This website uses Cookies. By clicking Accept, you agree to the storing of cookies on your device to enhance your community and translation experience. Read our Privacy Policy.
Click Preferences to customize your cookie settings.
Accept
Reject
Preferences
Buy or Renew
Buy or Renew
Integration Discussions
This forum was created for Palo Alto Networks partners and customers to collaborate on topics related to integrating Palo Alto Networks products.
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Integration Discussions
This forum was created for Palo Alto Networks partners and customers to collaborate on topics related to integrating Palo Alto Networks products.
About Integration Discussions
This forum was established for Palo Alto Networks partners and customers to collaborate on topics related to integration on the Palo Alto Networks products.

To start a new topic, simply click "New Message" below.

Discussions

Start a conversation

Idira and Cortex XSIAM: Partner Integration Framework for Identity Signal Correlation

Partner integration framework for operationalizing identity signals from #Idira (the Palo Alto Networks identity platform, built on the CyberArk acquisition and launched at IMPACT 2026) into #CortexXSIAM for detection and automated response. What the framework covers Technical integration pattern for Idira identity signal ingestion into XSIAM S...

Screenshot 2026-09-09 at 2.42.03 PM.png
vvadwlas by • L2 Linker
  • 222 Views
  • 2 replies
  • 0 Likes

Looking for XSIAM Demisto SDK

Hello everyone!We develop custom integrations for Cortex clients.We have always used the XSOAR Demisto SDK (https://xsoar.pan.dev/docs/reference/api/demisto-class). However, we now need to write integrations for XSIAM, and we suspect that, as XSIAM is a much larger platform than XSOAR, its Demisto SDK will have more features.We can’t find this S...

Cortex Cloud AppSec: Partner Positioning Guide for Managed Service and DevSecOps Integration

Partner-facing positioning reference for the #CortexCloud AppSec capability. Used by partners scoping AppSec into managed Cortex Cloud service offerings and by GSI partners integrating AppSec into DevSecOps program work. What the guide covers AppSec capability areas across the code-to-cloud-to-SOC flow SKU mapping and packaging model considerat...

Screenshot 2026-09-09 at 2.31.19 PM.png

XSOAR and AgentIX: Playbook CU Audit Guide for Consumption Reduction

Step-by-step audit framework for partners reviewing existing #XSOAR and #AgentiX playbooks to reduce Compute Unit consumption as enforcement continues to roll out. What the audit covers Checklist-driven review methodology for existing playbook libraries Common inefficiency patterns - over-invocation of high-cost models, redundant enrichment ste...

Screenshot 2026-09-09 at 2.06.46 PM.png

AgentIX on XSIAM: Compute Unit Optimization Guide for Partners

Operational reference for partners deploying agentic AI capabilities on #CortexXSIAM as #AgentiX CU charging enforcement continues to roll out. What the guide covers CU consumption patterns across system agents and custom agents Model selection strategy - matching model tier to actual detection complexity Prompt efficiency techniques for Agenti...

Screenshot 2026-09-09 at 2.06.46 PM.png

Cortex AES (Koi): Partner Service Integration Guide for MSSP Managed Service Packaging

Field guide to #CortexAES (formerly Koi) and how MSSP partners package managed AES service offerings. Developed with input from the Cortex AES product team. In use with MSSP partners launching AES managed services in the second half of 2026. What the guide covers AES four-layer detection model walkthrough (discovery, preventive policies, runtim...

Screenshot 2026-09-09 at 1.54.16 PM.png

Browser Extension Exfiltration Lab

Companion lab to the MCP Prompt Injection Kill Chain, focused on malicious browser extensions attempting credential exfiltration. What the lab covers Five distinct attack patterns, all inert, walking through how a malicious browser extension attempts credential theft under different technique variations. Each pattern includes XSIAM correlation w...

browser_extension_detection_layers.png

Cortex AES: MCP Prompt Injection Kill Chain - Self-Provisioning Lab for Agentic AI Attack Demonstration

Self-provisioning demonstration lab that walks partners through an end-to-end agentic AI attack scenario and shows how #CortexAES catches the threat across the four-layer detection model. The scenario Tool description mismatch in a Model Context Protocol (MCP) integration leads to credential exfiltration. The lab demonstrates the full kill chain...

mcp_kill_chain_detection_layers.png
vvadwlas by • L2 Linker
  • 109 Views
  • 0 replies
  • 0 Likes

Cortex Portfolio: Partner Opportunity Cockpit - Five-Layer Scoping Surface for First Meetings

First-meeting scoping tool for MSP and GSI partners running discovery conversations with new prospects. Structures the opportunity across the Palo Alto Networks platform - #Strata, #Cortex (including #CortexCloud), and #Idira - using a five-layer cybersecurity taxonomy. What the tool does Five-layer landscape - every PANW product across Strata,...

Screenshot 2026-09-09 at 11.45.44 AM.png

Cortex AES (Koi): AES Compass - Three-Question Routing Tool for Partner Enablement

Lightweight routing tool that surfaces the right #CortexAES (formerly Koi) field enablement resource from a curated library in three questions and about thirty seconds. What the tool does Partners answer three quick questions - role, conversation stage, and biggest gap - and the tool routes to the best-match resource: sizing guide, technical dem...

Screenshot 2026-09-09 at 11.15.19 AM.png

Cloud-to-SOC Reference Implementation - GCP Edition: Self-Provisioning Partner Lab for Cortex

Cloud-to-SOC Reference Implementation - GCP Edition A self-provisioning Google Cloud Platform lab that generates real Cortex Cloud posture, runtime, and identity signals into #XSIAM cases within about an hour of setup. Partners spin up the lab in their own GCP environment as a presales proof surface - no PANW resource required to demonstrate the...

vvadwlas by • L2 Linker
  • 108 Views
  • 1 replies
  • 0 Likes

XSIAM + AgentiX: CU Intelligence Platform for Partner Sizing Conversations

Interactive web tool for sizing Cortex Compute Unit consumption across #XSIAM, #AgentiX, and MSSP multi-tenant deployments. Built from partner field engagement and developed with input from Palo Alto Networks product management. What the tool does Models CU allocation across multiple tenants for MSSPs running downstream customer workloads Proje...

Screenshot 2026-09-09 at 11.02.28 AM.png

Panorama OS 11.2 API: Support for Commit All on a Specific User?

Hey all, I am running a Panorama PAN-OS version 11.2.0 instance that managed two Firewall devices, running PAN-OS 11.1.0 and 11.2.7-hc13 I have a question about committing changes to a given template stack / device group for a specific admin account. Before I commit to the template stacks / device groups / templates, I first make an API call to ...

mattirby_0-1785769206742.png
mattirby_2-1785774099572.png
mattirby_1-1785773990089.png
M.Irby by • L0 Member
  • 205 Views
  • 1 replies
  • 0 Likes

Automating CSV IOC Integration into Cortex XDR

Hi,Currently, we are performing IOC integration manually by importing a CSV file directly into the Cortex XDR console. Is there a capability or best practice to automate this CSV IOC integration? We are looking for ways to automatically fetch and ingest these indicators.Any guidance on using would be greatly appreciated.Thanks in advance!

  • 91 Posts
  • 27 Subscriptions
LEGAL NOTICES
RESOURCES
Khoros awards 2022
Copyright 2007 - 2026 - Palo Alto Networks