↳ GitHub sourceConnector

Palo Alto Cortex XDR

Description

The [Palo Alto Cortex XDR](https://cortex-panw.stoplight.io/docs/cortex-xdr/branches/main/09agw06t5dpvw-cortex-xdr-rest-api) data connector allows ingesting logs from the Palo Alto Cortex XDR API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform. It uses the Palo Alto Cortex XDR API to fetch logs and it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security data into a custom table so that queries don't need to parse it again, thus resulting in better performance.
Declared status
1
Declared author / publisher
Microsoft

Declared sources

Metadata from the source file. No dependencies inferred from KQL.

Data types

Declared permissions

Read and Write permissions are required.
Workspace
Workspace

Connector instructions

Content published in the repository. Refer to the original file for all parameters.

Base API URL
API Key ID
API Token
toggle

Related content

Links established from declared identifiers and solution manifests.

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
CortexXDRDataConnector
Additional source files 4Solutions/Cortex XDR/Data Connectors/CortexXDR_ccp/DataConnectorDefinition.jsonsource ↗Solutions/Palo Alto Cortex XDR/Data Connectors/CortexXDR_ccp/DataConnectorDefinition.jsonsource-occurrence ↗Solutions/Cortex XDR/Data/Solution_CortexXDR.jsonsolution-membership ↗Solutions/Palo Alto Cortex XDR/Data/Solution_CortexXDR.jsonsolution-membership ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.