Palo Alto Networks integrations

Cortex AgentiX supports data ingestion and orchestration from other Palo Alto Networks products. These integrations are provided through a combination of traditional data sources and unified connectors, ensuring comprehensive visibility and seamless cross-platform security operations.

Notice

Data collection may require an add-on.

Ingestion methods

Depending on the specific product and your tenant onboarding date, integrations are handled via the following methods:

• Connectors: The strategic, unified approach for integrating Palo Alto Networks services. A connector consolidates multiple security capabilities, such as Automation, Data Security, and Identity Posture, into a single, guided configuration flow.

  • Availability: These connectors are available for tenants onboarded after July 26, 2026.
  • Legacy support: Existing tenants (onboarded prior to July 26, 2026) can achieve similar functionality by using the standalone Marketplace integrations linked within each product topic. For more information, see Marketplace.
• Standard data sources: Cortex AgentiX supports streaming data directly from different Palo Alto Networks products.

Technical reference requirements for connectors

While the unified wizard handles the configuration for new connectors, you should refer to the Cortex Developer Docs for Marketplace (PAN DEV) site for specific technical information related to the integration (now referred to as a sub-capability in the new connector world), such as:

• Fetched Incidents Data
• Available Commands
• Required incident fields and data schemas not provided in the wizard.

Note

For many popular vendors, you can choose between distinct types of data sources to fit your needs. Check the available descriptions for each entry in the user interface and documentation to decide which option is most suitable.

General requirements

Ensure you meet the following requirements before configuring your integrations:

• Deploy the relevant Palo Alto Networks products, such as NGFW or Prisma Access.
• Hold Super User permissions for your Customer Support Portal (CSP) account.
• After your tenant has been activated, navigate to the Data Sources & Integrations page in Cortex AgentiX to configure your integrations.
• All devices and accounts allocated to your CSP accounts are available to integrate.

Supported integrations

Cortex AgentiX provides specific documentation and configuration steps for each Palo Alto Networks integration. Select an integration from the topics provided below to view its supported ingestion methods and configuration requirements.