Description
The [Palo Alto Cortex Xpanse ](https://www.paloaltonetworks.com/cortex/cortex-xpanse) data connector allows ingesting logs from the Palo Alto Cortex Xpanse API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Framework. It uses the Palo Alto Cortex Xpanse API to fetch alerts logs and it supports DCR-based [ingestion time transformations](https://docs.microsoft.com/azure/azure-monitor/logs/custom-logs-overview) that parses the received security data into a custom table, thus resulting in better performance.
- Version
- 3.0.0
- Declared author / publisher
- Microsoft - support@microsoft.com
- Support tier
- Microsoft
Related content
Links established from declared identifiers and solution manifests.
Source provenance
GitHubDisplayed values come from files in Azure/Azure-Sentinel. They describe the published template, not your workspace configuration.
- Commit
629d1d3↗- Source identifier
azure-sentinel-solution-cortexxpanse
GSTEP / CATALOG TRACKING
Added to catalog : 16 Sept 2026 · 05:49 UTC
Last change observed : 16 Sept 2026 · 05:49 UTC