> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-and-data-from-box.md). # Ingest Logs and Data from Box {% hint style="info" %} ### Notice Ingestion of logs and data requires a Cortex XDR Pro per GB license. {% endhint %} Cortex XDR can ingest different types of data from Box enterprise accounts using the **Box** data collector. To receive logs and data from Box enterprise accounts via the Box REST APIs, you must configure the Collection Integrations settings in Cortex XDR based on your Box enterprise account credentials. After you set up data collection, Cortex XDR begins receiving new logs and data from the source. When Cortex XDR begins receiving logs, the app creates a new dataset for the different types of data that you are collecting, which you can use to initiate XQL Search queries. For example queries, refer to the in-app XQL Library. For all logs, Cortex XDR can raise Cortex XDR alerts (Analytics, Correlation Rules, IOC, and BIOC), when relevant from Box logs. While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC, and BIOC alerts are only raised on normalized logs. The following table provides a brief description of the different types of data you can collect, the collection method and fetch interval for new data collected, the name of the dataset to use in Cortex XDR to query the data using XQL Search, and whether the data is normalized. {% hint style="info" %} ### Note The Fetch Intervals are non-configurable. {% endhint %} | Type of data | Description | Collection method | Fetch interval | Dataset name | Normalized data | | ------------------------------ | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | -------------- | ----------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | **Events and security alerts** | | | | | | | Events (admin\_logs) | Retrieves events related to file/folder management, permission changes, access and login activities, user/groups management, folder collaboration, file/folder sharing, security settings changes, tasks, permission changes on folders, storage expiration and data retention, and workflows. | Appends data | 60 seconds | `box_admin_logs_raw` | When relevant, Cortex XDR normalizes SaaS audit event logs into stories, which are collected in a dataset called `saas_audit_logs`. | | Box Shield Alerts |

Retrieves security alerts related to suspicious locations, suspicious sessions, anomalous download, and malicious content.

Note

Collecting Box Shield Alerts requires implementing Box Shield,

| Appends data | 60 seconds | `box_shield_alerts_raw` | — | | **Directory and metadata** | | | | | | | Users | Lists user data. | Overwrites data | 10 minutes | `box_users_raw` | — | | Groups | Lists user group data. | Overwrites data | 10 minutes | `box_groups_raw` | — | {% hint style="warning" %} ### Prerequisite 1. Set up an [Enterprise](https://www.box.com/pricing) Box plan.

Important

To collect Box Shield Alerts, you must purchase Box Shield and it must be enabled on Box enterprise.

2. Create a valid Box account that is assigned to a role with sufficient permissions for the data you want to collect. For example, create an account assigned to an Admin role to enable Cortex XDR to collect all metadata for all files, folders, and enterprise events for the entire organization. 3. Enable two-factor authentication for the Box account. For more information, see the [Box documentation](https://support.box.com/hc/en-us/articles/360043697154-Two-Factor-Authentication-Set-Up-for-Your-Account). {% endhint %} Configure Cortex XDR to receive logs and data from Box. 1. Complete the prerequisites mentioned above for your Box enterprise account. 2. Create a new app in your Box account. 1. Log in to your Box account, and in the [Dev Console](https://account.box.com/login?redirect_url=%2Fdevelopers%2Fconsole), click **Create New App**. 2. Select **Custom App**. 3. Set these settings in the **Custom App** dialog: * Select **Server Authentication (Client Credentials Grant)**. * Specify an **App Name**. * Click **Create App**. The new app is created and the opened in the **Configuration** tab. 4. In the **Configuration** tab of the new app, scroll down to the following sections and configure the app. * In the **App Access Level** section, select **App + Enterprise Access**. * In the **Application Scopes** section, set the following **Administrative Action** permissions depending on the type of data you want to collect. | Administrative action | Data type | | -------------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | **Manage users** | Users | | **Manage groups** |

Groups

Note

There is a current bug with the Groups API from Box. If you don't configure the Box app with the proper permissions for managing groups data, the Groups API from Box won't return an error message to Cortex XDR indicating that the API failed to receive the data, and the Groups data will not be collected.

| | **Manage enterprise properties** | | Once completed, scroll up in the tab to **Save Changes**. 5. In the **Authorization** tab, click **Review and Submit** to send your changes to the administrator for approval. In the **Review App Authorization Submission** dialog that is displayed, you can add a **Description** of the app changes, and then click **Submit**. 3. Ensure the new app changes are approved by an administrator in the **Admin Console** of the Box account. 1. Select **Apps** → **Customer Apps Manager** → **Server Authentication Apps**. 2. In the table, look for the **Name** of the Box app with the changes, where the **Authorization Status** is set to **Pending Authorization**, and select the **options menu** → **Authorize App**. 3. Click **Authorize**.

Note

For any future change that you make to your Box app, ensure that you send the changes for approval to the administrator, who will need to approve them as explained above.

4. In Cortex XDR, select **Settings** → **Configurations** → **Data Collection** → **Collection Integrations**. 5. In the **Box** configuration, click **Add Instance**. 6. Set the following parameters, where some values require you to log in to your Box account to copy and paste the values to the applicable fields: * **Name**: Specify a descriptive name for this Box instance. * **Enterprise ID**: Specify the unique identifier for your organization's Box instance, which is used to access the token request. This field can't be edited once the Box data collector instance is created. You can retrieve this value from your Box account in the the **General Settings** tab, and scrolling to the **App Info** section. Copy the **Enterprise ID** and paste it in this field in Cortex XDR. * **Client ID**: Specify the client ID or API key for the Box app you created. You can retrieve this value from your Box account in the **Configuration** tab, and scrolling down to the **OAuth 2.0 Credentials** section. **COPY** the **Client ID** and paste it into this field in Cortex XDR. * **Client Secret**: The client secret or API secret fort he Box app you created. You can retrieve this value from your Box account in the **Configuration** tab, and scrolling down to the **OAuth 2.0 Credentials** section. Click **Fetch Client Secret**, where you will need to authenticate yourself according to the [two-factor authentication method](#UUID-43fbc537-5cdf-8afd-10ba-dd448be327f8_listitem-idm53336178838098) defined in your Box app before the **Client Secret** is displayed. Copy this value and paste it in this field in Cortex XDR. * **Collect**: Select the types of data you want to collect from Box. All the options are selected by default. * Events and security alerts * **Events (admin\_logs)**: Collects events related to file/folder management, permission changes, access and login activities, user/groups management, folder collaboration, file/folder sharing, security settings changes, tasks, permission changes on folders, storage expiration and data retention, and workflows. * **Box Shield Alerts**: Collects security alerts related to suspicious locations, suspicious sessions, anomalous download, and malicious content. * Directory and metadata

Note

Inventory data snapshots are collected every 10 minutes.

* **Users**: Collects user data. * **Groups**: Collects user group data. 7. **Test** the connection settings. 8. If successful, **Enable** Box log collection. Once events start to come in, a green check mark appears underneath the Box configuration. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-and-data-from-box.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.