.png)
Palo Alto Networks Cortex XDR Integration Guide
Integrate Cortex XDR with enterprise systems through regional HTTPS REST APIs, API-key authentication, scheduled workflows, XQL queries, and carefully verified notification mechanisms.
Palo Alto Networks Cortex XDR integration options at a glance
Cortex XDR provides documented HTTPS REST APIs for incidents, alerts, endpoints, vulnerabilities, indicators, investigations, and selected response operations. Its XQL-related API operations support analytics queries, including workflows that may require polling or pagination. Collection and batch-style retrieval is available for relevant operations, while file and forensic capabilities are limited to selected APIs, permissions, and licensing. General-purpose webhooks or outbound callbacks for all alerts and object changes were not confirmed, so scheduled API polling is the safer default. Martini can authenticate with regional API hosts and permission-scoped API keys, orchestrate workflows, transform security data, apply routing rules, and expose controlled APIs for downstream consumers.
| Integration point | Supported by Palo Alto Networks Cortex XDR? | Common use cases | How Martini supports it |
|---|---|---|---|
| REST APIs | Yes | Retrieve and manage Cortex XDR Incidents, Alerts, Endpoints, Vulnerabilities, Indicators, investigation data, and other security operations data. | Martini can consume the regional HTTPS APIs, map responses, apply business rules, and expose a controlled API façade for downstream systems. |
| XQL analytics APIs | Yes | Run analytics queries against Cortex XDR datasets for detection summaries, endpoint activity reports, investigations, and compliance extracts. | Martini can invoke XQL-related API operations, poll asynchronous results where required, paginate result sets, and deliver transformed rows to target systems. |
| Bulk / asynchronous / batch APIs | Limited | Retrieve collections of Incidents, Alerts, Endpoints, or query results; some operations may return an operation identifier requiring polling. | Martini workflows can implement pagination, polling, bounded concurrency, timeouts, downstream batching, and terminal failure paths. |
| Authentication | Yes | Authenticate with an API key ID and token sent in the documented request headers, using a host that matches the Cortex XDR tenant region. | Martini stores the token in protected secrets or environment configuration and injects credentials into API requests without exposing them in mappings or logs. |
| File / attachment APIs | Limited | Selected endpoint and investigation operations may retrieve, quarantine, or handle forensic files and artifacts, subject to permissions and licensing. | Martini can orchestrate documented file operations, but the workflow must account for operation-specific response formats, size limits, and authorization. |
| Webhooks / outbound callbacks | Not confirmed | General-purpose notifications for all Cortex XDR Incidents, Alerts, or object changes were not confirmed; tenant-specific forwarding capabilities require verification. | If a supported HTTP notification is enabled, Martini can receive it through a webhook-oriented workflow; otherwise, scheduled REST polling remains the documented default. |
| Database / analytics access | Limited | Cortex XDR does not provide confirmed direct database or JDBC access; XQL is the documented product-level analytics mechanism. | Martini can call XQL APIs and write normalized results to an approved database or reporting destination, but should not connect directly to the Cortex XDR tenant database. |
| SDKs | Not confirmed | The documented integration surface is primarily HTTPS APIs; a general official SDK requirement was not confirmed. | Martini can call the REST APIs directly without requiring a vendor SDK and can encapsulate reusable request and mapping logic in workflows. |
How Palo Alto Networks Cortex XDR exposes data and business events
Cortex XDR REST APIs
Cortex XDR documents HTTPS REST APIs for security data and operations covering Incidents, Alerts, Endpoints, Vulnerabilities, Indicators, investigations, and related capabilities. API behavior, fields, permissions, and regional hosts vary by operation and tenant configuration.
Martini implementation pattern
Martini implementation pattern: a workflow calls the correct regional Cortex XDR API host with the API key ID and token, validates the response, maps provider objects to a canonical model, applies routing or enrichment rules, and writes the result to downstream systems. The workflow records checkpoints and separates transient failures from authorization and validation errors.
Implementation sequence
Cortex XDR XQL APIs
Cortex XDR exposes XQL-related API operations for querying security datasets. Queries may produce result collections directly or return an operation identifier that requires status checks and subsequent result retrieval.
Martini implementation pattern
Martini implementation pattern: a scheduled or API-triggered workflow submits a bounded XQL query, polls when the operation is asynchronous, retrieves pages or batches of results, transforms only approved columns, and publishes the output to a reporting store or downstream API.
Implementation sequence
Cortex XDR Collection and Batch Retrieval
Collection APIs and selected query operations support retrieval of multiple Cortex XDR objects. Exact pagination, filtering, asynchronous behavior, and limits are operation-specific and must follow the provider documentation.
Martini implementation pattern
Martini implementation pattern: a workflow uses controlled page sizes and concurrency, processes each page through mapping and business rules, stores a high-water mark, and retries only transient failures. Downstream writes use source identifiers to remain idempotent across replayed pages.
Implementation sequence
Cortex XDR File and Forensic Operations
Selected endpoint and investigation API areas may support file retrieval, quarantine, or forensic operations. These capabilities are not a universal attachment model and depend on permissions, endpoint availability, licensing, and the specific operation.
Martini implementation pattern
Martini implementation pattern: a workflow verifies that the requested operation is approved, calls the documented endpoint, handles metadata or download references according to the response, and applies size, retention, and sensitive-data controls before forwarding artifacts.
Implementation sequence
Cortex XDR Notification Mechanisms
General-purpose webhooks or outbound callbacks for all Cortex XDR Incidents, Alerts, and object changes were not confirmed. Any tenant-specific alert-forwarding capability should be verified against current product documentation and licensing.
Martini implementation pattern
Martini implementation pattern: if the customer has a supported HTTP notification mechanism, Martini exposes an authenticated receiving API or webhook workflow, validates the notification, retrieves the current Cortex XDR object when necessary, and processes it idempotently. If no supported notification exists, Martini uses scheduled REST polling instead.
Implementation sequence
Common Palo Alto Networks Cortex XDR integration patterns
Pattern 1: Synchronize Cortex XDR incidents to ServiceNow
When to use this pattern
Use this pattern when security operations needs service-management cases for newly created or modified Cortex XDR Incidents. Scheduled polling is the conservative default where general-purpose alert webhooks have not been confirmed.
Integration direction
Example Mapping
| Palo Alto Networks Cortex XDR Field | Canonical Field | Target Field |
|---|---|---|
| incident_id | sourceIncidentId | u_cortex_xdr_incident_id |
| severity | priority | priority |
| status | securityCaseStatus | state |
| description | investigationSummary | description |
Martini implementation pattern
A scheduler invokes the regional Cortex XDR incident API using a persisted time-window marker. Martini paginates results, allows a small overlap for late-arriving data, deduplicates by source identifier, maps status and severity, and creates or updates ServiceNow cases idempotently. Transient API and target failures are retried with backoff, while validation and authorization failures follow an error path.
Martini capabilities used
- workflows
- scheduled triggers
- API consumption
- data mapping
- business rules
- idempotency
- error handling
Pattern 2: Route and enrich Cortex XDR alerts
When to use this pattern
Use this pattern when different Alert types or severities require different response destinations, such as immediate escalation for critical detections and reporting-only treatment for low-severity events.
Integration direction
Example Mapping
| Palo Alto Networks Cortex XDR Field | Canonical Field | Target Field |
|---|---|---|
| alert_id | sourceAlertId | AlertId |
| severity | severity | Severity |
| endpoint_name | assetName | CompromisedEntity |
| indicator_value | indicator | Entities |
Martini implementation pattern
Martini retrieves Alert collections, optionally enriches them with related endpoint or indicator context, and applies severity, source, and processing-state rules. Critical Alerts are sent to the selected security platform, duplicates are routed to an audit path, and downstream writes include the source identifier so retries do not create duplicate events.
Martini capabilities used
- API consumption
- data mapping
- conditional routing
- enrichment
- deduplication
- retry handling
Pattern 3: Synchronize endpoints and vulnerabilities
When to use this pattern
Use this pattern when an asset or configuration-management process needs Cortex XDR endpoint status and selected vulnerability findings for posture, ownership, or remediation workflows.
Integration direction
Example Mapping
| Palo Alto Networks Cortex XDR Field | Canonical Field | Target Field |
|---|---|---|
| endpoint_id | sourceAssetId | correlation_id |
| hostname | hostName | name |
| operating_system | operatingSystem | os |
| last_seen | lastSeenAt | last_discovered |
Martini implementation pattern
A scheduled workflow retrieves paginated Endpoints and selected Vulnerabilities, normalizes host identifiers and timestamps, and separates active, inactive, and decommissioned assets. Martini applies field-presence rules for tenant-dependent attributes, updates existing target assets, batches writes, and retries transient page or target failures without replaying completed pages.
Martini capabilities used
- scheduled workflows
- pagination
- data transformation
- business rules
- batch processing
- checkpointing
- error handling
Pattern 4: Produce XQL-driven security reports
When to use this pattern
Use this pattern for periodic detection summaries, endpoint activity reports, investigation extracts, or compliance outputs that require Cortex XDR analytics rather than object-by-object retrieval.
Integration direction
Example Mapping
| Palo Alto Networks Cortex XDR Field | Canonical Field | Target Field |
|---|---|---|
| query_time | reportWindowStart | earliest |
| event_type | eventType | event_type |
| agent_hostname | endpointName | host |
| query_result_timestamp | eventTime | _time |
Martini implementation pattern
Martini submits a bounded XQL query with only required projections, polls when Cortex XDR returns an operation identifier, and retrieves result pages or batches within a timeout. The workflow transforms rows, removes unapproved sensitive fields, delivers the report to the target ingestion API, and records query status and checkpoint information.
Martini capabilities used
- API consumption
- workflow orchestration
- asynchronous polling
- mapping and transformation
- data minimization
- batch delivery
- monitoring
Applications commonly integrated with Palo Alto Networks Cortex XDR
Cortex XDR data can be routed to security operations, service management, analytics, and collaboration products. The exact transport and supported operations should be verified for each deployed product and Cortex XDR tenant; Martini can provide the orchestration, transformation, filtering, and error-handling layer between them.
| Application | Scenario | Direction | Martini Pattern |
|---|---|---|---|
| ServiceNow | Create or update security cases from Cortex XDR Incidents and Alerts, while synchronizing assignment, priority, and status where the target design supports it. | Palo Alto Networks Cortex XDR → Martini → ServiceNow | A scheduled or API-triggered workflow retrieves changed Incidents and Alerts, deduplicates by source identifier, maps severity and status to ServiceNow fields, and sends idempotent create or update requests with retry handling. |
| Splunk | Centralize Cortex XDR security events and investigation data for correlation, search, retention, and broader security reporting. | Palo Alto Networks Cortex XDR → Martini → Splunk | Martini polls the relevant Cortex XDR APIs or XQL operations, projects only approved fields, batches results, and delivers them through the selected Splunk ingestion interface while recording checkpoints and failures. |
| Microsoft Sentinel | Correlate Cortex XDR Incidents, Alerts, Indicators, and endpoint context with identity, cloud, and infrastructure signals. | Palo Alto Networks Cortex XDR → Martini → Microsoft Sentinel | A workflow retrieves incremental security data, normalizes timestamps and severity, applies data-minimization rules, and submits events through the approved Sentinel ingestion path with controlled retries. |
| Cortex XSOAR | Use Cortex XDR incidents, alerts, indicators, and endpoint context in investigation and response playbooks. | Palo Alto Networks Cortex XDR → Martini → Cortex XSOAR | Martini exposes a controlled API or scheduled workflow that retrieves selected Cortex XDR objects, maps them to XSOAR playbook inputs, and handles response results and authorization failures separately. |
| Jira | Create security or engineering issues from selected Cortex XDR Incidents and maintain downstream workflow status. | Palo Alto Networks Cortex XDR → Martini → Jira | Martini filters incidents by severity or classification, maps the incident identifier and investigation context to Jira fields, prevents duplicate issue creation, and optionally processes status updates. |
| Slack | Notify security teams about critical incidents, investigation milestones, and response outcomes. | Palo Alto Networks Cortex XDR → Martini → Slack | A Martini workflow polls or receives a separately verified notification, applies severity and deduplication rules, formats a minimal message with an investigation reference, and sends it to the approved Slack API. |
| Microsoft Teams | Deliver high-priority Cortex XDR notifications and investigation links to security operations channels. | Palo Alto Networks Cortex XDR → Martini → Microsoft Teams | Martini retrieves or receives eligible events, enriches them with selected endpoint and indicator context, applies routing rules, and calls Microsoft-supported messaging endpoints with retry and audit handling. |
How to build a Palo Alto Networks Cortex XDR integration in Martini
Objective
Configure the Cortex XDR regional API host and permission-scoped API credentials without embedding secrets in workflow logic.
Instructions in Martini
- Select the Cortex XDR tenant region and store the regional API host as environment configuration.
- Store the API key ID and token in protected Martini secrets.
- Confirm that the API key role can access the required Cortex XDR objects and operations.
- Use separate credentials for development, testing, and production where required.
Objective
Select a trigger that matches the confirmed Cortex XDR integration mechanism and required processing latency.
Instructions in Martini
- Use a scheduler for incremental Incidents, Alerts, Endpoints, Vulnerabilities, or XQL synchronization.
- Use an API or webhook-oriented workflow only when a tenant-specific HTTP notification capability has been verified.
- Define polling windows, overlap, and maximum execution duration.
Objective
Call the appropriate Cortex XDR REST or XQL operation and handle collection, pagination, and asynchronous behavior.
Instructions in Martini
- Call the documented regional REST endpoint with the required authentication headers.
- Process pagination fields according to the selected operation rather than assuming one response is complete.
- Poll operation identifiers when an XQL or other API operation is asynchronous.
- Apply bounded time windows and projections for large result sets.
Objective
Coordinate retrieval, enrichment, routing, downstream delivery, and checkpoint persistence in a maintainable Martini workflow.
Instructions in Martini
- Separate API retrieval, normalization, business rules, target delivery, and checkpoint updates into clear workflow stages.
- Keep Incident and Alert relationships explicit when choosing parent-child or flattened target models.
- Use reusable services or workflow logic for common authentication, pagination, and error handling.
Objective
Convert Cortex XDR objects and query rows into canonical and target-specific models while handling optional fields safely.
Instructions in Martini
- Map source identifiers, timestamps, severity, status, endpoint, user, and indicator context where available.
- Treat fields as optional when availability varies by endpoint, license, API version, or tenant configuration.
- Minimize sensitive fields before forwarding hostnames, usernames, command lines, paths, IP addresses, or investigation details.
Objective
Apply security, routing, deduplication, and idempotency decisions before writing to downstream systems.
Instructions in Martini
- Route critical Alerts to escalation paths and lower-severity data to reporting or audit paths.
- Use Cortex XDR object identifiers and source-system values to prevent duplicate target creation.
- Validate required fields and distinguish permanent validation failures from transient transport errors.
Common Palo Alto Networks Cortex XDR data objects used in integrations
| Object | Typical Use | Common target systems | Martini handling |
|---|---|---|---|
| Incidents | Represent groups of related security Alerts and investigation context for case synchronization and response routing. | ServiceNow, Cortex XSOAR, Microsoft Sentinel, Jira | Martini retrieves changed Incidents, maps identifiers, status, severity, timestamps, and context, then applies idempotency and incremental synchronization rules. |
| Alerts | Represent detection events with metadata, severity, status, source, and relationships to security investigations. | Splunk, Microsoft Sentinel, ServiceNow, Slack, Microsoft Teams | Martini filters and enriches Alerts, maps severity and endpoint context, routes them by business rule, and avoids duplicate downstream notifications. |
| Endpoints | Represent protected hosts, including identity, status, operating-system details, agent information, and last-seen context. | ServiceNow, asset-management platforms, Cortex XSOAR, reporting stores | Martini retrieves endpoint collections with pagination, normalizes host identifiers and status, and synchronizes active or inactive endpoint state. |
| Vulnerabilities | Represent vulnerability findings associated with endpoints or other assets for posture and remediation workflows. | ServiceNow, Jira, Microsoft Sentinel, security data stores | Martini selects approved vulnerability fields, joins findings with endpoint context where available, and routes prioritized remediation data. |
| Indicators | Represent investigation and detection indicators such as file hashes, IP addresses, domains, and URLs. | Cortex XSOAR, Splunk, Microsoft Sentinel, case-management systems | Martini validates indicator types, applies data-minimization and routing rules, and preserves source identifiers and provenance. |
| XQL queries and query results | Represent analytics requests and returned rows for detection summaries, investigations, endpoint activity, and compliance reporting. | Reporting stores, Splunk, data warehouses, internal APIs | Martini submits bounded queries, handles asynchronous operation identifiers and pagination where required, transforms rows, and records query checkpoints. |
Authentication and security considerations
API-key authentication
Cortex XDR documents API-key authentication using an API key ID and token in request headers. The API host is regional, so the tenant-specific host must be configured as an environment value.
Credential protection
- Store the API key token in Martini secrets or protected environment configuration.
- Do not place credentials in mappings, source code, or workflow logs.
- Use separate keys for development, testing, and production when required.
- Rotate keys according to organizational policy.
Least privilege and sensitive data
API keys are permission-scoped. Grant only the operations required by each workflow and protect Cortex XDR data that may contain usernames, hostnames, command lines, file paths, IP addresses, URLs, and investigation details.
Operational considerations for Palo Alto Networks Cortex XDR integrations
Regional hosts and permissions
Use the correct Cortex XDR regional API host and verify that the API key can access each required object and operation. License, tenant configuration, API version, and endpoint selection can affect available fields and actions.
Pagination and incremental synchronization
Collection APIs may return bounded result sets. Use operation-specific pagination, persisted high-water marks, overlap for late-arriving data, and deduplication by source object identifier.
Retries and asynchronous operations
Use controlled concurrency, exponential backoff, maximum attempts, and timeouts. When an operation identifier is returned, poll until completion or terminal failure and define a path for partial results.
Schema and data controls
Treat optional fields defensively, especially for endpoint, user, process, and indicator context. Minimize sensitive data before delivery and test mappings against representative Incidents, Alerts, Endpoints, Vulnerabilities, and XQL results.
Why use Martini instead of scripts or point-to-point integrations?
Orchestration instead of isolated scripts
Martini provides a maintainable workflow layer around Cortex XDR API calls, with scheduling, API exposure, transformations, conditional routing, reusable logic, and controlled downstream delivery.
Reliable synchronization
Checkpointing, pagination, idempotency, retry handling, asynchronous polling, and clear failure paths are easier to standardize than in a collection of one-off scripts.
Controlled integration surface
Martini can expose a controlled API façade over Cortex XDR operations, enforce validation and business rules, and keep regional hosts and API credentials in environment-specific configuration.
Frequently asked questions
Cortex XDR can be integrated through its documented regional HTTPS REST APIs using API-key authentication. These APIs cover Incidents, Alerts, Endpoints, Vulnerabilities, Indicators, investigations, selected file or response operations, and XQL-related analytics. Scheduled polling is the safest general pattern because universal webhooks for all object changes were not confirmed.
Yes. Martini can consume the Cortex XDR REST APIs, call XQL-related operations, schedule incremental synchronization, handle pagination and asynchronous polling, transform security data, and expose controlled APIs for downstream consumers. A tenant-specific notification can also be received if that capability is separately verified and enabled.
No dedicated Cortex XDR connector is required. Martini can integrate using the confirmed Cortex XDR REST APIs, API-key authentication, XQL API operations, and any separately verified notification or file operations through standards-based workflows.
Lonti does not charge an additional per-connector or per-vendor fee to integrate Cortex XDR. The integration is subject to the provisioned capacity of the Martini environment. Separate costs may apply from Palo Alto Networks, cloud infrastructure, or other third-party systems based on subscription, usage, and deployment model.
Use the documented regional REST APIs as the primary integration method and use XQL-related API operations for analytics and reporting. Collection and asynchronous behavior is operation-specific. GraphQL and SOAP APIs were not confirmed, and direct database access should not be assumed.
General-purpose webhooks or outbound callbacks for all Cortex XDR Incidents, Alerts, and object changes were not confirmed. If a supported tenant-specific HTTP notification or alert-forwarding capability is enabled, Martini can receive and process it; otherwise, scheduled REST polling is the recommended documented approach.
A Martini workflow can retrieve data incrementally using supported filters or time windows, paginate through results, persist a high-water mark, and deduplicate by the Cortex XDR object identifier. Mapping and transformation can normalize severity, status, timestamps, endpoint context, indicators, and target-specific fields while applying data-minimization rules.
Martini can distinguish authentication, authorization, validation, rate-limit, transient network, asynchronous-operation, and permanent endpoint failures. Retryable failures should use bounded exponential backoff, while downstream writes should use source identifiers for idempotency. Pagination, controlled concurrency, timeouts, and checkpointing help manage large collections and tenant-specific limits.
Related Martini documentation
APIs
Data and Security
Connect Palo Alto Networks Cortex XDR with Martini
Use Martini to build reliable Cortex XDR integrations that synchronize security data, apply routing and data-protection rules, and expose reusable enterprise APIs and workflows.