> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources/palo-alto-networks-integrations.md). # Palo Alto Networks integrations Cortex XSIAM supports data ingestion and orchestration from other Palo Alto Networks products. These integrations are provided through a combination of traditional data sources and unified connectors, ensuring comprehensive visibility and seamless cross-platform security operations. {% hint style="info" %} ### Notice Data collection may require an add-on. {% endhint %} ### Ingestion methods Depending on the specific product and your tenant onboarding date, integrations are handled via the following methods: * **Connectors**: The strategic, unified approach for integrating Palo Alto Networks services. A connector consolidates multiple security capabilities, such as Automation, Data Security, and Identity Posture, into a single, guided configuration flow. * **Availability**: These connectors are available for tenants onboarded after July 26, 2026. * **Legacy support**: Existing tenants (onboarded prior to July 26, 2026) can achieve similar functionality by using the standalone Marketplace integrations linked within each product topic. For more information, see [Marketplace](/cortex-agentix/configure-cortex-agentix/marketplace.md). * **Traditional data sources**: Cortex XSIAM supports streaming data directly from Prisma Access accounts, Prisma Access Browser, Cloud Next-Generation Firewalls (CNGFW), and Next-Generation Firewalls (NGFW), including Panorama devices, to your Cortex XSIAM tenants using the Strata Logging Service. * **Direct integration**: New tenants (and tenants upgraded from Cortex XDR to XSIAM) utilize the direct integration of Next-Generation Firewall, including Panorama devices, into Cortex XSIAM. For these tenants, the option to use the Strata Logging Service integration is not available. * **Migration from Strata Logging Service**: For tenants with existing direct integrations to the Strata Logging Service, you can migrate your configurations, such as NGFW and Prisma Access, to Cortex XSIAM before your license expires. This can be done manually via the **Migrate Devices** buttons on the **Data Sources & Integrations** page (recommended more than two weeks before license expiration) or via automatic migration initiated by Cortex XSIAM two weeks prior to expiration.

Note

Roll-back of Strata Logging Service integration migration is not supported.

#### Technical reference requirements for connectors While the unified wizard handles the configuration for new connectors, you should refer to the [Cortex Developer Docs for Marketplace (PAN DEV)](https://cortex.marketplace.pan.dev/marketplace/) site for specific technical information related to the integration (now referred to as a **sub-capability** in the new connector world), such as: * Fetched Incidents Data * Available Commands * Required incident fields and data schemas not provided in the wizard. {% hint style="info" %} **Note** For many popular vendors, you can choose between distinct types of data sources to fit your needs. Check the available descriptions for each entry in the user interface and documentation to decide which option is most suitable. {% endhint %} ### General requirements Ensure you meet the following requirements before configuring your integrations: * Deploy the relevant Palo Alto Networks products, such as NGFW or CNGFW. * Hold Super User permissions for your Customer Support Portal (CSP) account. * After your tenant has been activated, navigate to the **Data Sources & Integrations** page in Cortex XSIAM to configure your integrations. * All devices and accounts allocated to your CSP accounts are available to integrate. {% hint style="info" %} **Note** For certain traditional Palo Alto Networks integrations using data sources, you can select specific log types to ingest for each data source instance. This granular filtering allows you to optimize data consumption and reduce ingestion costs by ensuring only high-value security logs reach the ingestion pipeline. For more information, see [Log type filtering](broken://pages/VzeGRzsf9SaHrtaR1BJM). For customers who have not migrated to Cortex XSIAM 3.x, see [Collecting URL and File log types](broken://pages/rQS5fYcxpVtIjaZUg29g). {% endhint %} ### Supported integrations Cortex XSIAM provides specific documentation and configuration steps for each Palo Alto Networks integration. Select an integration from the topics provided below to view its supported ingestion methods and configuration requirements. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources/palo-alto-networks-integrations.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.