--- title: Palo Alto Networks Cortex XSOAR slug: connectors/palo-alto-networks-cortex-xsoar docTags: createdAt: 2026-06-09T16:29:48.099Z --- Palo Alto Networks Cortex XSOAR is a SOAR platform that automates and orchestrates security operations. Palo Alto Networks Cortex XSOAR is a comprehensive security orchestration, automation, and response (SOAR) platform that empowers security teams to manage incidents efficiently. This connector allows Swimlane Turbine users to automate incident creation, updates, and searches within Cortex XSOAR, enhancing incident response capabilities. By integrating with Cortex XSOAR, Swimlane Turbine end-users can streamline their security operations, reduce manual tasks, and improve response times through automated workflows and comprehensive incident management. ## Prerequisites Before you can use the Palo Alto Networks Cortex XSOAR connector for Turbine, you'll need access to the Cortex XSOAR API. This requires the following: - Cortex Custom Authentication using the following parameters: - FQDN: Fully Qualified Domain Name of your Cortex XSOAR instance. - API Key: A unique key used to authenticate API requests. - API Key ID: Identifier associated with the API Key for authentication purposes. ## Capabilities This connector provides the following capabilities: - Create or Update Incident - Search Incidents ## Notes ### Get your Cortex XSOAR API Key: - In Cortex XSOAR, navigate to **Settings & Info > Settings > Integrations > API Keys**. - Select + **New Key**. - Choose the type of API Key you want to generate based on your desired security level: **Advanced or Standard**. The Advanced API key hashes the key using a nonce, a random string, and a timestamp to prevent replay attacks. cURL does not support this but is suitable with scripts. Use the example script to create the advanced API authentication token. - If you want to define a time limit on the API key authentication, mark **Enable Expiration Date** and select the expiration date and time. Navigate to **Settings & Info > Settings > Integrations > API Keys** to track the Expiration Time field for each API key. In addition, Cortex XSOAR displays an API Key Expiration notification in the Notification Center one week and one day prior to the defined expiration date. - Provide a comment that describes the purpose for the API key, if desired. - Select the desired level of access for this key. You can select from the list of existing **Roles**, or you can select **Custom** to set the permissions on a more granular level. Roles are available according what was defined in the Cortex Gateway as described in [Manage Roles](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Administrator-Guide/Manage-Roles) in the Cortex XSOAR 8 Administrator’s Guide. - Save the API Key. - Copy the API key, and then click Done. This value represents your unique **API Key** in asset. ### Get your Cortex XSOAR API Key ID: - In the API Keys table, locate the **ID** field. - Note your corresponding **ID** number. This value represents the **API Key ID** in asset. ### Get your FQDN: - Select your API key and click **Copy URL**. ## Documentation - [Cortex XSOAR 8 API Documentation](https://cortex-panw.stoplight.io/docs/cortex-xsoar-8/m0qlgh9inh4vk-create-or-update-an-incident) ## Additional Documentation - [Palo Alto Networks Cortex XSOAR Connector Documentation](https://docs.swimlane.com/connectors/palo-alto-networks-cortex-xsoar) - [Palo Alto Networks Cortex XSOAR API Documentation](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR/8/Cortex-XSOAR-Administrator-Guide/Manage-Roles) - [Palo Alto Networks Cortex XSOAR Authentication Guide](https://docs.swimlane.com/authentication-guides/palo-alto-networks-cortex-xsoar) # Configurations ## Palo Alto Cortex XSOAR Authentication Palo Alto Cortex XSOAR authenticates using API Key and API Key ID. ### Configuration Parameters | **Parameter** | **Description** | **Type** | **Required** | | ------------- | ---------------------------------------------------------------------- | -------- | ------------ | | fqdn | The FQDN is a unique host and domain name associated with each tenant. | string | Required | | api\_key | The API Key is your unique identifier. | string | Required | | api\_key\_id | The API Key ID is your unique token used to authenticate the API Key. | string | Required | | verify\_ssl | Verify SSL certificate | boolean | Optional | | http\_proxy | A proxy to route requests through. | string | Optional | # Actions ## Create or Update Incident Create or update an incident in Palo Alto Networks Cortex XSOAR using specified JSON body details. ### Endpoint - **URL:** `incident` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | --------------------- | -------- | ------------ | ----------------------------------------------------------------------------- | | `closeNotes` | string | Optional | Notes for closing the incident. | | `closeReason` | string | Optional | The reason for closing the incident (select from existing predefined values). | | `closed` | string | Optional | When was this closed. | | `createInvestigation` | boolean | Optional | Parameter for Create or Update Incident | | `details` | string | Optional | The details of the incident - reason, etc. | | `labels` | array | Optional | Labels related to incident - each label is composed of a type and value. | | `labels.type` | string | Optional | Type of the resource | | `labels.value` | string | Optional | Value for the parameter | | `modified` | string | Optional | Parameter for Create or Update Incident | | `name` | string | Optional | Incident Name - given by user. | | `playbookId` | string | Optional | The associated playbook for this incident. | | `rawJSON` | string | Optional | Parameter for Create or Update Incident | | `reason` | string | Optional | The reason an incident was closed. | | `severity` | number | Optional | Severity is the incident severity has to be >= 0 and \<= 4. | | `sla` | number | Optional | SLAState is the incident SLA at closure time, in minutes. | | `status` | number | Optional | IncidentStatus is the status of the incident has to be >= 0 and \<= 2. | | `type` | string | Optional | Incident type. | ### Input Example `{"json_body":{"closeNotes":"string","closeReason":"string","closed":"2019-08-24T14:15:22Z","createInvestigation":true,"details":"string","labels":[{"type":"string","value":"string"}],"modified":"2019-08-24T14:15:22Z","name":"string","playbookId":"string","rawJSON":"string","reason":"string","severity":2,"sla":0,"status":2,"type":"Unclassified"}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------ | -------- | ------------------------------------ | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `ShardID` | number | Unique identifier | | `account` | string | Count value | | `activated` | string | Output field: activated | | `activatingingUserId` | string | Unique identifier | | `allRead` | boolean | Output field: allRead | | `allReadWrite` | boolean | Output field: allReadWrite | | `attachment` | array | Output field: attachment | | `attachment.file_name` | string | Name of the resource | | `attachment.file` | string | Output field: attachment.file | | `autime` | number | Time value | | `cacheVersn` | number | Output field: cacheVersn | | `canvases` | array | Output field: canvases | | `category` | string | Output field: category | | `changeStatus` | string | Status value | | `closeNotes` | string | Output field: closeNotes | | `closeReason` | string | Response reason phrase | | `closed` | string | Output field: closed | | `closingUserId` | string | Unique identifier | | `created` | string | Output field: created | | `dbotCreatedBy` | string | Output field: dbotCreatedBy | | `dbotCurrentDirtyFields` | array | Output field: dbotCurrentDirtyFields | | `dbotDirtyFields` | array | Output field: dbotDirtyFields | | `dbotMirrorDirection` | string | Output field: dbotMirrorDirection | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"ShardID":-9007199254740991,"account":"string","activated":"2019-08-24T14:15:22Z","activatingingUserId":"string","allRead":true,"allReadWrite":true,"attachment":[],"autime":-9007199254740991,"cacheVersn":-9007199254740991,"canvases":["string"],"category":"string","changeStatus":"string","closeNotes":"string","closeReason":"string","closed":"2019-08-24T14:15:22Z"}}` ## Search Incidents Perform a comprehensive search for incidents in Palo Alto Networks Cortex XSOAR, with support for filtering by multiple criteria. Requires JSON body input. ### Endpoint - **URL:** `incidents/search` - **Method:** `POST` ### Input | **Argument Name** | **Type** | **Required** | **Description** | | ------------------------- | -------- | ------------ | ------------------------------------------------------------------------------------------------------------------ | | `filter` | object | Optional | Parameter for Search Incidents | | `filter.andOp` | boolean | Optional | Parameter for Search Incidents | | `filter.category` | array | Optional | Parameter for Search Incidents | | `filter.details` | string | Optional | Parameter for Search Incidents | | `filter.fields` | array | Optional | Parameter for Search Incidents | | `filter.files` | array | Optional | Parameter for Search Incidents | | `filter.fromDate` | string | Optional | Date value | | `filter.id` | array | Optional | Unique identifier | | `filter.investigation` | array | Optional | Parameter for Search Incidents | | `filter.level` | array | Optional | Parameter for Search Incidents | | `filter.name` | array | Optional | Name of the resource | | `filter.notInvestigation` | array | Optional | Parameter for Search Incidents | | `filter.page` | number | Optional | Parameter for Search Incidents | | `filter.period` | object | Optional | Period holds the 'Period' query, such as last 3 days, last 6 hours, between 6 days from now until 3 days from now. | | `filter.period.by` | string | Optional | Parameter for Search Incidents | | `filter.period.byFrom` | string | Optional | Parameter for Search Incidents | | `filter.period.byTo` | string | Optional | Parameter for Search Incidents | | `filter.period.field` | string | Optional | Parameter for Search Incidents | | `filter.period.fromValue` | string | Optional | Value for the parameter | | `filter.period.toValue` | string | Optional | Value for the parameter | | `filter.query` | string | Optional | Parameter for Search Incidents | | `filter.reason` | array | Optional | Response reason phrase | | `filter.size` | number | Optional | Parameter for Search Incidents | | `filter.sort` | array | Optional | Parameter for Search Incidents | | `filter.sort.asc` | boolean | Optional | Parameter for Search Incidents | ### Input Example `{"json_body":{"filter":{"andOp":true,"category":["string"],"details":"string","fields":["string"],"files":["string"],"fromDate":"2019-08-24T14:15:22Z","id":["string"],"investigation":["string"],"level":[2],"name":["string"],"notInvestigation":["string"],"page":0,"period":{"by":"string","byFrom":"string","byTo":"string","field":"string","fromValue":"string","toValue":"string"},"query":"string","reason":["string"],"size":25,"sort":[{"asc":true,"field":"string","fieldType":"string"}],"status":[2],"timeFrame":0,"toDate":"2019-08-24T14:15:22Z","type":["string"],"urls":["string"]}}}` ### Output | **Parameter** | **Type** | **Description** | | ------------------------------- | -------- | -------------------------------- | | `status_code` | number | HTTP status code of the response | | `reason` | string | Response reason phrase | | `data` | array | Response data | | `data.account` | string | Response data | | `data.activated` | string | Response data | | `data.activatingingUserId` | string | Response data | | `data.allRead` | boolean | Response data | | `data.allReadWrite` | boolean | Response data | | `data.attachment` | array | Response data | | `data.attachment.description` | string | Response data | | `data.attachment.isTempPath` | boolean | Response data | | `data.attachment.name` | string | Response data | | `data.attachment.path` | string | Response data | | `data.attachment.showMediaFile` | boolean | Response data | | `data.attachment.type` | string | Response data | | `data.autime` | number | Response data | | `data.cacheVersn` | number | Response data | | `data.canvases` | array | Response data | | `data.category` | string | Response data | | `data.closeNotes` | string | Response data | | `data.closeReason` | string | Response data | | `data.closed` | string | Response data | | `data.closingUserId` | string | Response data | | `data.created` | string | Response data | | `data.dbotCreatedBy` | string | Response data | ### Output Example `{"status_code":200,"response_headers":{},"reason":"OK","json_body":{"data":[{}],"total":0}}` # Response Headers | **Header** | **Description** | **Example** | | ------------ | ----------------------------------------------------- | ----------------------------- | | Content-Type | The media type of the resource | application/json | | Date | The date and time at which the message was originated | Thu, 01 Jan 2024 00:00:00 GMT |