http, alias: paloaltocortex) lets you configure your telemetry pipeline to send
logs to Palo Alto Networks Cortex XSIAM.
Supported telemetry types
The for Chronosphere Telemetry Pipeline supports these telemetry types:| Logs | Metrics | Traces |
|---|---|---|
Configuration parameters
Use the parameters in this section to configure the . The Telemetry Pipeline web interface uses the items in the Name column to describe these parameters. Pipeline configuration files use the items in the Key column as YAML keys.General
| Name | Key | Description | Default |
|---|---|---|---|
| Cortex URL | host | Required. Specifies your Cortex XSIAM webhook URL. | api-{tenant external URL}.crtx.us.paloaltonetworks.com |
| Port | port | Required. Specifies TCP port of the target HTTP server. | 443 |
| Cortex URI and Instance | uri | Required. Specifies the URI to use as part of the request. | /xsoar/instance/execute/my_instance_01 |
| Headers | header | Required. Sets an HTTP header key/value pair. Use your ingest API token to authenticate with Cortex XSIAM. | Authorization [REPLACE WITH TOKEN] |
Advanced
| Name | Key | Description | Default |
|---|---|---|---|
| Format | format | Specifies the data format to use in the HTTP request body. Accepted values: json_lines, json, json_stream. | json |
| Compress | compress | Sets the payload compression mechanism. Accepted values: gzip, none. | none |
| HTTP Proxy | proxy | Specifies an HTTP proxy. The expected format of this value is http://host:port. | none |
| JSON Date Format | json_date_format | Sets the date format. Accepted values: double, epoch, iso8601, java_sql_timestamp. | iso8601 |
| JSON Date Key | json_date_key | Specifies the name of the date field in output. | _time |
| Body Key | body_key | Specifies the key that contains the format. | none |
| Header Tag | header_tag | Sets an HTTP header whose value is the tag of the record. | none |
| Header Key | headers_key | Specifies the key that contains the headers. | none |
Security and TLS
| Name | Key | Description | Default |
|---|---|---|---|
| TLS | tls | If true, enables TLS/SSL. If false, disables TLS/SSL. Accepted values: true, false. | true |
| TLS Certificate Validation | tls.verify | If on, and if tls is true, enables TLS/SSL certificate validation. If off, disables TLS/SSL certificate validation. Accepted values: on, off. | on |
| TLS Debug Level | tls.debug | Sets TLS debug verbosity level. Accepted values: 0 (No debug), 1 (Error), 2 (State change), 3 (Informational), 4 (Verbose). | 1 |
| CA Certificate File Path | tls.ca_file | Absolute path to CA certificate file. | none |
| Certificate File Path | tls.crt_file | Absolute path to certificate file. | none |
| Private Key File Path | tls.key_file | Absolute path to private key file. | none |
| Private Key Path Password | tls.key_passwd | Password for private key file. | none |
| TLS SNI Hostname Extension | tls.vhost | Hostname to be used for TLS SNI extension. | none |
Advanced Networking
| Name | Key | Description | Default |
|---|---|---|---|
| DNS Mode | net.dns.mode | Selects the primary DNS connection type, which can be TCP or UDP. | none |
| DNS Resolver | net.dns.resolver | Selects the primary DNS connection type, which can be LEGACY or ASYNC. | none |
| Prefer IPv4 | net.dns.prefer_ipv4 | Prioritizes IPv4 DNS results when trying to establish a connection. Accepted values: true, false. | false |
| Keepalive | net.keepalive | Enables or disables Keepalive support. Accepted values: true, false. | true |
| Keepalive Idle Timeout | net.keepalive_idle_timeout | Sets the maximum time allowed for an idle Keepalive connection. | 30s |
| Max Connect Timeout | net.connect_timeout | Sets the maximum time allowed to establish a connection, which includes the TLS handshake. | 10s |
| Max Connect Timeout Log Error | net.connect_timeout_log_error | Specifies whether to log an error on connection timeout. When disabled, the timeout is logged as a debug message. Accepted values: true, false. | true |
| Source Address | net.source_address | Specifies the network address to bind for data traffic. | none |
| Max Keepalive Recycle | net.keepalive_max_recycle | Sets the maximum number of times a keepalive connection can be used before it’s retired. | 2000 |
Basic Authentication
| Name | Key | Description | Default |
|---|---|---|---|
| HTTP Username | http_user | Basic auth username. | none |
| HTTP Password | http_passwd | Basic auth password. Requires http_user to be set. | none |