> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/complete-data-source-catalog.md). # Complete data source and connector catalog The complete data source catalog is a conceptual grouping that is comprised of all configuration points available for data ingestion across Cortex XSIAM. It represents the aggregate of every integration method, from unified vendor connectors and cloud onboarding wizards to generic on-premise collectors and specialized Marketplace integrations. The catalog is best understood by categorizing ingestion methods into the following core groups. By consulting the specific documentation sections dedicated to each category as detailed below, you gain a complete overview of all available ingestion options that collectively form the data source and connector catalog. ### Vendor-specific data sources and connectors This section includes integrations for specific third-party security and IT products, such as Okta, Box, and Salesforce. These include: * **Connectors**: The strategic, unified experience that allows you to manage all of a vendor's capabilities, such as log collection, automation, and posture, through a single configuration wizard. * **Standard data collectors**: Traditional built-in API and file-based collection functionalities. Access to specific connectors depends on your license and tenant onboarding date. For more information, see [What are Cortex XSIAM Data Sources and Connectors?](/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/what-are-cortex-xsiam-data-sources.md). Configured on the **Data Sources & Integrations** page. ### Cloud Service Provider (CSP) onboarding Cortex XSIAM provides specialized onboarding wizards for integrating major cloud environments, such as AWS, Azure, GCP, and OCI. These wizards enable streamlined setup for asset discovery, cloud posture/runtime security, and log collection across your cloud infrastructure. Configured on the **Data Sources & Integrations** page. ### Generic on-premise data collectors Flexible collectors for logs and data from local environments not tied to a specific vendor, including: * **Broker VM applets**, such as Syslog Collector and Database Collector, configured using the **Broker VMs** page. * **XDR Collectors (XDRC)** for on-host log collection, configured on the **XDR Collectors** page. ### Marketplace content packs (integrations) Packages that offer rich security content, often including a collection integration for data ingestion alongside automation components. * **New Tenants**: For tenants onboarded after July 26, 2026, standalone Marketplace integrations that have been consolidated into unified connectors are hidden from the catalog. Instead, these services are managed as sub-capabilities within the relevant vendor connector on the **Data Sources & Integrations** page to ensure a streamlined experience. * **Existing Tenants**: Continue to use Marketplace integrations for services not yet migrated to the connector framework for your account. These are installed from **Settings → Configurations → Marketplace** and configured using the Data Source Onboarder on the **Data Sources & Integrations** page. ### Palo Alto Networks integrations These integrations include both traditional data sources and new unified connectors to ensure deep telemetry ingestion and seamless cross-platform orchestration across the Palo Alto Networks security stack, such as Next-Generation Firewall and Prisma Access, configured on the **Data Sources & Integrations** page. ### Cloud Posture and Runtime Security data sources These data sources provide agentless visibility and real-time control over cloud risks by using cloud-native APIs to monitor misconfigurations and secure container environments. These data sources are configured: * Using Broker VM applets, such as AppSec Transporter, configured using the **Broker VMs** page. * On the **Data Sources & Integrations** page. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/complete-data-source-catalog.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.