Palo Alto Cortex XDR Alert Retriever - How to configure proxy settings for TA-palo-alto-cortex-xdr retriever?

[Lj231]

Hello,

we are using the TA for Palo Alto Cortex XDR (retriever) to collect data via API.
In our environment, outbound internet access is only possible through a proxy.

However, we were unable to find any configuration option within the app (neither in the Splunk UI nor in the config files) that allows us to specify proxy settings for the retriever input.

Could you please clarify the following:

1. Is proxy configuration supported for this TA/retriever input?

2. If yes, where and how can the proxy be defined (GUI, config files, or environment variables)?

3. If no proxy field is available:

   • Does the retriever rely on environment variables such as HTTPS_PROXY?

We would highly appreciate any official documentation or best practices for proxy setup in this context.

Thanks in advance for your support.

[livehybrid]

Hi @Lj231 

This app uses the python requests library, therefore you should be able to set a HTTP_PROXY/HTTPS_PROXY in $SPLUNK_HOME/etc/splunk-launch.conf

HTTP_PROXY="http://user:pass@proxy_ip:proxy_port"
HTTPS_PROXY="http://user:pass@proxy_ip:proxy_port"

Note that this will apply to the whole instance, not just that specific app. You will need to restart Splunk after configuring this.

🌟 Did this answer help you? If so, please consider:

• Adding karma to show it was useful

• Marking it as the solution if it resolved your issue

• Commenting if you need any clarification

Your feedback encourages the volunteers in this community to continue contributing.