Looking to build out our Cortex XDR/Rapid7 integration so that I can do incident response from the Rapid7 console (Isolate Machine, run antivirus scan, etc).
I can see in the documentation that an API key is needed to connect to our Cortex XDR instance. I cannot see what permissions this API key will need.
Has anyone completed this integration already and if so could they let me know what permissions they used on the key? Or alternatively if there’s any documentation on the permissions needed that I’ve missed that would also be awesome.
Awesome, thanks Darrick. This is enough of a launching pad that I can create a change request to get the API key created and modify the permissions needed down the line as needed - appreciate the response.