an instance.
2. Select the integration and click Add Instance.
3. Add the parameters as required.
4. If you want to fetch issues, select the Fetches alerts.

   For more information, see Fetch issues from an integration instance.
5. (Optional) To check that the integration instance is working correctly, click Test.
6. Save & Exit.

   Expand the integration to see more details such as the number of pulled issues/indicators or error messages.

   

   integration-details.png

   You can also enable/disable the integration instance, copy the instance, and view the integration fetch history.

   If you encounter an error, see Troubleshoot Integrations.
7. By default, the integration instance is used whenever the integration is called. If you want to only use the integration instance when specified with the using argument in a playbook or the CLI, change the integration instance setting from Always to On Demand. For example, you might have two instances of an integration and want to use one instance as the default and the other instance only for manual testing on demand.
8. (Optional) To manage access to specific commands, see Configure integration permissions.

Example: configure an OnboardingIntegration instance

In this example, you will set up the OnboardingIntegration.

If you have not done so, download the OnboardingIntegration content pack from Marketplace. Most integrations follow a similar configuration.

1. Go to Settings → Data Sources & Integrations and search for OnboardingIntegration.
2. Click Add Instance.
3. Add the number of issues to fetch per minute. By default, there is a maximum of 5 issues per minute.
4. Add the maximum number of issues to create. By default, there is a maximum number 10 issues to create.
5. Add the number of issues you want to create in minutes.
6. Set the Alerts Fetch Interval. By default, the issues are fetched every minute.
7. Select whether to run on an engine.
8. When troubleshooting the instances, adjust the default setting from off to a higher debugging level.
9. Select Fetches alerts to start ingesting issues.

   For all integrations, we recommend only fetching issues when everything is set up. When enabled, Cortex AgentiX searches for events that occurred within the time frame set for the integration, which is based on the specific integration. The default is 5 issues per minute.

   Note

   In some integrations, a classifier, an issue type, and mapper fields are included.
10. Test and Save & Exit.