Palo Alto Networks Cortex XDR
Introduction
This guide explains how to authenticate the Palo Alto Networks Cortex XDR connector in Swimlane using Cortex API Token authentication. You will generate Cortex XDR API credentials, collect the required identifiers, and configure the connector inside Swimlane Turbine.
Prerequisites
Cortex XDR Access Requirements
You must have administrative access to the Palo Alto Networks Cortex XDR tenant to:
- Generate API keys
- View tenant base URL
- Access Cortex XDR API settings
Required Credentials
During setup, you will collect:
- Cortex XDR Base URL
- API Token
- Cortex XDR API Key ID
Authentication Overview
Cortex XDR uses token-based authentication with a custom HTTP header. Authentication requires:
- API Token
- API Key ID (x-xdr-auth-id header)
Cortex XDR Setup
Take the following steps to generate the Cortex XDR API credentials:
- Log in to the Palo Alto Networks Cortex XDR Console.
- Navigate to Settings > Configurations > Integrations > API Keys.
- Click Generate API Key.
- Enter a name for the API key.
- Copy and securely store the API Key ID and API Token.
The API Token is shown only once. Copy and save it for further usage.
Connector Configuration in Swimlane
- Log in to Turbine.
- From the left-hand navigation pane, click ORCHESTRATION and click Assets. Asset homepage opens.
- Click the plus icon to open the Configure your Connector Asset window.
- Select Palo Alto Networks Cortex XDR from the Asset type list.
- Fill in the Asset Settings and Asset Input as shown:
Configuration β Cortex XDR Authentication
Authenticates using Cortex XDR API Token and API Key ID.
Field | Description | Required |
|---|---|---|
url | Cortex XDR API base URL | Required |
token | API Token | Required |
x-xdr-auth-id | API Key ID | Required |
verify_ssl | Verify SSL certificate | Optional |
http_proxy | Proxy configuration | Optional |
Troubleshooting
401 Unauthorized:
- Invalid or expired API Token
- Incorrect API Key ID
403 Forbidden:
- Insufficient API permissions
Connection Errors:
- Incorrect base URL
- SSL or proxy issues
You have successfully authenticated the Palo Alto Networks Cortex XDR connector in Swimlane.