> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources/vendor-specific-data-sources-and-connectors.md).
# Vendor-specific data sources and connectors
Cortex AgentiX enables you to ingest data from a wide range of third-party vendors and security services. For many popular vendors, you can choose between distinct types of ingestion methods to fit your organizational needs:
* Connectors
* Standard data sources (also called data collectors)
* Content pack integrations (Marketplace)
In some cases, the same vendor is available through multiple options. Check the available descriptions for each entry in both the user interface and documentation to decide which option is more suitable for your needs.
| Data Source Type | Primary Use | Configuration Method | Cortex XSIAM Features | Recommendation |
| -------------------------------------------------- | -------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Connector | Unified integration for all vendor capabilities. | Configured on the **Data Sources & Integrations** page using a unified wizard. | Includes data ingestion, parsing, normalization, plus built-in commands, and automations. | Recommended approach for all supported vendors. Choose this for a streamlined, multi-capability setup. |
| Standard data source (also called data collectors) | Ingesting raw logs and events. | Configured in the **Data Sources & Integrations** page using the Data Source Onboarder. | Limited to data ingestion, parsing, and normalization. | Choose this if you only need raw data ingestion for a service not yet covered by a unified connector. |
| Content pack integration (Marketplace) | Ingesting data and enabling rich security functionality. | Configured via a content pack downloaded from Marketplace by either:
- Using the Data Source Onboarder on the Data Sources & Integrations page (if available)
- Installing the content pack from Settings → Configurations → Marketplace, and then configuring the integration instance on the Data Sources & Integrations page.
| Includes: Data ingestion, parsing, normalization, plus built-in commands and automations, such as playbooks, scripts, correlation rules, and data model rules. | Primarily for existing tenants (onboarded before July 26, 2026) for services not yet migrated to the connector framework.
Choose this option for any of the following reasons:
- You need to define automations.
- You need to collect data that is not covered by a standard collector.
- You need to install rules or automations relevant to integrations or data sources.
|
### Availability for new tenants
If your Cortex AgentiX tenant was onboarded after July 26, 2026, a strategic Connector experience across the catalog is available. Standalone Marketplace integrations that have been consolidated into unified connectors are hidden from Marketplace to ensure a simplified configuration flow. For these vendors, always use the uniquely named Connector to manage all supported sub-capabilities.
### Third-party vendor list
Cortex AgentiX provides specific documentation for each vendor to help you choose and configure the right connection. To ensure you have a single, unified reference point, the vendors are listed in alphabetical order and includes every supported vendor, regardless of the data source group connector.
#### Keep in mind the following:
* **Unique connector names**: Each connector has its own unique name. Even if multiple connectors exist for a single vendor, they will be clearly labeled to distinguish their capabilities.
* **Licensing requirements**: Availability of specific connectors, capabilities, and sub-capabilities is determined by your tenant license. You will only see and be able to onboard services supported by your active license.
* **Consolidated management**: Regardless of whether you are using a traditional data source or a new unified connector, all active instances are managed from the **Data Sources & Integrations** page.
* **Marketplace reference (existing tenants)**: For tenants onboarded prior to July 26, 2026, this list doesn't include all content pack integrations, only those shared with a traditional data source. This helps you distinguish between multiple results for the same vendor. For a complete list of all available Marketplace content packs and integrations, see the [Cortex Developer Docs for Marketplace](https://cortex.marketplace.pan.dev/marketplace/). This site provides instructions for these integrations by selecting the **\** → **Content** → **Integrations**, and, depending on the integration, choosing the relevant integration steps you're looking to implement. You can always install and integrate content pack integrations in Cortex AgentiX from Marketplace or the **Data Sources & Integrations** page, if the content pack is available from this page.
* **Requirement hand-off (new tenants)**: If your tenant was onboarded after July 26, 2026, the unified wizard handles all configuration steps. Yet, you must still refer to the [Cortex Developer Docs for Marketplace](https://cortex.marketplace.pan.dev/marketplace/) for critical technical information not provided in the wizard, such as available fetched incidents data, commands, and other specific technical details related to the integration. Note that the Marketplace site may occasionally reference a different Cortex product, but the technical requirements remain applicable.
***
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources/vendor-specific-data-sources-and-connectors.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.