Thinkst Canary

Use Thinkst Canary data in Cortex XSIAM.

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

This connector is available with any active Cortex XSIAM or Cortex AgentiX license.

By presenting itself as an apparently benign and legitimate service, a Thinkst Canary draws the attention of unwanted activity. When someone trips one of the Canary's triggers, an alert is sent to notify the responsible parties so that action can be taken before valuable systems in your network are compromised. Fetch alerts from CanaryTools as issues and acknowledge them, get information about registered Canaries and Canary Tokens, and add IP addresses to the allow list.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• Thinkst Canary: By presenting itself as an apparently benign and legitimate service(s), the Canary draws the attention of unwanted activity. When someone trips one of the Canary's triggers, an alert is sent to notify the responsible parties so that action can be taken before valubale systems in your network are compromised.

To configure this connector, follow the steps outlined in the configuration wizard.