> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources/administration-and-troubleshooting/integrations/forward-requests-to-long-running-integrations.md). # Forward requests to long-running integrations Some long-running integrations provide internal data via API calls to your third-party software, such as a firewall. You can set up Cortex AgentiX to allow third-party software to access long-running integrations installed either on the Cortex AgentiX tenant or on an engine. Long-running integrations provide internal data via API calls such as: | Integration | Description | See More | | --------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------- | | O365 Teams (Using Graph API) | Get authorized access to a user's Teams app in a personal or organizational account. | [O365 Teams (Using Graph API)](https://xsoar.pan.dev/docs/reference/integrations/microsoft-graph-teams) | | Generic Webhook | Creates cases on event triggers. The trigger can be any query posted to the integration. | [Generic Webhook](https://xsoar.pan.dev/docs/reference/integrations/generic-webhook) | | Generic Export Indicators Service |

Use the Generic Export Indicators Service integration to provide an endpoint with a list of indicators as a service for the system indicators.

Note

For more information about how to set up the integration, see Manage external dynamic lists.

| [Generic Export Indicators](/cortex-agentix/detect-investigate-and-respond-to-threats/threat-intel-management/indicator-configuration/export-indicators.md) | | Microsoft Teams | Send messages and notifications to team members. | [Microsoft Teams](https://xsoar.pan.dev/docs/reference/integrations/microsoft-teams) | | TAXII Server | Provides TAXII Services for system indicators (Outbound feed). | [TAXII Server](https://xsoar.pan.dev/docs/reference/integrations/taxii-server) | | TAXII2 Server | Provides TAXII2 Services for system indicators (outbound feed). You can choose to use TAXII v2.0 or TAXII v2.1. | [TAXII2 Server](https://xsoar.pan.dev/docs/reference/integrations/taxii2-server) | | PingCastle | Listens for PingCastle XML reports. | [PingCastle](https://xsoar.pan.dev/docs/reference/integrations/ping-castle) | | Publish List | Publishes Cortex AgentiX lists for external consumption. | [Publish List](https://cortex.marketplace.pan.dev/marketplace/details/PublishList/) | | Simple API Proxy | Provides a simple API proxy to restrict privileges or minimize the number of credentials issued at the API. | [Simple API Proxy](https://cortex.marketplace.pan.dev/marketplace/details/SimpleAPIProxy/) | | Syslog v2 | Opens cases automatically from Syslog clients. | [Syslog v2](https://xsoar.pan.dev/docs/reference/integrations/syslog-v2) | | Web File Repository | Make your environment ready for testing purposes for your playbooks or automations to download files from a web server. | [Web File Repository](https://xsoar.pan.dev/docs/reference/integrations/web-file-repository#context-output) | {% hint style="info" %} ### Note * When running on the tenant, you can only use long-running integrations provided by Cortex AgentiX, you cannot create custom ones. Custom long-running integrations are supported only on engines at this time. * Configuring custom certificates or private API Keys in the long-running integration instance is supported only on engines, not on the Cortex AgentiX tenant. * If you have configured a range of **Approved IP Ranges** under **Allowed Sessions** on the **Security Settings** page, any incoming communication must be from approved IP addresses. {% endhint %}
Credentials For long-running integrations running on a tenant, you must set a username and password. For long-running integrations running on an engine, we strongly recommend setting a username and password, but it is not required. Users with sufficient permissions can set the username and password for specific integration instances on the **Data Sources & Integrations** page.
Define a listening port for long-running integrations When configuring a long-running integration instance, you may need to define a listening port. * **Integration instance running directly on a tenant** If the long-running integration runs on the Cortex AgentiX tenant, you do not need to enter a **Listen Port** in the instance settings. The system auto-selects an unused port for the long-running integration when the instance is saved. * **Integration instance running on a custom engine** You must set the **Listen Port** for access when configuring a long-running integration instance on an engine. Use a unique port for each long-running integration instance. Do not use the same port for multiple instances.
Test the long-running integration connection * **Integration instance running directly on a tenant** You can use CURL commands from any terminal to access and test the long-running integration. The string `xdr` in the URL must be replaced by `crtx` and the data URL must always be prefixed by `ext-`.

Note

For the TAXII Server and TAXII2 Server integrations, the xdr string is automatically replaced by crtx. For the Microsoft Teams integration, you can use the microsoft-teams-create-messaging-endpoint command to get the correct messaging endpoint based on the server URL, the server version, and the instance configurations. For more information, see Microsoft Teams.

Example: **Tenant URL**: **Request URL**: **CURL**: curl -v -u user:pass * **Integration instance running on a custom engine** You can use CURL commands from any terminal to access and test the long-running integration at the engine URL: `http://:/` For example, `curl -v -u user:pass http://:/?n=50` Curl request parameters for external dynamic lists The following list of curl request parameters applies when using the **Generic Export Indicators Service** integration for external dynamic lists. | Argument | Description | Example | | -------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------- | | **`n`** | The maximum number of entries in the output. If no value is provided, will use the value specified in the **List Size** parameter in the integration instance settings. | **`https://ext-/instance/execute/?n=50`** | | **`s`** | The starting entry index from which to export the indicators. | **`https://ext-/instance/execute/?s=10&n=50`** | | **`v`** | The output format. Supports PAN-OS (text), CSV, JSON, mwg, and proxysg (alias: bluecoat). | **`https://ext-/instance/execute/?v=json`** | | **`q`** | The query is used to retrieve indicators from the system. | **`https://ext-/instance/execute/?q="type:ip and sourceBrand:my_source"`** | | **`t`** | Only with mwg format. The type is indicated at the top of the exported list. Supports: string, applcontrol, dimension, category, ip, mediatype, number, and regex. | **`https://ext-/instance/execute/?v=mwg&t=ip`** | | **`sp`** | If set, will strip ports off URLs; otherwise, will ignore URLs with ports. | **`https://ext-/instance/execute/?v=text&sp`** | | **`di`** | Only with PAN-OS (text) format. If set, will ignore URLs that are not compliant with PAN-OS URL format instead of being rewritten. | **`https://ext-/instance/execute/?v=text&di`** | | **`cr`** | If set, will strip protocols off URLs. | **`https://ext-/instance/execute/?v=text&pr`** | | **`cd`** | Only with proxysg format. The default category for the exported indicators. | **`https://ext-/instance/execute/?v=proxysg&cd=default_category`** | | **`ca`** | Only with proxysg format. The categories that will be exported. Indicators not in these categories will be classified as the default category. | **`https://ext-/instance/execute/?v=proxysg&ca=category1,category2`** | | **`tr`** |

Only with PAN-OS (text) format. Whether to collapse IPs.

  • 0 - Do not collapse.
  • 1 - Collapse to ranges.
  • 2 - Collapse to CIDRs
| **`https://ext-/instance/execute/?q="type:ip and sourceBrand:my_source"&tr=1`** | | **`tx`** | Whether to output CSV formats as textual web pages. | **`https://ext-/instance/execute/?v=csv&tx`** |
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources/administration-and-troubleshooting/integrations/forward-requests-to-long-running-integrations.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.