> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-and-data-from-dropbox.md). # Ingest Logs and Data from Dropbox {% hint style="info" %} ### Notice Ingestion of logs and data requires a Cortex XDR Pro per GB license. {% endhint %} Cortex XDR can ingest different types of data from Dropbox Business accounts using the Dropbox data collector. To receive logs and data from Dropbox Business accounts via the Dropbox Business API, you must configure the Collection Integrations settings in Cortex XDR based on your Dropbox Business Account credentials. After you set up data collection, Cortex XDR begins receiving new logs and data from the source. When Cortex XDR begins receiving logs, the app creates a new dataset for the different types of data that you are collecting, which you can use to initiate XQL Search queries. For example queries, refer to the in-app XQL Library. For all logs, Cortex XDR can raise Cortex XDR alerts (Analytics, Correlation Rules, IOC, and BIOC), when relevant from Dropbox Business logs. While Correlation Rules alerts are raised on non-normalized and normalized logs, Analytics, IOC, and BIOC alerts are only raised on normalized logs. The following table provides a brief description of the different types of data you can collect, the collection method and fetch interval for new data collected, the name of the dataset to use in Cortex XDR to query the data using XQL Search, and whether the data is normalized. {% hint style="info" %} ### Note The Fetch Interval is non-configurable. {% endhint %} | Type of data | Description | Collection method | Fetch interval | Dataset name | Normalized data | | -------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------- | -------------- | ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------- | | **Log collection** | | | | | | | Events |

Retrieves team events, including access events, administrative events, file/folders events, security settings events, and more.

team\_log/get\_events

| Appends data | 60 seconds | `dropbox_events_raw` | When relevant, Cortex XDR normalizes SaaS audit event logs into stories, which are collected in a dataset called `saas_audit_logs`. | | **Directory and metadata** | | | | | | | Member Devices |

Lists all device sessions of a team.

team/devices/list\_members\_devices

| Overwrites data | 10 minutes | `dropbox_members_devices_raw` | — | | Users |

Lists members of a group.

team/members/list\_v2

| Overwrites data | 10 minutes | `dropbox_users_raw` | — | | Groups |

Lists groups on a team.

team/groups/list

| Overwrites data | 10 minutes | `dropbox_groups_raw` | — | {% hint style="warning" %} ### Prerequisite 1. Set up an [Advanced](https://www.dropbox.com/plans) Dropbox plan. 2. Create a Dropbox Business [admin account](https://help.dropbox.com/account-access) with **Security admin** permissions, which is required to authorize Cortex XDR to access the Dropbox Business account and generate the OAuth 2.0 access token. {% endhint %} Configure Cortex XDR to receive logs and data from Dropbox. 1. Complete the prerequisite steps mentioned above for your Dropbox Business account. 2. Log in to Dropbox using an admin account designated with **Security admin** level permissions. 3. In the Dropbox **App console**, ensure that you either create a new app, or your existing app is created, with the following settings: * **Choose an API**: Select **Scoped access**. * **Choose the type of access you need**: Select **Full dropbox** for access to all files and folders in a user's Dropbox. 4. In the **Permissions** tab of your app, ensure that the applicable permissions are selected under the relevant section heading for the type of data you want to collect: | Section heading | Permission | Data to collect | | ---------------- | ---------------------- | ----------------- | | **Account Info** | **account\_info.read** | All types of data | | **Team Data** | **team\_data.member** | All types of data | | **Members** | **members.read** | Users | | **groups.read** | Groups | | | **Sessions** | **sessions.list** | Member Devices | | **events.read** | Events | | 5. In the **Settings** tab of your app, copy the **App key** and **App secret** , where you must click **Show** to see the App secret and record them somewhere safe. You will need to provide these keys when you configure the Dropbox data collector in Cortex XDR. 6. In Cortex XDR, select **Settings** → **Configurations** → **Data Collection** → **Collection Integrations**. 7. In the **Dropbox** configuration, click **Add Instance**. 8. Set the following parameters: * **Name**: Specify a descriptive name for this Dropbox instance. * **App Key**: Specify the **App key**, which is taken from the [Settings tab](#UUID-48e935c0-46ce-a230-f252-618585853dd1_N1667467209646) of your Dropbox app. * **App Secret**: Specify the **App secret**, which is taken from the [Settings tab](#UUID-48e935c0-46ce-a230-f252-618585853dd1_N1667467209646) of your Dropbox app. * **Access Code**: After specifying an **App Key**, you can obtain the access code by hovering over the **Access Code** tooltip, clicking the **here** link, and signing in with your Dropbox Business account credentials. The URL link is `https://www.dropbox.com/oauth2/authorize?client_id=%APP_KEY%&token_access_type=offline&response_type=code`, where the `%APP_KEY%` is replaced with the **App Key** value specified.

Note

When the App Key field is empty, the here link in the tooltip is disabled. When an incorrect App Key is entered, clicking the link results in a 404 error.

To obtain the Access Code complete the following steps in the page that opens in your browser: 1. Read the disclaimer and click **Continue**. 2. Review the permissions listed, which should match the permissions you configured in your Dropbox app in the [Permissions tab](#UUID-48e935c0-46ce-a230-f252-618585853dd1_N1667490419389) according to the type of data you want to collect, and click **Allow**. 3. Copy the **Access Code Generated** and paste it in the **Access Code** field in Cortex XDR. The access code is valid for around four minutes from when it is generated.

Note

Whenever you change the permissions of the Dropbox app, we recommend that you generate a new Access Code for the Dropbox data collector instance so that the permissions match the updates.

* **Collect**: Select the types of data you want to collect from Dropbox. All the options are selected by default. * Log collection * **Events (get\_events}**: Retrieves team events, including access events, administrative events, file/folders events, security settings events and more.

Note

Event data is collected every 60 seconds with a 10 minute lag time.

* Directory and metadata * **Member Devices**: Collects all device sessions of a team. * **Users**: Collects all members of a group. * **Groups**: Collects all groups on a team.

Note

Inventory data snapshots are collected every 10 minutes.

9. **Test** the connection settings. 10. If successful, **Enable** Dropbox log collection. Once events start to come in, a green check mark appears underneath the Dropbox configuration. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/data-management/data-ingestion/external-data-ingestion/additional-log-ingestion-methods/ingest-logs-and-data-from-dropbox.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.