Palo Alto XSOAR

Record your Palo Alto XSOAR connection as security automation evidence. Automated collection is not available for this provider yet.

Connect with an API token

1. In Palo Alto XSOAR:

   1. In Cortex XSOAR 8, go to Settings & Info › Settings › Integrations › API Keys and select New Key.
   2. Choose the security level Standard or Advanced.
   3. Assign the least-privileged role available (a custom role with view-only permissions). Optionally set an expiration and a comment.
   4. Select Generate, then copy the API key before closing the notification.

   Where to find the other values:

   • Base URL (optional): Select Copy API URL on the API Keys page; it copies your tenant's API address.
   • Account / Org / Workspace (optional): If an API key ID is needed, it is in the ID column of the API Keys table (sent as the x-xdr-auth-id header).

   Palo Alto XSOAR shows the secret only once, so copy it before you leave the page.

   Same product as Cortex XSOAR (Palo Alto Networks). Steps are for XSOAR 8 SaaS; the key cannot be viewed again after closing the notification.

   Source: cortex-docs.paloaltonetworks.com, checked 2026-10-07.

2. On Compliance › Connectors, open Palo Alto XSOAR, click Connect, choose API token and fill in:

   Field	What to enter
   API token / Personal access token	Required. Stored encrypted and never shown again.
   Base URL (optional)	—
   Account / Org / Workspace (optional)	—

3. Click Connect with token.

Frameworks

No automated compliance test reads Palo Alto XSOAR yet, so no framework lists it. How connectors provide evidence for frameworks: Frameworks and connectors.

Related

• Security Automation connectors
• Compliance connectors: how connecting works, card statuses and multiple accounts
• Connector setup reference: every connector in one table
• Frameworks and connectors: how connectors provide evidence for frameworks