> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/external-integrations.md). # External integrations You can integrate external threat intelligence services with Cortex XSIAM that provide additional verification sources for each key artifact in a case. Cortex XSIAM supports the following integrations:
Threat intelligence | Integration | Description | | ----------- | --------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | WildFire |

Cortex XSIAM automatically includes WildFire threat intelligence in the case and issue investigation.

WildFire detects known and unknown threats, such as malware. The WildFire verdict contains detailed insights into the behavior of identified threats. The WildFire verdict is displayed next to relevant Key Artifacts in the Cases page. See Review WildFire analysis details for more information.

| | VirusTotal |

VirusTotal provides aggregated results from over 70 antivirus scanners, domain services included in the block list, and user contributions. The VirusTotal score is represented as a fraction. For example, a score of 34/52 means out of 52 queried services, 34 services determined the artifact to be malicious.

To view VirusTotal threat intelligence in cases, you must obtain the license key for the service and add it to the Cortex XSIAM Configuration. When you add the service, the relevant VirusTotal (VT) score is displayed in the Cases page under Key Artifacts.

|
Case management | Integration | Description | | ----------------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | | Third-party ticketing systems | To manage cases from the application of your choice, you can use the Cortex XSIAM API Reference to send issues and issue details to an external receiver. After you generate your API key and set up the API to query Cortex XSIAM, external apps can receive case updates, request additional data about cases, and make changes such as setting the status and changing the severity or assigning an owner. To get started, see the Cortex XSIAM API Reference guide. |
--- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/configure-cortex-xsiam/customize-cases-and-issues/external-integrations.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.