Idira and Cortex XSIAM: Partner Integration Framework for Identity Signal Correlation

[vvadwlas]

Partner integration framework for operationalizing identity signals from #Idira (the Palo Alto Networks identity platform, built on the CyberArk acquisition and launched at IMPACT 2026) into #CortexXSIAM for detection and automated response.

What the framework covers

• Technical integration pattern for Idira identity signal ingestion into XSIAM
• Service packaging models for partner delivery - standalone, bundled with managed SOC, integrated into IR services
• Partner delivery model across the three Palo Alto Networks core platforms (Strata, Cortex, Idira)
• Common identity signal use cases - privileged access anomaly detection, service account behavior monitoring, identity-driven attack path correlation
• Integration architecture patterns for MSSP and GSI motions
  
  Idira and Cortex XSIAM: Partner Integration Framework for Identity Signal Correlation
  

Developed with input from

Idira product team and BDM counterparts. Scoped with pilot partners for the second half of 2026.

Who uses it

Partners building identity-integrated managed SOC offerings, GSI partners integrating identity signal into broader security program work, and MSSP partners scoping Idira into existing Cortex managed services.

Access

#links See Attachments

InfoSec cleared for partner distribution.

Feedback

Comments and feedback welcome below.

#Idira #CyberArk #Cortex XSIAM #Identity #Partner Enablement Integration

Note
For the most current version of this resource, contact the author directly via LIVEcommunity direct message.

[larson096vikky]

Hello,

This is a very well-structured and valuable framework. I really appreciate the clarity around the integration patterns, partner delivery models, and the practical identity-driven use cases for Cortex XSIAM. The alignment across Idira, Cortex, and Strata, along with the MSSP/GSI perspectives, makes this particularly relevant for partners looking to operationalize identity signals within their existing SOC and IR services. Great work by everyone involved, and looking forward to seeing how this evolves through the pilot phase in H2 2026.

[vvadwlas]

Thank you for reading closely and for the thoughtful feedback. The identity-driven use cases were the section I spent the most time on because that is where I think the operational leverage actually sits for partners integrating Cortex Xsiam and Idira - and the H2 2026 pilot phase is exactly where those patterns get tested against production reality. If the pilot surfaces something worth iterating on in the framework, I would welcome your continued input.