Palo Alto Cortex XDR — Integration Setup

Prerequisites

Cortex XDR tenant (Pro or equivalent, with the public API enabled)
Cortex XDR admin access to generate API keys
CMDash Essentials tier or above

Step 1: Generate an API Key

Log in to the Cortex XDR console.
Go to Settings → Configurations → API Keys.
Click New Key.
Security level: Standard is sufficient for CMDash's read-only sync (a Standard key sends the raw key value; an Advanced key requires request signing, which this integration does not perform).
Role: assign a read-only role scoped to Incident Management and Endpoint Administration (or your org's equivalent read-only role).
Copy the generated API Key and note the Key ID shown alongside it.
From Settings → Configurations → API Keys, also copy your tenant's FQDN (e.g., https://api-<tenant>.xdr.us.paloaltonetworks.com).

Step 2: Connect in CMDash

Navigate to Integrations in your CMDash dashboard.
Find Palo Alto Cortex XDR and click Connect.
Enter:
- API Key (stored as this connection's access token)
- API Key ID
- FQDN (defaults to https://api-default.xdr.us.paloaltonetworks.com if left blank — override this with your tenant's actual FQDN)
Click Save & Test Connection.

What Syncs

Data Type	Cortex XDR API	Sync Frequency
Incidents (last 24 hours, or since the last sync if that was longer ago, up to 30 days; up to 10,000)	`POST /public_api/v1/incidents/get_incidents`	Every 4 hours by default (configurable per connection)
Endpoints (up to 20,000)	`POST /public_api/v1/endpoints/get_endpoint`	Every 4 hours by default (configurable per connection)

Both calls are followed page by page (Cortex XDR returns at most 100 rows per request) until the vendor's own total_count is reached. Incidents are filtered to those created in the last 24 hours, or since the last successful sync when that was longer ago (never more than 30 days), and sorted newest-first. A hard ceiling of 10,000 incidents and 20,000 endpoints per sync bounds the walk; if it is reached, or a later page fails, the sync is recorded as Partial with a warning on the connection instead of Healthy, and the inventory is known to be incomplete.

Troubleshooting

401 Unauthorized: Verify the API Key and Key ID match — Cortex XDR rejects a Standard key if the x-xdr-auth-id header doesn't correspond to the key that generated it.
403 Forbidden: The API key's assigned role does not include Incident Management or Endpoint Administration read permissions.
Connecting to the wrong tenant: Double-check the FQDN field — CMDash defaults to api-default.xdr.us.paloaltonetworks.com, which is almost never your actual tenant URL.
Empty incident list: The adapter only looks back 24 hours; if nothing new triggered in Cortex XDR during that window, an empty result is expected, not an error.

Rate Limits & Sync Behavior

Setting	Value
Sync frequency	Every 4 hours by default (`syncInterval` is configurable per connection)
First sync	Endpoint inventory pulled immediately (up to 20,000); incidents limited to the trailing 24-hour window even on first sync
Rate limit handling	Every outbound request is paced through CMDash's shared per-tenant token bucket for this provider, and a vendor `429` (with its `Retry-After`) holds that tenant's budget until the vendor says it is ready (#507)
Failed sync retry	Job queue retries 3 times with exponential backoff (starting at 30s) — see docs/developers/dead-letter.md

Credential Rotation

Cortex XDR Standard API keys do not expire automatically. CMDash recommends rotating them on the same cadence as your other privileged API credentials (quarterly is a reasonable default).

To rotate:

In the Cortex XDR console, generate a new Standard API key (Settings → Configurations → API Keys → New Key).
Copy the new API Key and Key ID.
In CMDash: Settings → Integrations → Palo Alto Cortex XDR → Edit.
Enter the new API Key and Key ID, then Save.
Once confirmed healthy, revoke the old key in the Cortex XDR console.

Note: Cortex XDR API keys have no expiry metadata exposed to CMDash, so the 30-day expiry warning banner is not shown for this integration.

Multiple Instances / Multi-Site

If your organization operates more than one Cortex XDR tenant (e.g., separate tenants per business unit or region), each tenant requires its own CMDash connection with its own FQDN, API Key, and Key ID.

To add another tenant:

Generate an API key in the additional Cortex XDR tenant, following Step 1.
In CMDash: Settings → Integrations → Add Integration → Palo Alto Cortex XDR.
Enter the credentials and FQDN for the additional tenant.
Give the connection a descriptive name (e.g., Cortex XDR - EMEA, Cortex XDR - Corp).
Click Save & Test Connection.

Compliance Framework Coverage

The Cortex XDR integration provides evidence for the following controls. Coverage is automatically mapped when data is synced.

Framework	Control	Description
PCI DSS	10.2	Event log monitoring — Cortex XDR incident data mapped to log review evidence
PCI DSS	11.5	Intrusion detection — XDR incidents mapped to IDS/IPS evidence
HITRUST	09.ab	Monitoring system use — endpoint telemetry and incident data
CMMC L2	SI.1.210	System monitoring — continuous endpoint monitoring via Cortex agents
SOC 2	CC7.1	Threat detection — Cortex XDR incidents feed the threat-detection evidence bucket