Configuring SMC

To connect SMC to SLS, an API key needs to be created. For more information, see the section Enabling and managing SMC's public API in the SMC administration guide. Once the key is created, store it, as you will need it when configuring SLS.

For more information on the links between SMC and SLS, refer to the section Accessing the Stormshield Log Supervisor (SLS) server in the SMC administration guide.

Some playbooks use groups that need to be created in advance.

1. Log in to the SMC server.

2. Click on Objects > Create an object.

3. Select Group.

4. Enter XDR_IP_blocked in the Object name field and click on Create.

5. Repeat the process by entering XDR_internet_blocked_IP in the Object name field.

These groups can now be used in 'block' filter rules. Some Stormshield XDR playbooks will create objects in this group, which correspond to IP addresses that must be blocked:

• XDR_internet_blocked_IP contains only public Internet IP addresses,

• XDR_IP_blocked contains only private IP addresses.

For more information on creating and deploying filter rules, refer to the section Creating filter and NAT rules in the SMC administration guide.