> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations.md).

# Palo Alto Networks integrations

Cortex Cloud supports data ingestion and orchestration from other Palo Alto Networks products. These integrations are provided through a combination of traditional data sources and unified Connectors, ensuring comprehensive visibility and seamless cross-platform security operations.

{% hint style="info" %}

### Notice

Data collection may require an add-on.
{% endhint %}

### Ingestion methods

Depending on the specific product and your tenant onboarding date, integrations are handled via the following methods:

* **Connectors**: The strategic, unified approach for integrating Palo Alto Networks services. A connector consolidates multiple security capabilities, such as Data Security, Identity Posture, and Automation, into a single, guided configuration flow.
  * **Availability**: These connectors are available for tenants onboarded after **July 26, 2026**.
  * **Legacy support**: Existing tenants (onboarded prior to July 26, 2026) can achieve similar functionality by using the standalone Marketplace integrations linked within each product topic. For more information, see [Marketplace](/cortex-cloud-runtime-security/marketplace/cortex-marketplace.md).
* **Traditional data sources**: Cortex Cloud supports streaming data directly from Prisma Access accounts, Prisma Access Browser, Cloud Next-Generation Firewalls (CNGFW), and Next-Generation Firewalls (NGFW), including Panorama devices, to your Cortex Cloud tenants using the Strata Logging Service.
  * **Direct integration for new tenants**: New tenants (and tenants upgraded from Cortex XDR to Cortex Cloud) utilize the direct integration of Next-Generation Firewall, including Panorama devices, into Cortex Cloud. For these tenants, there’s no option to use the Strata Logging Service integration.
  * **Migration from Strata Logging Service**: For tenants with existing direct integrations to the Strata Logging Service, you can migrate your configurations, such as NGFW and Prisma Access, to Cortex Cloud before your license expires. This can be done manually via the **Migrate Devices** buttons on the **Data Sources & Integrations** page (recommended more than two weeks before license expiration) or via automatic migration initiated by Cortex Cloud two weeks prior to expiration.

    <div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><h3>Note</h3><p>Roll-back of Strata Logging Service integration migration is not supported.</p></div>

#### Technical reference requirements for connectors

While the unified wizard handles the configuration for new connectors, you should refer to the [Cortex Developer Docs for Marketplace (PAN DEV)](https://cortex.marketplace.pan.dev/marketplace/) for specific technical information related to the integration (now referred to as a sub-capability in the new connector world), such as:

* Fetched incidents data
* Available commands
* Required incident fields and data schemas not provided in the wizard.

### General requirements

Ensure you meet the following requirements before configuring your integrations:

* Deploy the relevant Palo Alto Networks products, such as NGFW or CNGFW.
* Hold Super User permissions for your Customer Support Portal (CSP) account.
* After your tenant has been activated, navigate to the **Data Sources & Integrations** page in Cortex Cloud to configure your integrations.
* All devices and accounts allocated to your CSP accounts are available to integrate.

{% hint style="info" %}
**Note**

For Palo Alto Networks Integrations there is an option to turn on or off the collection of URL and File log types. For more information, see [Collecting URL and File log types](/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations/collecting-url-and-file-log-types.md).
{% endhint %}

### Supported Integrations

Cortex Cloud provides specific documentation and configuration steps for each Palo Alto Networks integration. Select an integration to view its supported ingestion methods and configuration requirements.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/cortex-cloud-data-sources-and-connectors/palo-alto-networks-integrations.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.