> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources/what-are-cortex-xsiam-data-sources.md).

# What are Cortex AgentiX data sources and connectors?

Data sources and connectors are the foundational mechanisms used to ingest security and operational data, including logs, events, and asset metadata, into Cortex AgentiX for analysis, correlation, and response. By consolidating data from diverse origins like cloud environments and SaaS platforms, Cortex AgentiX constructs a comprehensive and contextualized "security story" used to identify threats and prioritize risk.

### **Customer availability by tenant type**

The ingestion methods and configuration options available to you in the UI depend on your tenant onboarding date:

* **New tenants (onboarded after July 26, 2026)**: You will primarily interact with the strategic Connector experience. Standalone Marketplace integrations that have been consolidated into connectors are hidden from the catalog to ensure a unified configuration flow.
* **Existing tenants (onboarded before July 26, 2026)**: You will continue to see both standalone Marketplace integrations and unified Connectors. Refer to the specific documentation for each vendor to determine the supported configuration method for your account.

### **Clarifying terminology: Data sources and connectors**

In the Cortex AgentiX user interface (UI), configuring ingestion involves different areas and terminologies depending on the type of connection and your tenant onboarding date. While Cortex AgentiX is introducing connectors as a new, unified approach to ingestion, traditional data source methods remain supported.

In the current intermediate state, it is important to understand how these terms relate to each other:

* **Data sources**: Represents the traditional method for any integration that provides data to Cortex AgentiX. In this documentation, Data Source is used as the category for these traditional ingestion methods, which include:
  * **Data collectors**: Built-in tools primarily focused on raw log ingestion. This includes core ingestion functionalities found using the Data Source Onboarder .
  * **Marketplace (integrations)**: Content packs that include collection integrations. These are often referred to as data sources in the UI, as integrations that fetch data are configured through the Data Source Onboarder on the **Data Sources & Integrations** page.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>This legacy implementation is primarily available to existing customers; new customers (onboarded after July 26, 2026) will use the new Connectors framework for these services (see <a href="#customer-availability-by-tenant-type">Customer availability by tenant type</a> above).</p></div>
* **Connectors**: The new, unified mechanism for data ingestion. For supported vendors, a Connector groups multiple security capabilities, such as logs and automation, into a single, uniquely named entry with a guided configuration wizard.

While specific components like Data Collectors and Connectors are named explicitly when discussing their unique configuration workflows, they all fall under the foundational goal of ingesting data into Cortex AgentiX.

### **Why are different data sources and connectors necessary?**

Cortex AgentiX enables you to collect data across a vast and varied enterprise landscape. This necessitates distinct data source types and connectors designed for different environments and needs:

* **Connectors**: Streamline the onboarding of third-party SaaS services by grouping identity and data security capabilities into a single entry with a guided wizard. This unified approach represents the strategic method for all new vendor integrations.
* **Standard data collectors (API/Built-in)**: These are built-in functionalities primarily focused on ingesting raw logs and security events for core security analysis, parsing, and normalization.
* **Marketplace content packs**: These packages offer specialized security functionality by bundling both a collection integration (for data ingestion) and automation components, such as playbooks and correlation rules.

  <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>Standalone Marketplace integrations are primarily used by existing customers (onboarded before July 26, 2026). New customers will find these services consolidated within the new Connector framework.</p></div>
* **Palo Alto Networks Integrations**: Cortex AgentiX provides both standard data sources and new unified connectors for Palo Alto Networks products to ensure deep telemetry ingestion and seamless cross-platform orchestration.

### **Current UI and future direction**

Cortex AgentiX is transitioning toward a unified ingestion experience. While different ingestion methods currently involve distinct workflows, the following table summarizes where to manage them:

| Ingestion Method          | Primary UI Location(s) for Configuration                                                                                                                                          | Key Components                                                                                                                                                                                                                                                                                                                                       |
| ------------------------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Connectors                | **Data Sources & Integrations** page (Settings → Data Sources & Integrations → **+ Add New**)                                                                                     | Unified wizard for multi-capability vendor integrations.                                                                                                                                                                                                                                                                                             |
| Standard data collectors  | **Data Sources & Integrations** page (Settings → Data Sources & Integrations → **+ Add New**)                                                                                     | Built-in functionalities primarily focused on ingesting raw logs and security events.                                                                                                                                                                                                                                                                |
| Marketplace content packs | **Data Sources & Integrations** page (**Settings** → **Data Sources & Integrations** via Data Source Onboarder, for packs with data ingestion or after a **Marketplace** install) | <p>Discovery and installation of integration-specific content packs.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>For new tenants from July 26, 2026, services consolidated into connectors are managed via the <strong>Data Sources & Integrations</strong> page.</p></div> |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/configure-cortex-agentix/cortex-agentix-data-sources/what-are-cortex-xsiam-data-sources.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.