What are Cortex AgentiX data sources and connectors?

Learn more about Cortex AgentiX Data Sources and connectors with a unified approach to integrations.

Data sources and connectors are the foundational mechanisms used to ingest security and operational data, including logs, events, and asset metadata, into Cortex AgentiX for analysis, correlation, and response. By consolidating data from diverse origins like cloud environments and SaaS platforms, Cortex AgentiX constructs a comprehensive and contextualized "security story" used to identify threats and prioritize risk.

Customer availability by tenant type

The ingestion methods and configuration options available to you in the UI depend on your tenant onboarding date:

• New tenants (onboarded after July 26, 2026): You will primarily interact with the strategic Connector experience. Standalone Marketplace integrations managed by Palo Alto Networks that have been consolidated into connectors are hidden from the catalog to ensure a unified configuration flow. Partner and community-contributed integrations remain available as standalone packs.
• Existing tenants (onboarded before July 26, 2026): You will continue to see both standalone Marketplace integrations and unified Connectors. Refer to the specific documentation for each vendor to determine the supported configuration method for your account.

Clarifying terminology: Data sources and connectors

In the Cortex AgentiX user interface (UI), configuring ingestion involves different areas and terminologies depending on the type of connection and your tenant onboarding date. While Cortex AgentiX is introducing connectors as a new, unified approach to ingestion, traditional data source methods remain supported.

In the current intermediate state, it is important to understand how these terms relate to each other:

• Data sources: Represents the traditional method for any integration that provides data to Cortex AgentiX. In this documentation, Data Source is used as the category for these traditional ingestion methods, which include:

  • Data collectors: Built-in tools primarily focused on raw log ingestion. This includes core ingestion functionalities found using the Data Source Onboarder.
  • Marketplace (integrations): Content packs that include collection integrations. These are often referred to as data sources in the UI, as integrations that fetch data are configured through the Data Source Onboarder on the Data Sources & Integrations page.

    Note

    This implementation is primarily available to existing customers; new customers (onboarded after July 26, 2026) will use the new Connectors framework for Palo Alto Networks managed integrations (see Customer availability by tenant type above). Partner and community-contributed integrations remain available via the Marketplace.
• Connectors: The new, unified mechanism for data ingestion. For supported vendors, a Connector groups multiple security capabilities, such as logs and automation, into a single, uniquely named entry with a guided configuration wizard.

While specific components like Data Collectors and Connectors are named explicitly when discussing their unique configuration workflows, they all fall under the foundational goal of ingesting data into Cortex AgentiX.

Why are different data sources and connectors necessary?

Cortex AgentiX enables you to collect data across a vast and varied enterprise landscape. This necessitates distinct data source types and connectors designed for different environments and needs:

• Connectors: Streamline the onboarding of third-party SaaS services by grouping identity and data security capabilities into a single entry with a guided wizard. This unified approach represents the strategic method for all new vendor integrations.
• Standard data collectors (API/Built-in): These are built-in functionalities primarily focused on ingesting raw logs and security events for core security analysis, parsing, and normalization.
• Marketplace content packs: These packages offer specialized security functionality by bundling both a collection integration (for data ingestion) and automation components, such as playbooks and correlation rules.

  Note

  Standalone Marketplace integrations managed by Palo Alto Networks are primarily used by existing customers (onboarded before July 26, 2026). New customers will find these integrations consolidated within the new Connector framework, while partner and community integrations continue to be available as standalone Marketplace content packs.
• Palo Alto Networks Integrations: Cortex AgentiX provides both standard data sources and new unified connectors for Palo Alto Networks products to ensure deep telemetry ingestion and seamless cross-platform orchestration.

Current UI and future direction

Cortex AgentiX is transitioning toward a unified ingestion experience. While different ingestion methods currently involve distinct workflows, the following table summarizes where to manage them:

Ingestion Method	Primary UI Location(s) for Configuration	Key Components
Connectors	Data Sources & Integrations page (Settings → Data Sources & Integrations → + Add New)	Unified wizard for multi-capability vendor integrations.
Standard data collectors	Data Sources & Integrations page (Settings → Data Sources & Integrations → + Add New)	Built-in functionalities primarily focused on ingesting raw logs and security events.
Marketplace content packs	Data Sources & Integrations page (Settings → Data Sources & Integrations via Data Source Onboarder, for packs with data ingestion or after a Marketplace install)	Discovery and installation of integration-specific content packs. Note For new tenants from July 26, 2026, services consolidated into connectors are managed via the Data Sources & Integrations page.