> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-mulesoft.md). # Onboard MuleSoft For SaaS Security to detect posture risks in your MuleSoft instance, you must onboard your MuleSoft instance to SaaS Security. Through the onboarding process, SaaS Security connects to an Anypoint Platform API and, through the API, scans your MuleSoft instance for misconfigured settings and account risks. SaaS Security gets access to your MuleSoft instance through an OAuth 2.0 application that you create. In the Anypoint Platform, an OAuth 2.0 application is called a Connected App. During onboarding, you supply SaaS Security with the application credentials (Client ID and Client Secret) for your Connected App. SaaS Security uses these credentials to access the Anypoint Platform API. SaaS Security scans are supported for all MuleSoft paid plans. To access your MuleSoft instance, SaaS Security requires the following information, which you specify during the onboarding process. | Item | Description | | ------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Hosted Region | MuleSoft operates multiple independent regional sites worldwide. Because these regional environments are entirely separate from one another, you must provide SaaS Security with the region where MuleSoft hosts your data. You can determine your region from the MuleSoft URL displayed in your browser's address bar. | | Client ID | SaaS Security accesses an Anypoint Platform API through a Connected App that you create in the Anypoint Platform. The Anypoint Platform generates the Client ID to uniquely identify this Connected App. | | Client Secret | SaaS Security accesses an Anypoint Platform API through a Connected App that you create in the Anypoint Platform. The Anypoint Platform generates the Client Secret, which SaaS Security uses to authenticate to the API through the Connected App. | To onboard your MuleSoft instance, complete the following actions. *** ### Step 1: Identify the Anypoint Platform Account Identify the Anypoint Platform account that you will use to create your Connected App. Required Permissions: To create the Connected App, you must use an Anypoint Platform account assigned to the Organization Administrator role. *** ### Step 2: Log In to the Anypoint Platform Open a web browser to the [MuleSoft Anypoint Platform login page](https://anypoint.mulesoft.com/login/) and log in to the Organization Administrator account you identified. *** ### Step 3: Identify Your Hosted Region Use the following table to determine your region based on the MuleSoft URL displayed in your browser's address bar. You will provide this region information to SaaS Security during onboarding. | URL | Region | | ------------------------- | ------------------------------- | | anypoint.mulesoft.com | US | | eu1.anypoint.mulesoft.com | Europe | | ca1.anypoint.mulesoft.com | Canada | | jp1.anypoint.mulesoft.com | Japan | | gov.anypoint.mulesoft.com | Gov (MuleSoft Government Cloud) | **Note**: MuleSoft Government Cloud is a dedicated, high-security instance of Anypoint Platform tailored for U.S. public sector organizations, including federal, state, and local agencies and their authorized partners. *** ### Step 4: Create Your Connected App SaaS Security uses this Connected App to authenticate to an Anypoint Platform API to run scans. You configure the Connected App to allow access to only the scopes that SaaS Security requires. 1. From the Anypoint Platform home screen, navigate to the Access Management page. In some interface versions, a link to Access Management is on the home screen. If you do not see a link on the home screen, locate the Access Management link under the main navigation menu in the top-left corner of the Anypoint Platform page. 2. From the left navigation pane of the Access Management page, select Connected Apps. 3. On the Connected Apps page, click Create app. 4. On the Create App page, complete the following actions: 1. Specify a Name for your Connected App. For example, SaaS Security Integration. 2. For the Type of application, select App acts on its own behalf (client credentials). 3. Click Add Scopes and add the following scopes: 1. View Policies 2. Access Controls Viewer 3. View Connected Applications 4. View Environment 5. View Organization 6. View Users in a particular organization 5. Click Save. The Anypoint Platform creates the Connected App and displays it in the list of Connected Apps. 6. From the list on the Connected Apps page, click the name of your Connected App. The Anypoint Platform displays the Update App page, which shows the Connected App credentials (Client ID and Client Secret) that SaaS Security uses to authenticate to an Anypoint Platform API. 7. Copy the Client ID and Client Secret and paste them into a text file. **Note**: Do not continue to the next step unless you have copied the Client ID and Client Secret. You must provide this information to SaaS Security during the onboarding process. *** ### Step 5: Connect SaaS Security to Your MuleSoft Instance By adding a MuleSoft app in Cortex, you enable SaaS Security to connect to your MuleSoft instance. 1. Log in to Cortex. 2. Select **Settings > Data Sources and Integrations > Add New**. You can use the Search bar to find the app you want to connect to. 3. Click the MuleSoft tile. 4. Under **Capabilities**, enter a name for your application. 5. Select Security Posture under Default Capabilities and click Next. 6. Under **Connections**, enter the Client ID, Client Secret, and Hosted Region for your Connected App. 7. Under **Configurations**, select a **Sync Interval**. Choose a meaningful **Tag** to distinguish between various applications in different environments. 8. Click **Next** to complete the onboarding validation process. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/cortex-cloud-ai-security/cortex-cloud-saas-security/onboard-a-supported-saas-application/onboard-mulesoft.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.