Cortex XDR (Palo Alto Networks)

Connect your own Palo Alto Networks Cortex XDR tenant (Standard API key + key ID + tenant FQDN), verifying the credentials with a real call before saving.

List connected Cortex XDR tenants.

Disconnect a Cortex XDR tenant, removing its stored API key.

List incidents on the connected Cortex XDR tenant, optionally filtered by status.

Read one Cortex XDR incident in full, including its related alerts.

Update an existing Cortex XDR incident's status, assignee, or severity. A resolve_comment is required when status starts with 'resolved'.

List alerts on the connected Cortex XDR tenant, optionally restricted to one incident.

List endpoints (hosts) enrolled in the connected Cortex XDR tenant.

Isolate an endpoint from the network -- cuts almost all network access immediately except the Cortex XDR agent channel. Use only for active threat containment.

Restore an isolated endpoint's normal network access.

Trigger an on-demand malware scan on one or more endpoints.

List custom Indicators (IOCs) configured on the connected Cortex XDR tenant.

Create a custom Indicator (IOC) on the connected Cortex XDR tenant to flag or block a hash, IP, domain, or path fleet-wide.

Remove a custom Indicator (IOC) from the connected Cortex XDR tenant.

List scripts available in the connected Cortex XDR tenant's Action Center library.

Run an approved Action Center script against one or more endpoints -- executes real code on live hosts, use with care.

Read the per-endpoint results of a previously run Action Center script by its action_id.

Build one aggregated health report across the connected Cortex XDR tenant: open incidents by severity, unassigned High/Critical incidents, and disconnected endpoints.