Integrating Cato Data with Stellar Cyber

Overview

Use the Stellar Cyber integration to analyze Cato network and security data in Stellar Cyber Open XDR. The native integration sends data directly to an XDR Connect webhook, where you configure normalization and field mappings for your search and threat-hunting workflows.

You configure the integration in the Cato Management Application (CMA). Cato sends HTTPS POST requests containing JSON arrays and authenticates with a Stellar Cyber API token.

This Data Export integration is separate from the Stellar Cyber API integration.

Stellar Cyber Data Sources

Cato supports exporting the following data sources:

• Events: Records of network and security activity, such as policy matches, threats, connectivity changes, and audit activity.

• Flows: Network flow records that add application and user context and aggregated session details, such as bytes, packets, and duration.

Each record includes a data_source field with the value events or flows. Flow data can generate significantly more volume than event data, depending on your traffic.

Select the Cato data source that matches the Stellar Cyber destination's configuration.

Prerequisites

• Editor permission for Integrations in the Resources section of the CMA. For more information, see Managing Admin Roles Using RBAC.

• A Stellar Cyber deployment with XDR Connect available. For more information, see Stellar Cyber: Configuring XDR Connector.

• Add/Edit/Delete XDR connector access in Stellar Cyber RBAC for the administrator creating the destination, and permission to generate an API token with XDR Connector Ingestion privilege.

• Representative Cato JSON records for the data sources you plan to export, for use when configuring normalization.

• The prerequisites described in Getting Started with Event Integrations, including any required IP allowlisting.

Use Cases

Events

Send Cato events to Stellar Cyber to investigate network and security activity alongside other data. For example, an analyst can search for a recent Cato threat event and review its user, application, and site information. Automated Threat Hunting rules can provide additional detections and custom alerts.

Flows

Use flow records to add session context to an investigation. Bytes transferred, packet counts, and session duration help an analyst assess whether suspicious activity involved a brief connection or a large transfer that may warrant further investigation.

Creating the Stellar Cyber Integration

Create a Stellar Cyber API token and XDR connector, then use the generated webhook URL and token to configure the Data Export integration in the CMA.

Step 1: Create the Stellar Cyber API Token

Stellar Cyber recommends an ingestion-only role with the XDR Connector Ingestion privilege. API keys are associated with an identity rather than with an individual connector.

To create the API token:

1. Log in to Stellar Cyber using an account with permission to create the required API key.

2. Click your account name and select Profile.

3. On the API Keys tab, create an API token for an identity with XDR Connector Ingestion privilege.

4. Copy the token and store it securely. Choose its expiration according to your organization's rotation policy; Stellar Cyber recommends a 90-day expiration.

Step 2: Create the XDR Connector in Stellar Cyber

To create the destination connector:

1. Go to System > Integrations > Connectors, click Create, and select XDR Connector.

2. Enter a unique connector name, such as cato_events.

3. In Raw Log Input, paste a representative Cato JSON record for the source you plan to export. Include the fields to be mapped, including a timestamp and data_source.

4. In the General step, under Generate Connector Link, click Generate and copy connector Link. Save the complete generated webhook URL.

5. Select the destination Tenant.

6. (Optionally) Configure Tenant Mapping to route records using a tenant identifier in the incoming JSON. Configure the appropriate mapping table if the records contain vendor tenant IDs.

7. In the Normalization step, configure Vendor, Source, and Namespace.

8. Select the Index Type that matches the source. Stellar Cyber describes Syslog for events and Traffic for network flows. You cannot change this selection after creating the connector.

9. In Field Mapping, enable Timestamp Mapping and select the source field and timestamp format. Without this mapping, Stellar Cyber uses ingestion time as the event timestamp.

10. Configure mappings from raw fields to Stellar Cyber schema fields or custom namespace fields. Use Use Template if you have a mapping template.

11. Click Show Output and check the normalized sample, field types, and timestamp.

12. (Optionally) Configure enrichment in the Enrichment step.

13. Click Finish & Apply.

Use the complete generated URL for your deployment. Hosted instances generally use HTTPS on port 443. Data Analyzer destinations use the generated hostname and port 8889.

Step 3: Create the Integration in the CMA

To create the Stellar Cyber integration:

1. From the CMA navigation menu, go to Resources > Integrations.

2. Open the Configured Integrations tab and click New.

3. Select Stellar Cyber and the Data Export capability.

4. Enter a Name and an optional Description.

5. For Ingestion URL, paste the complete webhook URL generated in Step 2.

6. For Bearer Token, paste the API token with ingestion privilege. Enter only the token; Cato adds the Bearer prefix.

7. Under Data sources, select the source that matches the Stellar Cyber destination's Index Type and normalization configuration.

8. (Optionally) Configure the filters for the selected source. See Filters.

9. Click Save.

Cato stores the API token encrypted and does not display it again. Update the integration when you rotate the token.

Step 4: Verify Ingestion and Normalization

To verify that Cato data arrives in Stellar Cyber:

1. In the CMA, open Configured Integrations and confirm that the integration leaves Configuring and does not show an authentication or destination error. Refresh the page if needed.

2. Generate a recent Cato event or network traffic for each configured data source.

3. In Stellar Cyber, go to System > Integrations > Connectors and locate the XDR Connect connector.

4. After records arrive, click View Events. Confirm that each Cato record appears individually.

5. Select More Info for a record. On the JSON tab, inspect the parsed fields. On the Details tab, check the normalized fields.

6. Verify the destination tenant, index, namespace, and timestamp. Confirm that data_source matches the configured Cato source.

Filters

Use event and flow filters to limit the Cato data exported to Stellar Cyber. This helps control ingestion volume and focus investigations on relevant activity.

Filter conditions within a group use AND logic. Separate groups use OR logic.

• Events Filter – Click Add Filter to define a condition, or Add Group to add another filter group.

• Flows Filter – Available when Flows is selected. It uses the same grouping logic as the event filter.

Filters that are too restrictive can exclude all records without reporting an error. If no data arrives, check the selected data source and filter conditions.

Known Limitations

• Index Type and Namespace cannot be changed after creating a Stellar Cyber XDR connector. Choose the destination configuration before enabling export.

• A connector has a default destination tenant. Routing records to other tenants requires Tenant Mapping and an appropriate identifier in the incoming JSON.

• Stellar Cyber does not support third-party alert integration or ML-based detections for data ingested through XDR Connect. Automated Threat Hunting rules can provide additional detections and custom alerts.

• API keys are identity-based. Use a token with ingestion-only privileges and rotate it according to your policy.

• You cannot customize the Cato integration's request body format, content type, or authentication header.

Troubleshooting