Sending cases of MDR Unit 42 Managed Services cortex XDR to tickiting system

A.BELKAHLA — Wed, 05 Aug 2026 14:16:19 GMT

Hello,

I hope you all doing well, i want to send case investigated by MDR to our internal tickiting system (regardless of it, the importing that it support API, webhook ...).

Can you please share a refference or documentation on how to do it on cortex side, and the configuration i need to deploy on Cortex XDR.

Best regards,

Re: Sending cases of MDR Unit 42 Managed Services cortex XDR to tickiting system

susekar — Wed, 05 Aug 2026 14:34:59 GMT

Hello @A.BELKAHLA ,

Greetings for the day.

To send incidents investigated by Cortex XDR (and the MDR team) to your internal ticketing system, you can use the Cortex XDR Public API.

Cortex XDR Public API

If your ticketing system retrieves incidents instead of receiving them, use the Cortex XDR Public API.

Useful API endpoints:

POST /incidents/get_incidents/ – Retrieves incidents based on filters.
POST /incidents/get_incident_extra_data/ – Retrieves detailed information for a specific incident.

To use the API, generate an API Key and API Key ID under:

Settings → Configurations → Integrations → API Keys

Ensure the API key has the required permissions, such as Security Admin or Instance Administrator.

For additional details, refer to:

Cortex XDR API Reference: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-5.x-Documentation/Cortex-XDR-API-Reference
Data and Log Forwarding: https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-5.x-Documentation/Data-and-log-forwarding

If you feel this has answered your query, please let us know by clicking like and on "mark this as a Solution".

Thanks & Regards,
S. Subashkar Sekar

topic Sending cases of MDR Unit 42 Managed Services cortex XDR to tickiting system in Cortex XDR Discussions

Sending cases of MDR Unit 42 Managed Services cortex XDR to tickiting system

Re: Sending cases of MDR Unit 42 Managed Services cortex XDR to tickiting system

Cortex XDR Public API