Palo Alto Networks integrations

Cortex Cloud supports data ingestion from other Palo Alto Networks products.

Cortex Cloud supports data ingestion and orchestration from other Palo Alto Networks products. These integrations are provided through a combination of traditional data sources and unified Connectors, ensuring comprehensive visibility and seamless cross-platform security operations.

Notice

Data collection may require an add-on.

Ingestion methods

Depending on the specific product and your tenant onboarding date, integrations are handled via the following methods:

• Connectors: The strategic, unified approach for integrating Palo Alto Networks services. A connector consolidates multiple security capabilities, such as Data Security, Identity Posture, and Automation, into a single, guided configuration flow.

  • Availability: These connectors are available for tenants onboarded after July 26, 2026.
  • Legacy support: Existing tenants (onboarded prior to July 26, 2026) can achieve similar functionality by using the standalone Marketplace integrations linked within each product topic. For more information, see Marketplace.
• Traditional data sources: Cortex Cloud supports streaming data directly from Prisma Access accounts, Prisma Access Browser, Cloud Next-Generation Firewalls (CNGFW), and Next-Generation Firewalls (NGFW), including Panorama devices, to your Cortex Cloud tenants using the Strata Logging Service.

  • Direct integration for new tenants: New tenants (and tenants upgraded from Cortex XDR to Cortex Cloud) utilize the direct integration of Next-Generation Firewall, including Panorama devices, into Cortex Cloud. For these tenants, there’s no option to use the Strata Logging Service integration.
  • Migration from Strata Logging Service: For tenants with existing direct integrations to the Strata Logging Service, you can migrate your configurations, such as NGFW and Prisma Access, to Cortex Cloud before your license expires. This can be done manually via the Migrate Devices buttons on the Data Sources & Integrations page (recommended more than two weeks before license expiration) or via automatic migration initiated by Cortex Cloud two weeks prior to expiration.

    Note

    Roll-back of Strata Logging Service integration migration is not supported.

Technical reference requirements for connectors

While the unified wizard handles the configuration for new connectors, you should refer to the Cortex Developer Docs for Marketplace (PAN DEV) for specific technical information related to the integration (now referred to as a sub-capability in the new connector world), such as:

• Fetched incidents data
• Available commands
• Required incident fields and data schemas not provided in the wizard.

General requirements

Ensure you meet the following requirements before configuring your integrations:

• Deploy the relevant Palo Alto Networks products, such as NGFW or CNGFW.
• Hold Super User permissions for your Customer Support Portal (CSP) account.
• After your tenant has been activated, navigate to the Data Sources & Integrations page in Cortex Cloud to configure your integrations.
• All devices and accounts allocated to your CSP accounts are available to integrate.

Note

For Palo Alto Networks Integrations there is an option to turn on or off the collection of URL and File log types. For more information, see Collecting URL and File log types.

Supported Integrations

Cortex Cloud provides specific documentation and configuration steps for each Palo Alto Networks integration. Select an integration to view its supported ingestion methods and configuration requirements.