Forcepoint

Use Forcepoint data with Cortex XSIAM.

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

Forcepoint is an advanced threat protection product with added local management controls. This connector lets you create and manage custom URL/IP block-list categories in Forcepoint Web Security, centrally manage Forcepoint engines through the Security Management Center, and collect activity logs from Forcepoint DLP.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• Forcepoint: Advanced threat protection with added local management controls. This sub-capability is available with any active Cortex XSIAM, Cortex Cloud, or Cortex AgentiX license.

• Forcepoint DLP Event Collector: This sub-capability is available with any active Cortex XSIAM license.

• Forcepoint Security Management Center: Forcepoint SMC provides unified, centralized management of all models of Forcepoint engines whether physical, virtual or cloud—across large, geographically distributed enterprise environments. This sub-capability is available with any active Cortex XSIAM or Cortex AgentiX license.

To configure this connector, follow the steps outlined in the configuration wizard.