Skip to main content

Palo Alto Networks Cortex XDR

Palo Alto Networks Cortex XDR is an extended detection and response platform that consolidates security telemetry, threat intelligence, and incident data across networks, endpoints, cloud workloads, and applications. As a comprehensive cybersecurity operations solution, Cortex XDR provides advanced threat detection, investigation, and response capabilities through behavioral analytics, machine learning, and integrated security data from multiple sources.

CategorySOAR
DirectionQuery source
Sign-inAPI Key
Query languagesSTIX, SQLite
Websitepaloaltonetworks.com

Before you start​

Huntbase signs in to Palo Alto Networks Cortex XDR with API Key. Create the credential in Palo Alto Networks Cortex XDR first, then keep it to hand for the Connect step.

  1. In Cortex XDR, go to Settings › Configurations › Integrations › API Keys and click New Key.
  2. Under Security Level, choose Standard or Advanced. Under Role, choose a read-only role such as Viewer.
  3. Click Generate and copy the key right away. You cannot view it again after you close the dialog.
  4. In the API Keys table, note the ID of the new key. This is the API Key ID.
  5. Click Copy API URL to copy your tenant's API address.
Watch out for
  • The key is shown only once, when you generate it.

For the vendor's own instructions, see Cortex XDR API key documentation.

tip

Use a dedicated, read-only credential for Huntbase where the product allows it. Huntbase only needs to read.

Connect Palo Alto Networks Cortex XDR​

  1. Go to Connections and click New connection, or click New connection on the Palo Alto Networks Cortex XDR product page.
  2. On Product, pick Palo Alto Networks Cortex XDR and choose the Owner.
  3. On Details, give the connection a Name and, optionally, a Description.
  4. On Connect, fill in the settings and credentials described below.
  5. On Verify, review the summary and click Create & check.

For everything else on the setup page — saving a draft, I'll do this later, and what each check result means — see Connections.

Settings​

Where your Palo Alto Networks Cortex XDR lives:

FieldRequiredNotes
Server AddressYesThe API URL from Copy API URL. It starts with api-.
Quota ThresholdNoQueries use your tenant's daily query quota. A Standard license includes 5 units, and you can buy 10 more. Queries fail once the quota is used up. Defaults to 5.
Base URLNo

Credentials​

The only Method is API Key. Enter a Credential label (for example Production), then fill in:

FieldRequiredNotes
Tenant FQDNNoTenant Id of Palo Alto Cortex XDR Application. When using a multi-tenant environment, this value is used to determine the tenant that will be used. Secret — not shown again after you save it.
API KeyYesThe API Key is a unique identifier required for authenticating API calls. Secret — not shown again after you save it.
API Key IDYesThe number in the ID column of the API Keys table, not the key itself. Secret — not shown again after you save it.

Query it​

Once connected, Palo Alto Networks Cortex XDR can serve these languages in a query tab, and Scout can use it when you ask in Auto:

LanguageUse it for
STIXSTIX patterns for indicator sweeps, translated into the product's native search.
SQLiteSQL across this source and every other connected source.

Next steps​