Palo Alto Cortex Xsiam
Introduction
This guide tells you how to authenticate the Cortex XSIAM connector in Swimlane using API Key Authentication.
You will generate an API Key, collect the required identifiers, and configure the connector in Swimlane.
Prerequisites
Cortex XSIAM Access Requirements
You must have permissions to:
- Access the Cortex XSIAM console.
- Create and manage API Keys.
- Access the Cortex XSIAM Public API.
- View incidents and alerts.
- Manage API integrations.
Required Credentials
During setup, you will collect:
- API URL
- API Key
- API Key ID
Cortex XSIAM Setup
Take the following steps to generate an API Key:
- Log in to your Cortex XSIAM tenant.
- Navigate to Settings > Configurations > Integrations > API Keys.
- Click + New API Key.
- Enter a descriptive name for the key.
- Select the appropriate role or permissions required for the integration.
- (Optional) Configure an expiration date for the API key.
- Click Generate.
- Copy and securely save the API Key.
This saved value is your Authorization value in Swimlane.
Take the following steps to collect the API Key ID:
- Navigate to Settings > Configurations > Integrations > API Keys.
- Locate the API key you created.
- Copy the API Key ID.
This value is your x-xdr-auth-id in Swimlane.
Take the following steps to collect the API URL:
- Log in to your Cortex XSIAM tenant.
- Copy your tenant URL from the browser.
Example:
https://api-<tenant>.xdr.<region>.paloaltonetworks.com
Use your tenant URL as the url value in Swimlane.
Connector Configuration in Swimlane
- Log in to Turbine.
- From the left-hand navigation pane, click ORCHESTRATION and click Assets.
- Asset homepage opens.
- Click the plus icon to open the Configure your Connector Asset window.
- Select Cortex XSIAM from the Asset type list.
- Fill in the Asset Settings and Asset Input as shown:
Field | Description | Required/Optional |
|---|---|---|
url | Cortex XSIAM Tenant API URL | Required |
Authorization | API Key generated in Cortex XSIAM | Required |
x-xdr-auth-id | API Key ID | Required |
verify_ssl | Enable/Disable SSL Verification | Optional |
http_proxy | Optional proxy configuration | Optional |
- Fields with * marks are required.
- Click Create.
Troubleshooting
Authentication Failed (401 Unauthorized)
Verify that:
- The API Key is valid.
- The API Key has not expired.
- The API Key ID matches the API Key.
- The tenant URL is correct.
Permission Denied (403 Forbidden)
Verify that:
- The API key has sufficient permissions.
- Your role allows access to Cortex XSIAM APIs.
- API access is enabled for your tenant.
SSL Errors
If SSL verification fails:
- Verify that your Cortex XSIAM endpoint uses a trusted SSL certificate.
- Confirm that any proxy or firewall is not interfering with SSL traffic.
- Disable verify_ssl only for testing if permitted by your organization's security policy.
Result
You have successfully authenticated the Cortex XSIAM connector in Swimlane.
Sources
- Cortex XSIAM REST API Documentation https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-APIο»Ώ
- Cortex XSIAM API Authentication Documentation https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-API/Get-Started-with-Cortex-XSIAM-APIsο»Ώ
- Cortex XSIAM API Keys Documentation https://docs-cortex.paloaltonetworks.com/r/Cortex-XSIAM/Cortex-XSIAM-Administrator-Guide/API-Keysο»Ώ