Cortex XSOAR API

Name: Cortex XSOAR API API
Brand: Cortex XSOAR API
Availability: InStock

✓ Official Vendor SpecSecuritySoarapiKey27 EndpointsREST

For Agents

Manage Cortex XSOAR incidents, indicators, playbooks, war rooms, evidence, users, and automation scripts for security orchestration and response workflows.

Connect the Cortex XSOAR API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Cortex XSOAR API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Install Jentic One Beta (Self-Hosted)

Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Cortex XSOAR API API.

Search, create, update, and close security incidents with custom fields and severity

Manage indicators of compromise (IOCs) including IPs, domains, URLs, hashes, and emails

Execute playbooks and automation scripts for incident response workflows

Add evidence, notes, and attachments to incidents and war rooms

GET STARTED

Start building with Cortex XSOAR API API

Explore with Jentic

View OpenAPI Document

Use for: Create a new security incident in XSOAR, Search for incidents by severity or status, Add an indicator of compromise to XSOAR, Execute a playbook on an incident

Not supported: Does not generate threat intelligence, scan networks, or perform endpoint detection — use for orchestrating multi-tool security workflows, managing incidents, and executing playbooks only. Security data comes from integrated tools like SIEM, EDR, and threat intel feeds.

Palo Alto Networks Cortex XSOAR (formerly Demisto) is a Security Orchestration, Automation and Response (SOAR) platform. The REST API provides endpoints for managing incidents, indicators of compromise (IOCs), playbooks, integrations, war rooms, evidence, users, roles, investigations, and automation scripts. The API supports incident lifecycle management from creation through investigation, enrichment, remediation, and closure, with playbook execution, indicator enrichment, and evidence tracking. Authentication uses API keys passed in the Authorization header.

Use Cases

Patterns agents use Cortex XSOAR API API for, with concrete tasks.

★ Automated Incident Creation from SIEM Alerts

Automatically create XSOAR incidents from SIEM alerts, threat intelligence feeds, or monitoring systems. POST /incident with name, type, severity, customFields, and labels creates a new incident that triggers playbook execution. This supports workflows where alerts from Splunk, QRadar, or Sentinel are converted into XSOAR incidents for orchestrated response, with deduplication based on alert fingerprints.

POST /incident with IncidentCreate payload containing name, type, severity, customFields, and labels to trigger playbook-driven response.

Indicator Enrichment and Threat Intelligence

Enrich security incidents with indicators of compromise (IOCs) by creating or updating indicators via the API. Indicators include IP addresses, domains, URLs, file hashes, and email addresses with reputation scores, threat actor associations, and expiration dates. This supports automated threat intel ingestion from STIX/TAXII feeds, VirusTotal, or custom sources, centralizing IOC data for playbook-driven enrichment.

POST /indicators/create with indicator type, value, reputation, and metadata to populate the XSOAR threat intel database.

Playbook Execution and Orchestration

Trigger playbook execution on incidents programmatically to automate investigation and remediation workflows. Playbooks define sequences of actions like enriching IOCs, querying EDR, isolating endpoints, notifying stakeholders, and closing incidents. The API supports starting playbooks, querying their status, and retrieving outputs, enabling external systems to orchestrate XSOAR workflows in response to real-time threats.

POST /playbook/execute with incidentId and playbookId to trigger automated response workflows.

War Room Collaboration and Evidence Tracking

Manage war rooms for collaborative incident investigation by adding notes, evidence, and attachments via the API. War rooms aggregate timeline data, analyst comments, IOC lookups, and external tool outputs. POST /entry creates war room entries with markdown-formatted notes, file attachments, or structured evidence like EDR query results. This supports multi-analyst investigations and audit-ready incident documentation.

POST /entry with incidentId, contents, and tags to add investigation notes, evidence, or attachments to the war room.

AI Agent for SOC Automation

Let an AI agent handle SOC workflows like creating incidents from alerts, enriching IOCs, executing playbooks, adding analysis notes, and closing incidents with resolution summaries. Through Jentic, the agent searches by intent (e.g., 'create xsoar incident'), loads the schema, and executes with the API key injected securely, enabling conversational security orchestration.

Use Jentic search 'create xsoar incident' to find POST /incident, load schema, execute with name, type, severity, and customFields.

Key Endpoints

27 endpoints — palo alto networks cortex xsoar (formerly demisto) is a security orchestration, automation and response (soar) platform.

METHOD

PATH

DESCRIPTION

POST

/incident

Create a new incident

POST

/incidents/search

Search incidents with filters

POST

/incident/update

Update an incident

POST

/indicators/create

Create an indicator

POST

/playbook/execute

Execute a playbook on an incident

POST

/entry

Add a war room entry

POST

/incident

Create a new incident

POST

/incidents/search

Search incidents with filters

POST

/incident/update

Update an incident

POST

/indicators/create

Create an indicator

POST

/playbook/execute

Execute a playbook on an incident

POST

Why though Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Cortex XSOAR API keys are stored encrypted in the Jentic vault and injected as the Authorization header at execution time. Raw keys never appear in agent prompts, transcripts, or response payloads.

Intent-based discovery

Agents search by intent such as 'create xsoar incident' or 'execute xsoar playbook' and Jentic returns the matching endpoint with its schema and required parameters.

Time to first call

Direct Cortex XSOAR integration: 2-4 days to model incidents, indicators, playbooks, and war rooms. Through Jentic: under 1 hour — search, load schema, execute.

Related APIs

Alternatives and complements available in the Jentic catalogue.

Complementary

Splunk API

Splunk SIEM generates alerts that are sent to Cortex XSOAR for orchestrated incident response via the API.

Use Splunk for log aggregation and correlation; use XSOAR to orchestrate multi-tool response workflows triggered by Splunk alerts.

Complementary

Prisma Cloud CSPM API

Prisma Cloud CSPM detects cloud security misconfigurations that can trigger XSOAR incidents for automated remediation.

Use Prisma Cloud for cloud posture management and XSOAR to orchestrate remediation playbooks across cloud providers.

FAQs

Specific to using Cortex XSOAR API API through Jentic.

What authentication does the Cortex XSOAR API use?

The Cortex XSOAR API uses API key authentication via the Authorization header. API keys are generated in the XSOAR web interface under Settings > Integrations > API Keys. Through Jentic, keys are stored encrypted and injected at execution time.

Can I create incidents programmatically with the XSOAR API?

Yes. POST /incident with name, type, severity, customFields, and labels creates a new incident. This supports automated incident creation from SIEM alerts, threat intel feeds, and monitoring systems.

How do I execute a playbook via the XSOAR API?

Use POST /playbook/execute with incidentId and playbookId to trigger playbook execution. Playbooks automate investigation and remediation workflows like IOC enrichment, endpoint isolation, and stakeholder notification.

Does the XSOAR API support indicator management?

Yes. The API provides endpoints for creating, updating, and searching indicators of compromise (IOCs) including IPs, domains, URLs, hashes, and emails with reputation scores and threat intel metadata.

Is the Cortex XSOAR API free?

Cortex XSOAR is a commercial SOAR platform from Palo Alto Networks with various licensing tiers. The API is included with XSOAR licenses. Contact Palo Alto Networks for pricing details.

Can I add evidence to incidents via the API?

Yes. Use POST /entry with incidentId, contents, and tags to add notes, evidence, or attachments to incident war rooms. This supports collaborative investigation and audit-ready documentation.