Configure access to external storage

Configure Azure Blob, Amazon S3, or S3-compatible storage for Cortex XSOAR 8 SaaS incident exports.

Configure external cloud storage before exporting Cortex XSOAR incidents. Set up egress in Cortex Gateway, then add Azure Blob, Amazon S3, or S3-compatible storage in Cortex XSOAR.

The Azure Blob Storage feature is disabled by default. To enable Azure Blob Storage, contact Customer Support.

Before you begin

Before you begin, you need the following information from your external storage solution:

• Azure Blob:

  • SAS token: If you are using a SAS token, you need the account name, container name, and the SAS token.
  • Service Principal: If you are using a Service Principal, you need the account name, container name, tenant ID, client ID, and client secret.
  • The following permissions are required:

    • Read (r): get_container_properties, download_blob
    • List (l): list_blobs
    • Write (w): upload_blob
    • Delete (d): delete_blob
• Amazon S3

  • Bucket name, region, access key, and secret key.
  • The following Amazon S3 bucket policies must be allowed:

    • s3:PutObject
    • s3:GetObject
    • s3:DeleteObject
    • s3:ListBucket
• S3-Compatible

  • Domain name or IP address of the path, bucket name, URL, access key, and secret key.

Example: Retrieve information from Amazon S3

Configure external storage access

Complete these tasks in order. First, allow outbound traffic in Cortex Gateway. Then add the storage connection in Cortex XSOAR.

Configure egress in Cortex Gateway

Only a user with Account Admin or Instance Admin permissions can configure egress. For more information, see Egress configurations.

1. In the Cortex Gateway, go to Permission Management → Egress Configurations → Path.
2. Select the account name and tenant.
3. In the Flow field:

   • For Azure Blob, select Data Exporter Azure Blob Storage Account Name or Data Exporter Azure Blob Container Name.
   • For Amazon S3, select External Storage: AWS S3.
   • For S3-compatible storage, select External Storage: S3-compatible.
4. In the Path field:

   • For Amazon S3 storage, enter only the bucket name for the Path.
   • For S3-compatible storage, enter the domain name or IP address of the path.
   • For Azure Blob storage, enter the Storage Account Name if you selected the Data Exporter Azure Blob Storage Account Name flow option. Enter the Blob Container Name if you selected the Data Exporter Azure Blob Container Name flow option.

Configure external storage in the Cortex XSOAR 8 SaaS tenant

1. Go to Settings & Info → Settings → System → External Storage → New.
2. Enter a storage name of your choice and select whether the storage is AWS S3 or S3-Compatible.

   • For Azure Blob, choose SAS Token or Service Principal.

     • For SAS Token authentication, enter the Account name, Container name, and SAS token.
     • For Service Principal authentication, enter the Account name, Container name, Tenant ID, Client ID, and Client secret.
   • For Amazon S3, enter the Bucket name, Region, Access key, and Secret key.
   • If you are instead using a storage option such as GCP configured to be S3-compatible, enter the Bucket name, URL, Access key, and Secret key.
3. Test connection.

   If the connection fails, confirm that you configured egress in the Cortex Gateway, the credentials are correct, and you have write permissions to the bucket.
4. Save the configuration.

Next steps

After configuration, export incidents to your cloud storage solution:

• Export Cortex XSOAR incidents to cloud storage

• Schedule incident export

• Export incidents on demand