canonical: https://jentic.com/apis/paloaltonetworks.com

# Palo Alto Networks APIs

Palo Alto Networks provides cloud and security operations platforms accessible through two APIs on Jentic. The Prisma Cloud CSPM API monitors cloud security posture, compliance, and asset inventory across AWS, Azure, and GCP, while the Cortex XSOAR API drives security orchestration, incident management, and playbook automation. Together they let agents detect cloud misconfigurations and orchestrate the response.

## For AI agents

An agent can query cloud security alerts, check compliance posture against frameworks like CIS and PCI-DSS, and inventory multi-cloud assets through Prisma Cloud, then create incidents, enrich indicators, and execute response playbooks through Cortex XSOAR. This lets one agent move from detecting a cloud risk to orchestrating its remediation.

## Scope

Use for: Monitoring multi-cloud security posture and compliance with Prisma Cloud and orchestrating incident response and playbooks with Cortex XSOAR

Not supported:
- endpoint detection
- network firewall management
- vulnerability scanning
- threat intelligence generation
- application-layer security

## APIs

| API | Category | Endpoints | Description |
| --- | --- | --- | --- |
| Prisma Cloud CSPM API | security | 91 | Query cloud security alerts, check compliance posture, manage security policies, and inventory multi-cloud assets across AWS, Azure, and GCP through Palo Alto Networks' Prisma Cloud CSPM platform. |
| Cortex XSOAR API | security | 27 | Manage Cortex XSOAR incidents, indicators, playbooks, war rooms, evidence, users, and automation scripts for security orchestration and response workflows. |

## Which API to use

| Need | API | Why |
| --- | --- | --- |
| Detect cloud misconfigurations and compliance drift | prisma-cloud-cspm-api | Prisma Cloud CSPM queries alerts, compliance posture, and asset inventory across AWS, Azure, and GCP. |
| Orchestrate incident response and playbooks | cortex-xsoar-api | Cortex XSOAR manages incidents, indicators, war rooms, and playbook execution for SOAR workflows. |
| Track security work in incidents and war rooms | cortex-xsoar-api | Cortex XSOAR owns incident records, evidence, and analyst collaboration; Prisma Cloud only produces the findings. |

## Cross-API use cases

### Cloud finding to orchestrated response

An agent pulls a high-severity misconfiguration or compliance failure from Prisma Cloud, then opens a Cortex XSOAR incident and runs a remediation playbook. This connects cloud detection to an auditable response workflow without an analyst copying alert details by hand.

Example prompt: List open high-severity alerts via Prisma Cloud GET /alert, then create a Cortex XSOAR incident with POST /incident and trigger a playbook with POST /playbook/execute.

### Compliance drift into SOC tracking

An agent checks compliance posture against a framework like CIS or PCI-DSS in Prisma Cloud, and for each failing standard creates a tracked Cortex XSOAR incident with the failing resources attached as evidence. This gives compliance findings a documented owner and timeline.

Example prompt: Retrieve posture via Prisma Cloud GET /compliance/posture, then for failing standards create incidents with POST /incident and attach findings via POST /entry.

### Enrich cloud alerts with indicators

An agent triages Prisma Cloud alerts tied to anomalous activity, then records the associated IPs, domains, and hashes as indicators of compromise in Cortex XSOAR for playbook-driven enrichment. This links cloud posture data to the threat intel used across investigations.

Example prompt: Fetch alert detail via Prisma Cloud GET /alert/{id}, then create matching indicators in Cortex XSOAR with POST /indicators/create.

## Why Jentic

- **Setup:** Wiring these APIs by hand means handling two different auth models, Prisma Cloud's bearer token with regional host selection and Cortex XSOAR's Authorization-header key against your own host, plus your own retry and error handling. With Jentic you install once, add each Palo Alto Networks API from the Jentic directory, store each credential once, and your agent calls both.
- **Permission scoping:** Your own rules decide which operations each API exposes to the agent. You can let it read Prisma Cloud alerts and compliance posture while withholding cloud-account onboarding, and let it create Cortex XSOAR incidents while withholding playbook execution, so higher-impact actions are added only when you choose.
- **Credential handling:** Your Prisma Cloud access key and your Cortex XSOAR API key are each stored once, encrypted, by your own Jentic One instance and injected at execution time. Neither credential enters the agent's prompt, logs, or context.
- **Discovery method:** An agent searches Jentic by intent such as 'check cloud compliance posture' or 'create an xsoar incident', and Jentic returns the matching Prisma Cloud or Cortex XSOAR operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related vendors

- **CrowdStrike** — Adds endpoint detection and host containment that complements Prisma Cloud's cloud posture and XSOAR's orchestration.
- **Splunk** — SIEM log aggregation and correlation that can feed alerts into Cortex XSOAR for orchestrated response.
- **Tenable** — Vulnerability scanning and host assessment that pairs with cloud-native misconfiguration detection.

## FAQ

### What can an agent do across the Palo Alto Networks APIs on Jentic?

An agent can detect cloud security issues with Prisma Cloud CSPM, covering alerts, compliance posture, and multi-cloud asset inventory, and then orchestrate the response with Cortex XSOAR, covering incidents, indicators, war rooms, and playbooks. The two APIs let one agent go from finding a cloud risk to running an automated response.

### Do the two APIs share one set of credentials?

No. Prisma Cloud CSPM authenticates with a bearer token derived from an access key and secret, while Cortex XSOAR uses an API key in the Authorization header pointed at your own XSOAR host. Each API is added and credentialed separately in your Jentic One instance.

### When should I use Prisma Cloud CSPM versus Cortex XSOAR?

Use Prisma Cloud CSPM to find and assess cloud misconfigurations, compliance drift, and asset risk across AWS, Azure, and GCP. Use Cortex XSOAR when you need to open incidents, enrich indicators, collaborate in war rooms, or run playbooks in response to those findings.

### Can I connect a cloud finding to an automated response?

Yes. An agent can read a high-severity alert or compliance failure from Prisma Cloud, then create a Cortex XSOAR incident and execute a playbook to remediate it. This is the main cross-API pattern for the Palo Alto Networks portfolio on Jentic.

### Are these APIs free to use?

Both Prisma Cloud and Cortex XSOAR are commercial Palo Alto Networks products with licensing tiers, and the APIs are included with those licenses. Contact Palo Alto Networks for pricing. Jentic provides the integration layer, not the underlying subscriptions.

### What kinds of security work fall outside these two APIs?

These APIs cover cloud posture and orchestration, not endpoint detection, network firewall management, vulnerability scanning, or application-layer security. Security data feeding XSOAR often comes from separate integrated tools like SIEM, EDR, and threat intel feeds.