Palo Alto Cortex

This guide describes how to create API credentials in Palo Alto Cortex XDR and configure the Palo Alto Cortex connector in AiStrike.

Prerequisites

• Administrator access to Cortex XDR, with permission to create and manage API keys.

• Path: Settings → Configurations → Integrations → API Keys.

1. Create an API key

The API key lets AiStrike pull alerts from Cortex XDR.

1. Log in to Cortex XDR as an administrator.

2. Navigate to Settings → Configurations → Integrations → API Keys.

3. Click New Key.

4. Under Security Level, select Standard or Advanced.

   • Use Standard unless your organization requires Advanced keys.

   • AiStrike supports both. The type you select here must match API Key Type in AiStrike.

5. Under Role, select a role that can view alerts. Use a dedicated, least-privilege role rather than a full admin role when possible.

6. (Optional) Add a comment such as AiStrike integration.

7. (Optional) Enable an expiration date if your policy requires it.

8. Click Generate.

9. Copy the API Key and store it securely — it is displayed only once and cannot be retrieved again.

NOTE: Copy the API Key before you close the dialog. You will not be able to view it again.

2. Copy the API Key ID and FQDN

On the API Keys page:

1. Copy the API Key ID for the key you just created.

2. Right-click the key and select View Examples.

3. From the cURL example, copy the tenant FQDN.

The example URL looks like:

https://api-{fqdn}/public_api/v1/{name of api}/{name of call}/

Paste only the FQDN into AiStrike — not https://, not api-, and not /public_api/v1.

3. Connector configuration

If you have any questions or need assistance configuring the integration, please contact the AiStrike team.