{
  "Name": "Cortex XDR",
  "Author": "Microsoft",
  "Logo": "<img src=\"https://raw.githubusercontent.com/Azure/Azure-Sentinel/master/Logos/CortexXDR_Logo.svg\" width=\"75px\" height=\"75px\">",
  "Description": "The [Palo Alto Networks](https://www.paloaltonetworks.com/) Cortex XDR Microsoft Sentinel Solution pulls log directly from the Cortex XDR platform via API. The solution is configured to pull the Incidents from the Cortex XDR platform every 5 minutes and ingest them into Microsoft Sentinel. The solution is dependent on the Cortex XDR API Key and API Key ID. The API Key ID is used as the polling key path and the API Key is used as the header for the API request. The solution also includes 3 analytics rules to detect the creation of incidents based on the severities (High, Medium, Low).",
  "Analytic Rules": [
    "Analytic Rules/CortexXDR_High.yaml",
    "Analytic Rules/CortexXDR_Medium.yaml",
    "Analytic Rules/CortexXDR_Low.yaml"
  ],
  "Parsers":[
    "Parsers/PaloAltoCortexXDR.yaml"
  ],
  "Data Connectors": [
    "Data Connectors/CortexXDR_ccp/DataConnectorDefinition.json",
    "Data Connectors/CortexXDR_DataConnector.json"
    ],
  "BasePath": "C:\\GitHub\\Azure-Sentinel\\Solutions\\Cortex XDR",
  "Version": "3.0.0",
  "Metadata": "SolutionMetadata.json",
  "TemplateSpec": false,
  "Is1PConnector": false
}