↳ GitHub sourceSolution

Palo Alto Cortex Xpanse CCF

Description

The [Palo Alto Cortex Xpanse ](https://www.paloaltonetworks.com/cortex/cortex-xpanse) data connector allows ingesting logs from the Palo Alto Cortex Xpanse API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Framework. It uses the Palo Alto Cortex Xpanse API to fetch alerts logs and it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security data into a custom table, thus resulting in better performance.
Version
3.0.0
Declared author / publisher
Microsoft - support@microsoft.com
Support tier
Microsoft

Related content

Links established from declared identifiers and solution manifests.

Source provenance

GitHub

Displayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.

Source identifier
azure-sentinel-solution-cortexxpanse
Additional source files 2Solutions/Palo Alto Cortex Xpanse CCF/Data/Solution_CortexXpanse.jsonsolution-manifest ↗Solutions/Palo Alto Cortex Xpanse CCF/SolutionMetadata.jsonsolution-metadata ↗
GSTEP / CATALOG TRACKING

Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC

GSTEP sync dates, separate from the source content’s publication dates.