Next-Generation Firewall
You can configure collecting Next-Generation Firewall logs and data using a data source, content pack integration (onboarded prior to July 26, 2026), or connector (onboarded after July 26, 2026):
Data Source overview
You can forward firewall data from your Next-Generation Firewall (NGFW) and Panorama devices to Cortex XDR.
Link to Data Source instructions
Links to content pack/integration details (onboarded prior to July 26, 2026)
The PAN-OS by Palo Alto Networks content pack manages Palo Alto Networks Firewalls and Panorama via API, allowing users to create, modify, and manage custom security policies, perform configuration commits, manage dynamic lists, perform system upgrades, and query various log types. It contains various playbooks, a classifier (Panorama Classifier) and mapper (Panorama Mapper), issue fields, issue types, and automations/scripts. It also includes the following integration:
Palo Alto Networks PAN-OS: Use this integration to manage Palo Alto Networks Firewall and Panorama, including managing Prisma Access through Panorama, creating and managing security policies, and querying logs. This integration includes commands for managing the master key, checking dynamic updates status, downloading and installing various dynamic updates (for example, AntiVirus, WildFire, GlobalProtect Clientless VPN), listing and deleting policy rules (including new types like application-override, authentication, decryption, nat, and pbf), managing addresses and URL categories, retrieving rule hit counts, disabling rules, and performing hygiene checks on various security profiles and configurations.
Link to connector (onboarded after July 26, 2026)
Last updated
Was this helpful?