Paloalto Cortex XDR dashboard into Grafana

[PuddyPuddy]

Hello,

I am trying to set up a dashboard in Grafana to monitor my AV incidents. I followed the instructions in this topic.

I installed the Infinity plugin and configured the authentication for Cortex XDR. However, when I test the authentication, I encounter a 500 error.

Could you provide more context or guidance on resolving this issue? Thank you!

[yosiasz]

Welcome @PuddyPuddy

What did you try for the authentication, can you share a screen shot? Also something from your grafana logs?

[PuddyPuddy]

Hello,

Here is what I’m trying to setup the authentification ;

[yosiasz]

which Auth method did you use? and looks like you do not have the URL set

[PuddyPuddy]

I’m using the Cortex XDR API (the secret is in the Headers)

[yosiasz]

did you purposely leave this blank?

[PuddyPuddy]

Yes, i leave this blank on purpose

[yosiasz]

you left it blank in order to hide it from your post. if not that might be why it is failing? you either provide that URL here, or in the query for this api in a panel datasource query. if you leave it blank here there is nothing it can authenticate against

[PuddyPuddy]

It’s optional, but I added it (URL) and nothing changed. When I click on ‘Save & Test’, it authenticates against the health check URL.

[yosiasz]

can you look at grafana logs, or check the browser console to see what might be wrong and the details error message

[PuddyPuddy]

Hello,

Here the logs ;

[PuddyPuddy]

Hello,

the bot keep blocking my reply, but here the logs in txt ;

health check failed with url https://api-apipa.paloaltonetworks.com/api_keys/validate/. error received: unsuccessful HTTP response. 500 Internal Server Error (Grafana)

Failed to load resource: the server responded with a status of 400 (Bad Request) (Browser Console)

[PuddyPuddy]

I noticed that Grafana (Infinity) trying to execute the following command:

curl --location "command"

it fails. However, when i’m using :

curl -X POST "command"

it works successfully.

[yosiasz]

hmmm so you api endpoint is called as POST and not GET ?

Also do you have the latest version?

Also which of these auth types are you using?

So configure it as is in datasources but don’t test it as the default seems to not be GET when configuring the datasource, just configure the auth there.

but then when calling your data source make sure to use POST and see what happens

[PuddyPuddy]

i made it !

i just have to add a body !

Thanks for your help, when i setup all, i update the topic