Palo Alto Networks Certified Security Automation Engineer (PCSAE)Cortex XSOAR FundamentalsMedium
An organization is migrating its security operations to Cortex XSOAR and wants to integrate its existing Active Directory (AD) for user authentication and authorization. The security administrator needs to configure XSOAR to synchronize user accounts and groups from AD, ensuring that user roles and permissions in XSOAR are mapped based on their AD group memberships. Which XSOAR integration type is specifically designed to achieve this?
- ALDAP Integration
- BGeneric API Integration
- CCloud Identity Provider (IdP) Integration
- DSIEM Integration
Show answer & explanationAnswer & explanation
Correct answer: A. LDAP Integration
LDAP (Lightweight Directory Access Protocol) integration is the standard method for connecting Cortex XSOAR to Active Directory or other directory services for user authentication, synchronization, and mapping roles based on group memberships.
Why the other options are wrong
- B. Generic API Integration is too broad and would require custom development for AD functionality.
- C. Cloud Identity Provider Integration (e.g., SAML, OAuth) is for cloud-based IdPs, not on-premises Active Directory directly.
- D. SIEM Integration is for ingesting security alerts and logs, not for user management.
Cortex XSOAR LDAP Integration
A feature that allows Cortex XSOAR to connect with LDAP-compatible directory services (like Active Directory) for user authentication, synchronization, and role mapping.
- Supports Active Directory
- Synchronizes users and groups
- Maps AD groups to XSOAR roles
Memory trick: LDAP is the 'Link' to your company directory.