> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/what-are-cortex-cloud-data-sources.md).

# What are Cortex Data Security data sources and connectors?

Data sources and connectors are the foundational mechanisms used to ingest security and operational data, including logs, events, and asset metadata, into Cortex Data Security for analysis, correlation, and response. By consolidating data from diverse origins like cloud environments, SaaS platforms, and on-premises infrastructure, Cortex Data Security constructs a comprehensive and contextualized "security story" used to identify misconfigurations and prioritize risk.

### Clarifying terminology: Data sources and Connectors

In the Cortex Data Security user interface (UI), configuring ingestion involves different areas and terminologies depending on the type of connection and your tenant onboarding date. While Cortex Data Security is introducing connectors as a new, unified approach to ingestion, traditional Data Source methods remain supported .

In the current intermediate state, it is important to understand how these terms relate to each other:

* **Data sources**: Represents the traditional method for any integration that provides data to Cortex Data Security. In this documentation, Data Source is used as the category for these traditional ingestion methods, which include:
  * **Data collectors**: Built-in tools primarily focused on raw log ingestion. This includes core ingestion functionalities found using the Data Source Onboarder .
  * **Broker VM applets**: Specialized applications running on the Broker VM that function as collectors, such as the DSPM Fileshare.
* **Connectors**: The new, unified mechanism for data ingestion. For supported vendors, a Connector groups multiple security capabilities, such as Identity Posture and Data Security, into a single, uniquely named entry with a guided configuration wizard .

While specific components like Data Collectors, Broker VM applets, and Connectors are named explicitly when discussing their unique configuration workflows, they all fall under the foundational goal of ingesting data into Cortex Data Security.

### Why are different data sources and connectors necessary?

Cortex Data Security enables you to collect data across a vast and varied enterprise landscape. This necessitates distinct data source types and connectors designed for different environments and needs:

* **Connectors**: Streamline the onboarding of third-party SaaS services by grouping identity and data security capabilities into a single entry with a guided wizard.
* **Standard data collectors (API/Built-in)**: These are built-in functionalities primarily focused on ingesting raw logs and security events for core security analysis, parsing, and normalization.
* **Broker VM data collector applets**: These are modular applications installed on a local Broker VM virtual appliance, designed for on-premise data collection needs.
* **Cloud Service Provider (CSP) Onboarding**: These are specialized wizards for integrating cloud environments, such as AWS, Azure, GCP, and OCI, enabling streamlined setup for asset discovery, cloud posture security, and log collection.
* **Cloud Posture and Runtime Security data sources**: These data sources provide agentless visibility and real-time control over cloud risks by using cloud-native APIs to monitor misconfigurations, scan container registries, and secure serverless functions or sensitive data across multi-cloud environments.

### **Current UI and future direction**

Cortex Data Security is transitioning toward a unified ingestion experience. While different ingestion methods currently involve distinct workflows, the following table summarizes where to manage them:

| Data Source Type                                | Primary UI Location(s) for Configuration                                                                                                                                                                                                                   | Key Components                                                                                           |
| ----------------------------------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | -------------------------------------------------------------------------------------------------------- |
| Connectors                                      | **Data Sources & Integrations** page (**Settings** → **Data Sources & Integrations** → **+ Add New**)                                                                                                                                                      | Unified wizard for multi-capability vendor integrations.                                                 |
| Standard data collectors                        | **Data Sources & Integrations** page (**Settings** → **Data Sources & Integrations** → **+ Add New**)                                                                                                                                                      | Built-in functionalities primarily focused on ingesting raw logs and security events, such as Okta.      |
| CSP onboarding and standard collectors          | **Data Sources & Integrations** page (**Settings** → **Data Sources & Integrations** → **+ Add New**)                                                                                                                                                      | Specialized wizards for integrating cloud environments, such as AWS, Azure, and GCP.                     |
| Broker VM applets                               | **Broker VMs** page (Settings → Configurations → Data Broker → **Broker VMs**)                                                                                                                                                                             | Specialized applications running on a Broker VM, such as DSPM Fileshare.                                 |
| Cloud Posture and Runtime Security data sources | <ul><li><strong>Data Sources & Integrations</strong> page (Settings → Data Sources & Integrations → <strong>+ Add New</strong>)</li><li><strong>Broker VMs</strong> page (Settings → Configurations → Data Broker → <strong>Broker VMs</strong>)</li></ul> | Direct API ingestion or Broker VM applets for monitoring misconfigurations and securing cloud workloads. |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/data-security-documentation/cortex-data-security-data-sources-and-connectors/what-are-cortex-cloud-data-sources.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.