canonical: https://jentic.com/apis/paloaltonetworks.com/cortex-xsoar # Palo Alto Networks Cortex XSOAR API Palo Alto Networks Cortex XSOAR (formerly Demisto) is a Security Orchestration, Automation and Response (SOAR) platform. The REST API provides endpoints for managing incidents, indicators of compromise (IOCs), playbooks, integrations, war rooms, evidence, users, roles, investigations, and automation scripts. The API supports incident lifecycle management from creation through investigation, enrichment, remediation, and closure, with playbook execution, indicator enrichment, and evidence tracking. Authentication uses API keys passed in the Authorization header. ## For AI agents Manage Cortex XSOAR incidents, indicators, playbooks, war rooms, evidence, users, and automation scripts for security orchestration and response workflows. ## Scope Does not generate threat intelligence, scan networks, or perform endpoint detection - use for orchestrating multi-tool security workflows, managing incidents, and executing playbooks only. Security data comes from integrated tools like SIEM, EDR, and threat intel feeds. ## Capabilities - Search, create, update, and close security incidents with custom fields and severity - Manage indicators of compromise (IOCs) including IPs, domains, URLs, hashes, and emails - Execute playbooks and automation scripts for incident response workflows - Add evidence, notes, and attachments to incidents and war rooms - Manage war rooms for collaborative incident investigation - Administer users, roles, and permissions for XSOAR access control - Query and manage integrations with third-party security tools - Track investigations and incident timelines ## Use cases ### Automated Incident Creation from SIEM Alerts Automatically create XSOAR incidents from SIEM alerts, threat intelligence feeds, or monitoring systems. POST /incident with name, type, severity, customFields, and labels creates a new incident that triggers playbook execution. This supports workflows where alerts from Splunk, QRadar, or Sentinel are converted into XSOAR incidents for orchestrated response, with deduplication based on alert fingerprints. Example prompt: POST /incident with IncidentCreate payload containing name, type, severity, customFields, and labels to trigger playbook-driven response. ### Indicator Enrichment and Threat Intelligence Enrich security incidents with indicators of compromise (IOCs) by creating or updating indicators via the API. Indicators include IP addresses, domains, URLs, file hashes, and email addresses with reputation scores, threat actor associations, and expiration dates. This supports automated threat intel ingestion from STIX/TAXII feeds, VirusTotal, or custom sources, centralizing IOC data for playbook-driven enrichment. Example prompt: POST /indicators/create with indicator type, value, reputation, and metadata to populate the XSOAR threat intel database. ### Playbook Execution and Orchestration Trigger playbook execution on incidents programmatically to automate investigation and remediation workflows. Playbooks define sequences of actions like enriching IOCs, querying EDR, isolating endpoints, notifying stakeholders, and closing incidents. The API supports starting playbooks, querying their status, and retrieving outputs, enabling external systems to orchestrate XSOAR workflows in response to real-time threats. Example prompt: POST /playbook/execute with incidentId and playbookId to trigger automated response workflows. ### War Room Collaboration and Evidence Tracking Manage war rooms for collaborative incident investigation by adding notes, evidence, and attachments via the API. War rooms aggregate timeline data, analyst comments, IOC lookups, and external tool outputs. POST /entry creates war room entries with markdown-formatted notes, file attachments, or structured evidence like EDR query results. This supports multi-analyst investigations and audit-ready incident documentation. Example prompt: POST /entry with incidentId, contents, and tags to add investigation notes, evidence, or attachments to the war room. ### AI Agent for SOC Automation Let an AI agent handle SOC workflows like creating incidents from alerts, enriching IOCs, executing playbooks, adding analysis notes, and closing incidents with resolution summaries. Through Jentic, the agent searches by intent (e.g., 'create xsoar incident'), loads the schema, and executes with the API key injected securely, enabling conversational security orchestration. Example prompt: Use Jentic search 'create xsoar incident' to find POST /incident, load schema, execute with name, type, severity, and customFields. ## Key endpoints | Method | Path | Description | | --- | --- | --- | | POST | /incident | Create a new incident | | POST | /incidents/search | Search incidents with filters | | POST | /incident/update | Update an incident | | POST | /indicators/create | Create an indicator | | POST | /playbook/execute | Execute a playbook on an incident | | POST | /entry | Add a war room entry | ## Key resources - **Incidents** — Security events requiring investigation and response, with severity, type, status, custom fields, and playbook associations - **Indicators** — Indicators of compromise (IOCs) including IPs, domains, URLs, hashes, emails with reputation and threat intel metadata - **Playbooks** — Automated workflow sequences for incident investigation, enrichment, and remediation - **War Rooms** — Collaborative investigation spaces with notes, evidence, attachments, and timeline data - **Integrations** — Connections to third-party security tools like SIEM, EDR, threat intel, and ticketing systems - **Users and Roles** — XSOAR user accounts and role-based access control ## Why Jentic - **Setup:** Wiring Cortex XSOAR by hand means handling its API-key auth in the Authorization header, pointing at your own XSOAR host, and building your own retry and error handling. Through Jentic you install once, import the Cortex XSOAR API from the API Directory, store the key once, and your agent calls it. - **Permission scoping:** Cortex XSOAR takes incident and indicator targets in the request body rather than the URL path, so limit the agent to the operations it needs, such as creating incidents or searching them. Operations like executing a playbook are not included unless you add them. - **Credential handling:** Your Cortex XSOAR key is stored once, encrypted, by your own Jentic One instance and injected as the Authorization header at execution time. It never enters the agent's prompt, logs, or context. - **Discovery method:** Agents search Jentic by intent such as 'create an XSOAR incident' or 'execute a playbook', and Jentic returns the matching Cortex XSOAR operation with its input schema so the agent calls the right endpoint without browsing the reference docs. ## Related APIs - **Splunk API** — Splunk SIEM generates alerts that are sent to Cortex XSOAR for orchestrated incident response via the API. - **Prisma Cloud CSPM API** — Prisma Cloud CSPM detects cloud security misconfigurations that can trigger XSOAR incidents for automated remediation. ## FAQ ### What authentication does the Cortex XSOAR API use? The Cortex XSOAR API uses API key authentication via the Authorization header. API keys are generated in the XSOAR web interface under Settings > Integrations > API Keys. Through Jentic, keys are stored encrypted and injected at execution time. ### Can I create incidents programmatically with the XSOAR API? Yes. POST /incident with name, type, severity, customFields, and labels creates a new incident. This supports automated incident creation from SIEM alerts, threat intel feeds, and monitoring systems. ### How do I execute a playbook via the XSOAR API? Use POST /playbook/execute with incidentId and playbookId to trigger playbook execution. Playbooks automate investigation and remediation workflows like IOC enrichment, endpoint isolation, and stakeholder notification. ### Does the XSOAR API support indicator management? Yes. The API provides endpoints for creating, updating, and searching indicators of compromise (IOCs) including IPs, domains, URLs, hashes, and emails with reputation scores and threat intel metadata. ### Is the Cortex XSOAR API free? Cortex XSOAR is a commercial SOAR platform from Palo Alto Networks with various licensing tiers. The API is included with XSOAR licenses. Contact Palo Alto Networks for pricing details. ### Can I add evidence to incidents via the API? Yes. Use POST /entry with incidentId, contents, and tags to add notes, evidence, or attachments to incident war rooms. This supports collaborative investigation and audit-ready documentation. ### Can I limit what my agent is allowed to do with the Cortex XSOAR API? Yes. Because you run Jentic One yourself, your own rules decide which Cortex XSOAR operations and credentials the agent may use. Since XSOAR takes incident and indicator targets in the request body rather than the URL path, you scope the agent to the specific operations it needs, such as creating incidents with POST /incident or searching them with POST /incidents/search. Higher-impact operations like executing a playbook with POST /playbook/execute stay off limits unless you explicitly grant them.