A company has a highly segmented network where the Cortex XSOAR server cannot directly communicate with an on-premises mail server. Which component should be deployed in the mail server's segment to facilitate integration?
In Cortex XSOAR architecture, the Cortex XSOAR Engine is the dedicated component used to extend the platform's reach into remote or restricted network segments.
Remote Execution: The Engine is installed in the remote segment and establishes an outbound connection to the main XSOAR server. It then executes integration commands (like checking mailboxes or querying Active Directory) locally within that segment.
Security: This architecture avoids the need to open multiple inbound ports through internal firewalls, adhering to the "Secure-by-Design" principle.
Note on Broker VM: While the Broker VM is used for Cortex XDR/XSIAM log ingestion, the Engine is the specific terminology for the XSOAR remote execution component.
Contribute your Thoughts:
Chosen Answer:
This is a voting comment (?). You can switch to a simple comment. It is better to Upvote an existing comment if you don't have anything to add.
Submit