> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/manage-custom-content-for-connectors.md). # Manage custom content for connectors Understand how to manage custom content for connectors in Cortex XDR. Cortex XDR is transitioning to a unified connector experience that consolidates all vendor security capabilities, including log ingestion, automation, and threat intelligence, into a single entry in the catalog. Within a connector, these individual services are referred to as sub-capabilities (integrations). ### Availability The method for managing custom content depends on your onboarding date and the implementation status of the specific vendor: * **New customers (onboarded after July 26, 2026)**: Your entire catalog follows the unified connector experience. To create custom content based on any existing service in the catalog, you must use the external management workflow (GitHub and the SDK). * **Existing customers (onboarded before July 26, 2026)**: * **Unified connectors**: These represent a simplified onboarding experience for your tenant and do not support custom content. * **Legacy integrations**: To create custom content, you must continue to use the **Duplicate** and **View Source** options for original Marketplace integrations, which remain fully supported using the built-in editor in Cortex XDR. ### Duplicate and view source code The method for managing source code depends on whether you are duplicating a legacy integration or a sub-capability within a connector: * **Legacy integrations**: You can continue to use the **Duplicate** and **View Source** options directly within Cortex XDR. Upon duplication, the item transitions to a custom content status, and you can modify the source code using the built-in editor. * **Connector sub-capabilities (integrations)**: The built-in editor is not supported for duplicating or expanding existing sub-capabilities. To view the source code of a sub-capability or to duplicate it as custom content, you must perform the manual flow using GitHub and the `demisto-sdk`.

Note

The built-in editor remains fully supported for creating new custom integrations from scratch.

### External management workflow When you select **Duplicate** or **View Source** for a sub-capability (integration) on the **Data Sources & Integrations** page, Cortex XDR provides the names of all the connector's sub-capabilities (integrations) so you can select the one relevant to you. You will need this name to locate the relevant files in the official repository. #### **Option 1: View source in GitHub** If you only need to review the code without making changes: 1. Copy the **Integration Name** provided for the sub-capability (integration) on the **Data Sources & Integrations** page in Cortex XDR. 2. Navigate to the official [Cortex Content GitHub Repository](https://github.com/demisto/content). 3. Search for the integration folder under the `Packs/ directory` using the name you copied (such as, `Packs//Integrations//`). 4. Review the `YAML` and `Python/PowerShell` files directly in the repository. #### **Option 2: Duplicate and modify using the SDK** To modify an existing sub-capability (integration) and upload it as custom content, you must use the SDK. {% hint style="warning" %} #### Important **Recommended AI-assisted workflow**: It is recommended to use the[ upload-custom-integration skill](https://github.com/demisto/content/blob/master/.ai/skills/upload-custom-integration/SKILL.md) to complete this procedure by copying the skill to an agentic AI coding assistant. The skill is tool-agnostic, is compatible with any agentic AI coding assistant, and provides step-by-step guidance through the entire workflow. {% endhint %} {% hint style="warning" %} #### Prerequisite Before starting, ensure you have: * [Python 3.10](https://www.python.org/downloads/) or higher installed on your workstation. * [Git](https://git-scm.com/install/) installed and configured with access to GitHub. * Cortex XDR credentials (Instance Administrator privileges required). {% endhint %} **Step 1: Install or update demisto-sdk** The custom upload flow requires `demisto-sdk` **version 1.39.10 or higher**. 1. Run the following command to install or upgrade:\ `pip install --upgrade demisto-sdk` 2. Verify the version and confirm the command is available:\ `demisto-sdk upload-custom-integration --version` {% hint style="info" %} #### Note For full installation instructions and system requirements, see the [Demisto-SDK Installation Guide](https://cortex-docs.paloaltonetworks.com/demisto-sdk-development-guide/demisto-sdk-guide/install-demisto-sdk). {% endhint %} **Step 2: Clone or sync the content repository** {% hint style="warning" %} #### Warning If you intend to submit your changes as a pull request to `demisto/content`, you should fork the repository first instead of cloning it directly. See the[ Contributing Guide](https://xsoar-pan-dev--pull-request-1877-lm46g8g7.web.app/docs/contributing/contributing) for the full fork-based contribution workflow. {% endhint %} Clone the official[ demisto/content repository](https://github.com/demisto/content) locally. * **Option A SSH** (recommended for local uploads only):\ `git clone git@github.com:demisto/content.git` * **Option B (HTTPS)**:\ `git clone https://github.com/demisto/content.git` {% hint style="info" %} #### Note If you already have a local copy, ensure it is up to date before proceeding:\ `git checkout master` `git pull origin master --rebase` {% endhint %} **Step 3: Configure environment variables** To allow `demisto-sdk` to authenticate with your platform instance, create a `.env` file in the `root` directory of your cloned content repository (`content/.env`). **How to obtain credentials from Cortex XDR:** 1. Log in to Cortex XDR. 2. Navigate to **Settings** → **Configurations** → search for **API Keys**. 3. **API URL** (`DEMISTO_BASE_URL`): Click **Copy API URL** in the top right corner. 4. **API Key** (`DEMISTO_API_KEY`):\ a. Click **New Key** (top right corner).\ b. Set **Key Type** to **Standard**.\ c. Set **Role** to **Instance Administrator**.\ d. Click **Generate** and copy the key immediately from the window. 5. **Auth ID** (`XDR_AUTH_ID`):\ a. Close the key window to view the API Keys table.\ b. Locate the row for your newly created API key.\ c. Copy the numerical ID in the **ID** column (such as, 4). **Populate content/.env**\ Add your credentials to `content/.env`: `DEMISTO_BASE_URL=https://api-your-tenant-url.xdr.us.paloaltonetworks.com/xsoar` `DEMISTO_API_KEY=your_copied_api_key_here` `XDR_AUTH_ID=your_key_id_number_here` **Step 4: Duplicate and update YAML** 1. **Locate the sub-capability (integration)**: Find the directory you want to duplicate under the `Packs` directory (such as, `Packs//Integrations//`). 2. **Add the \_copy marker**: Open the integration's `.yml` file in your favorite IDE (such as, VS Code) and update both the `commonfields.id` and `name` fields to include the `_copy` marker. If either field is missing this marker, the upload command will block execution to prevent tenant corruption. {% hint style="info" %} #### Note Updating the display field with the `_copy` marker is optional but recommended. It helps distinguish your custom duplicate from the original sub-capability (integration) in Cortex XDR. {% endhint %} {% hint style="warning" %} #### Important **Warning Critical System ID Conflict Risk**: If you upload a custom sub-capability (integration) whose ID matches an official system integration's ID, any subsequent attempt to update or install the system pack containing that integration will fail with a platform system error. The `_copy` marker suffix is required to protect your instance. {% endhint %} For example: `# BEFORE` `commonfields:` `id: PolarSecurity` `name: Polar Security` `# AFTER (Required Duplication Convention)` `commonfields:` `id: PolarSecurity_copy` `name: Polar Security_copy` **Step 5: Upload the custom sub-capability (integration)** Run the `upload-custom-integration` command, passing the path to your modified directory or direct YAML file. * **Recommended (upload using directory path)**: `demisto-sdk upload-custom-integration -i 'Packs/MyPack/Integrations/MyIntegration'` * **Alternative (upload using direct YAML file)**: `demisto-sdk upload-custom-integration -i 'Packs/MyPack/Integrations/MyIntegration/MyIntegration.yml'` **Expected command output**: ``` Running Demisto-SDK CLI Uploading Packs/MyPack/Integrations/MyIntegration/MyIntegration.yml to https://api-your-tenant... UPLOAD SUMMARY: SUCCESSFUL UPLOADS: NAME TYPE PACK NAME PACK VERSION MyIntegration.yml Integration My Pack 1.0.0 ``` \ **Step 6: Verify in Cortex XDR** 1. Log in to Cortex XDR. 2. Select **Settings** → **Data Sources & Integrations** → **Add New**. 3. Locate your sub-capability (integration); it will display a **Custom** badge. 4. Click **Add** to configure and use your custom duplicate. ### Troubleshooting & FAQ **Error: Missing \_copy Marker** If you see an error like the one below, the SDK has blocked the upload to prevent ID conflicts: `Invalid value: Integration field(s) missing the '_copy' marker: commonfields.id = 'MyIntegration' and name = 'MyIntegration'`\ **Fix**: Open your YAML file and append `_copy` to both `commonfields.id` and `name`. **Bypassing Validation (--force-id)** {% hint style="warning" %} #### Important Using `--force-id` is strongly discouraged. Only use this flag if you are an advanced administrator explicitly maintaining custom IDs outside standard system pack boundaries.\ Before using this flag, verify ALL of the following: 1. Your chosen ID is completely unique and does NOT match the original integration ID. 2. Your chosen ID does NOT match any integration ID published on Marketplace. {% endhint %} If you must upload without the `_copy` marker, pass the `--force-id` flag:\ `demisto-sdk upload-custom-integration -i --force-id`\ This will log a high-visibility CLI warning before proceeding:\ `[WARNING] Uploading custom content without the '_copy' marker risks conflicting with official system pack IDs... Proceeding because --force-id was explicitly set.` --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xdr/configure-cortex-xdr/cortex-xdr-data-sources/administration-and-troubleshooting/manage-custom-content-for-connectors.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.