Box

Use Box data with Cortex XSIAM.

The capabilities and sub-capabilities listed for this connector are available with any active Cortex Cloud Posture Security license.

This connector includes the following capabilities and sub-capabilities (if applicable):

• Agent Security Scanning

How to configure the Box connector

Prerequisites

• Administrative privileges in your Box instance, including the ability to access the Admin and Dev console.
• Box Enterprise Advanced license, to access Box AI Studio and build custom agents.

To access Box, Cortex XSIAM requires the following information, which you will specify during the connection process.

• Enterprise ID
• Client ID and Client Secret

Task 1: Gather information from your Box AI application

1

Create and Configure a Custom Box App

1. Sign in to your Box instance.
2. From the left navigation pane, select Dev Console > Create Platform App > Custom App.
3. On the Custom App page, enter the following information:

   1. Give a suitable App Name.
   2. Give a suitable Description (optional).
   3. For Purpose, choose Automation from the drop-down and click Next.
4. Select Server Authentication (Client Credentials Grant) for the authentication method and click Create App.
5. On the newly created app page, select the Configuration tab.
6. In the OAuth 2.0 Credentials section, copy the Client ID and the Client Secret (Fetch Client Secret) to a text file for use during data connection.
7. In the App Access Level section, choose App+Enterprise Access.
8. In the Application Scopes > Content Actions section, ensure you select the following checkbox options:

   1. Read all files and folders stored in Box.
   2. Write all files and folders stored in Box.
   3. Manage AI.
9. Ensure you deselect all other checkbox options under Application Scopes > Administrative Actions and Application Scopes > Developer Actions.
10. Click Save Changes.
11. Back on the newly created app page, select Authorization > Review and Submit and then click Submit. Your new app will move to the Pending Authorization state.

2

Authorize the App in the Admin Console

1. Click Back to My Account on the left navigation pane and select Admin Console > Integrations > Platform Apps Manager.
2. On the Server Authentication Apps list, find the app you created and select ... > Authorize App > Authorize.

3

Retrieve the Enterprise ID

1. Go back to My Account > Dev Console and select the app you created.
2. Copy the Enterprise ID (available in the General Settings tab). Repeat the authorization process again if you modify any settings during configuration.

Task 2: Connect Box AI Agents to Cortex XSIAM

1. In Cortex XSIAM, navigate to Settings → Data Sources & Integrations.
2. Click + Add new.
3. In the Add Data Sources or Integrations page, search for Sentry.
4. Under Recommended, hover over the new Sentry integration and click Add Instance to launch the configuration wizard.
5. Under the Capabilities tab, Enter a Name for your application.
6. Select Security Posture under Default Capabilities.
7. Click Next.
8. Under Connection, enter your Enterprise ID, Client ID, and Client Secret.
9. Under Configuration tab, select a Sync Interval. Choose a meaningful Tag to distinguish between various applications in different environments.
10. A confirmation message indicates that Sentry is successfully connected. Confirm the Summary details and click Save instance.