Cortex XSOAR (API) | AiStrike Documentation

This guide explains how to configure Cortex XSOAR to allow AiStrike to connect via the XSOAR REST API. AiStrike can pull incidents, create incidents, update incident fields and statuses, add notes to war rooms, and optionally trigger playbooks — all authenticated via a dedicated API key scoped to a least-privilege role.◼︎

Overview

The integration uses a dedicated AiStrike service user and role inside XSOAR, authenticated via an API key. This avoids tying integration access to individual user accounts and ensures AiStrike has only the permissions it needs.

The configuration involves five steps, completed in order:

Create a dedicated AiStrike role with scoped permissions.
Create a dedicated AiStrike service user.
Assign the role to the user.
Generate an API key scoped to the AiStrike role.
Configure the connection in AiStrike.

Prerequisites

Before starting, ensure you have:

Administrator access to your Cortex XSOAR tenant.
An AiStrike account with Integrations access.
Your XSOAR instance URL (e.g. https://your-xsoar.company.com or your XSOAR Cloud tenant URL).

XSOAR Version Note

Navigation paths may differ slightly between XSOAR 6.x (on-prem), XSOAR 8 (on-prem), and XSOAR Cloud/SaaS. Steps in this guide follow XSOAR 8 / Cloud navigation. For XSOAR 6.x, Settings is accessed from the top navigation bar.

Step 1 — Create the AiStrike Role

Create a dedicated role that grants AiStrike the minimum permissions required for the integration. Using a scoped role rather than Administrator follows the principle of least privilege.

Settings & Info > Settings > Users & Roles > Roles

Steps

Navigate to Settings & Info > Settings > Roles.
Click + New Role.
Enter the Role Name — recommended: AiStrike_Integration.
Configure permissions using the table below.
Optional: in the Advanced tab, define a default dashboard or shift period. This is not required for the AiStrike integration.
Click Save.

Required Permissions

Grant the following permissions. All others can remain off.

Permission Category	Specific Permission	Required / Optional	Used For
Incidents	View incidents	Required	Pull incidents
Incidents	Create incidents	Required	Create incidents
Incidents	Edit incidents	Required	Update status / fields
Incidents	Add incident notes / comments	Required	War room notes
Incidents	Assign incidents	Required	If AiStrike assigns
Incidents	Close incidents	Required	If AiStrike closes
Playbooks	View / execute playbooks	Optional	If triggering playbooks
Dashboards	View dashboards	Optional	Metrics access

Least Privilege

Start with only the Required permissions above. Add optional permissions only when a specific AiStrike use-case requires them.

Step 2 — Create the AiStrike Service User

Create a dedicated user account for AiStrike. This should be a service account not tied to any individual employee, so that the integration remains active even when team members change.

Settings & Info > Settings > Users & Roles > Users > + New User

Steps

Navigate to Settings & Info > Settings > Users.
Click + New User.
Complete the form using the field reference below.
Click Save.

User Configuration Fields

Field	Recommended Value	Notes
Username	aistrike_integration	Use consistent naming across all integrations
Full Name	AiStrike Integration
Email	aistrike@yourdomain.com	Use a shared mailbox, not a personal address
Role	AiStrike_Integration (created in Step 1)	Assign via the Roles field
Password	Strong auto-generated password	Store in a secrets vault — never plain email
User Type	Regular user	Do not grant Administrator
Multi-factor Auth	Disabled for this service account	MFA will block API key authentication — disable or create an exemption

Important — Disable MFA on the Service Account

Multi-factor authentication (MFA) will block API key authentication if enabled. When creating the AiStrike integration user, ensure MFA is not enforced on this account. If your XSOAR policy enforces MFA globally, create a service account exemption.

Step 3 — Assign the Role to the AiStrike User

There are two ways to assign the AiStrike role to the user. The User Group method is recommended for production environments.

Option A — Direct Assignment

Navigate to Settings & Info > Settings > Users.
Click the AiStrike integration user.
In the Roles field, select AiStrike_Integration.
Click Save.

Option B — Via User Group (Recommended)

Navigate to Settings & Info > Settings > User Groups.
Click + New Group. Enter a name such as AiStrike_ServiceAccounts.
In the Roles section, add the AiStrike_Integration role.
In the Members section, add the AiStrike integration user.
Click Save.

Why User Groups?

User Groups make it easy to manage permissions for multiple service accounts consistently, and to audit access independently of individual user accounts.

Step 4 — Create a New API Key

The API key is what AiStrike uses to authenticate every request to your XSOAR instance. The key is shown only once — copy it immediately after generation.

Settings & Info > Settings > Integrations > API Keys > + New Key

Steps

Navigate to Settings & Info > Settings > Integrations > API Keys.
Click + New Key.
Choose the API key type:
- Standard (Required) — key is sent directly in the Authorization header. Compatible with curl and most HTTP clients. Recommended for most AiStrike deployments.
- Advanced — key is hashed using a nonce, random string, and timestamp to prevent replay attacks. Note: Advanced keys require a script-based authentication flow; plain curl is not supported.
Optional — enable an expiration date:
- Mark Enable Expiration Date and select the expiration date and time.
- XSOAR will send an API Key Expiration notification in the Notification Center one week and one day before expiry.
- Set a calendar reminder 30 days before expiry to regenerate the key and update the AiStrike configuration before it expires.
In the Comment field, enter: AiStrike Integration Key — [date generated].
In the Role field, select the AiStrike_Integration role created in Step 1.
Click Generate Key.
Copy the full key Value immediately and store it in a password manager or secrets vault.
Click Done / Close.

Copy the Key Now — This Is Your Only Opportunity

XSOAR displays the API key value exactly once, at the moment of generation. Once you click Done or navigate away, the value cannot be retrieved. Do NOT copy the Key ID — you need the Value (the long alphanumeric string). If you lose it, delete the key and generate a new one.

Step 5 — Configure the Integration in AiStrike

With your API key generated, complete the connector setup in the AiStrike console.

Log in to your AiStrike portal.
Navigate to Integrations and search for Cortex XSOAR.
Select Cortex XSOAR and click Add Integration.
Enter the configuration details from the table below.
Click Connect to test and save the integration.
Contact your AiStrike Customer Success Manager to confirm ingestion is healthy and review the first data window.

Configuration Fields

Field	Description / Where to Find It	Required	Example
Connector Name	A friendly label for this integration (for display in AiStrike only)	Required	XSOAR Prod
XSOAR URL	The base URL of your XSOAR instance, without a trailing slash	Required	https://xsoar.co.com
API Key	The full Value copied in Step 4. This is the long alphanumeric string, not the Key ID.	Required	abc123...xyz
API Key Type	Standard or Advanced — must match the type selected in Step 4.	Required	Standard
Tenant / Account ID	Required for multi-tenant XSOAR environments. Found in XSOAR instance settings.	If multi-tenant

What AiStrike Can Do via This Integration

Once configured, AiStrike can perform the following actions against your XSOAR instance, subject to the permissions assigned in Step 1.

Capability	Description	Permission Required
Pull incidents	Ingest XSOAR incidents into AiStrike for enrichment and correlation	View incidents
Create incidents	Create new incidents in XSOAR from AiStrike detections or alerts	Create incidents
Update incident status	Change status (e.g. Active, Resolved, Closed) from within AiStrike	Edit incidents
Add notes / comments	Post investigation notes or enrichment findings into XSOAR war rooms	Add incident notes
Assign incidents	Assign XSOAR incidents to analysts from AiStrike	Assign incidents (optional)
Trigger playbooks	Invoke XSOAR playbooks from AiStrike response workflows	Execute playbooks (optional)
Close incidents	Close XSOAR incidents from AiStrike on resolution	Close incidents (optional)

Support

If you encounter issues not covered in this guide, contact the AiStrike team:

Enterprise customers — contact your AiStrike Customer Success Manager.
When contacting support, please have ready: your XSOAR instance URL, the API key type in use, your XSOAR version, and a description of the error or behaviour observed.