Integrating PrivX with XSOAR

To integrate PrivX with Cortex XSOAR by Palo Alto Networks, do the following:

1. Install XSOAR
2. Install PrivX content pack.
3. Create a new PrivX role. Grant the role with connections-authorize permissions:

1. Create a new API Client in PrivX UI at Administration/Deployment/Integrate with PrivX Using API Clients.
   Grant the previously created role to the API client so the API client receives connections-authorize permissions.
   Also ensure that it has a role needed to access the desired account on the target host.

See API-Client Integration for more info.

1. Create an SSH key pair for which the ephemeral certificates are created. This is an example, you can use existing public key as well:

% ssh-keygen -t rsa -b 4096
Generating public/private rsa key pair.
Enter file in which to save the key (~/.ssh/id_rsa): id_rsa_test
Enter passphrase (empty for no passphrase): 
Enter same passphrase again: 
Your identification has been saved in id_rsa_test
Your public key has been saved in id_rsa_test.pub

% cat id_rsa_test.pub 
ssh-rsa AAAAB3NzaC1yc2EA....GSCjSzEHDclQ== user@host

1. Configure PrivX content pack with the following attributes:

1. Click "Test" button in XSOAR integration page, you should receive "Success" message:

1. Now you're ready for testing the XSOAR commands:

!privx-get-cert username=xsoar hostname=10.1.12.15
!privx-get-cert username=xsoar hostname=10.1.12.15 service=SSH role-id=b4a9749e-bc9b-5e96-4c63-9bfd58b74e7b

!privx-get-secret name=the-secret
!privx-get-secret name=another-secret