{"templateId":"markdown","sharedDataIds":{"sidebar":"sidebar-sidebars.yaml"},"props":{"metadata":{"markdoc":{"tagList":[]},"type":"markdown"},"seo":{"title":"Palo Alto Cortex XDR Integration","description":"Control the power of AI Agents in runtime.","llmstxt":{"hide":false,"sections":[{"title":"Table of contents","includeFiles":["**/*"],"excludeFiles":[]}],"excludeFiles":[]}},"dynamicMarkdocComponents":[],"compilationErrors":[],"ast":{"$$mdtype":"Tag","name":"article","attributes":{},"children":[{"$$mdtype":"Tag","name":"Heading","attributes":{"level":1,"id":"palo-alto-cortex-xdr-integration","__idx":0},"children":["Palo Alto Cortex XDR Integration"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Connect your Palo Alto Cortex XDR tenant to Capsule Security to inventory your managed endpoints and discover the AI coding agents and AI apps in use across them."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"overview","__idx":1},"children":["Overview"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["This integration uses the Cortex XDR public API to sync:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Devices"]}," - Endpoint inventory from the Endpoints API (hostnames, OS type and version, agent version, IP addresses, signed-in users, groups, last-seen time)"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AI coding agents"]}," - Claude Code, Cursor, GitHub Copilot, Codex, Gemini CLI, Windsurf, and similar developer agents detected from process-launch telemetry"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AI apps"]}," - Browser and web-app usage of AI services, detected from network and DNS telemetry"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Device inventory comes from the synchronous Endpoints list. Shadow-AI detection comes from two XQL queries run over a rolling window that advances from a saved checkpoint. Capsule connects with a read-only API key and never installs software on endpoints or writes to your Cortex tenant."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"prerequisites","__idx":2},"children":["Prerequisites"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Before you begin, ensure you have:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["An active ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Cortex XDR Pro"]}," deployment with endpoints reporting to the tenant"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Access to create an ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API key"]}," in the Cortex console and assign it a read-only role (",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Viewer"]},")"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Your tenant-specific ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API URL"]}," (e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://api-acme.xdr.us.paloaltonetworks.com"]},")"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["A ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule Security"]}," account with admin access"]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Required - XQL query quota."]}," Runtime detection of AI agents and AI apps runs on XQL, which requires a ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Cortex XDR Pro per Endpoint"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Pro per TB"]}," license and consumes your tenant's query quota. Capsule issues ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["12 XQL queries per day"]},", plus 14 on the first sync - see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#query-volume"},"children":["Query volume"]}," for the breakdown. If XQL is unavailable, the integration still installs and provides full device inventory - see ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#feature-availability"},"children":["Feature availability"]}," below."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-1-create-an-api-key-in-the-cortex-console","__idx":3},"children":["Step 1: Create an API Key in the Cortex Console"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule authenticates to Cortex XDR with a long-lived API key and its key ID. Cortex XDR does not use OAuth - you generate the key once in the console and Capsule stores it encrypted. There is no automatic refresh, so key rotation is operator-managed."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"steps","__idx":4},"children":["Steps"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Sign in to your ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Cortex console"]}," at your tenant URL (e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://acme.xdr.us.paloaltonetworks.com"]},")."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Navigate to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Configurations → Integrations → API Keys"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["New Key"]},"."]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Security Level"]},": Choose ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Advanced"]}," (recommended) or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Standard"]},". ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["This cannot be changed later"]}," - note which one you picked, because Capsule asks for it during setup."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Role"]},": Select the predefined ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Viewer"]}," role. It's read-only across the tenant and covers everything Capsule calls - endpoint inventory and XQL."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Comment"]},": Enter a descriptive name (e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Capsule Security Integration"]},")"]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Generate the key and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["copy it immediately"]},". Cortex shows the key only once; if you lose it you must generate a new one."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Note the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["ID"]}," shown next to the key in the API Keys table - this is the numeric ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API Key ID"]}," Capsule needs alongside the key itself."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Note your ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API URL"]},". From the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API Keys"]}," page, use ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Copy URL"]}," to get the exact address, or derive it from your console URL by prefixing the first label with ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["api-"]},": a console at ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://acme.xdr.us.paloaltonetworks.com"]}," has an API URL of ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://api-acme.xdr.us.paloaltonetworks.com"]},". Capsule adds the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["api-"]}," prefix for you if you paste the console URL."]}]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Reference:"]}," Palo Alto's ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-API/Get-Started-with-Cortex-XDR-APIs"},"children":["Get Started with Cortex XDR APIs"]}," documents key creation for your console version."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"what-the-key-can-access","__idx":5},"children":["What the key can access"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule only calls these read-only endpoints - no write or response actions:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/xql/get_quota"]}," - credential check at install and test-connection"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/endpoints/get_endpoint"]}," - device inventory"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/xql/start_xql_query"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/xql/get_query_results"]},", ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["/xql/get_query_results_stream"]}," - shadow-AI and agent detection queries"]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"using-a-custom-role-instead-of-viewer","__idx":6},"children":["Using a custom role instead of Viewer"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If Viewer is broader than you need, copy it into a custom role scoped to just these calls:"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Go to ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Configurations → Access Management → Roles"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Select ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Viewer"]}," and duplicate it."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["In the copy, keep view-only permissions for ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Endpoint Administration"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["XQL"]}," (Query Center); remove the rest."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Save the role, then select it in the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Role"]}," field when you create the API key."]}]},{"$$mdtype":"Tag","name":"blockquote","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["XQL results are gated per dataset by the role. The role must be able to view the endpoint and XDR datasets Capsule queries - if the credential check fails with 403, the role is missing Query Center view access or dataset visibility."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"standard-vs-advanced-security-level","__idx":7},"children":["Standard vs Advanced security level"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Advanced"]}," is the recommended level and Palo Alto's default. The key itself is never transmitted: each request carries a hash of the key combined with a random nonce and a timestamp, which the server recomputes. A captured request cannot be replayed."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Standard"]}," sends the key verbatim in the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Authorization"]}," header on every request."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["A key's level is fixed at creation. Capsule cannot detect which level a key uses - a standard key sent with advanced headers is simply rejected - so you must select the matching level during setup."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"security-notes","__idx":8},"children":["Security notes"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Store the API key in a secrets manager. Cortex displays it only once at creation."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Anyone holding the key and key ID can read your tenant data within the key's role. Treat both as secrets."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If the key is ever exposed, ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["revoke it"]}," in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Configurations → Integrations → API Keys"]}," and generate a new one."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Capsule stores the key encrypted at rest and uses it only to call the Cortex XDR public API over HTTPS."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"step-2-configure-the-integration-in-capsule","__idx":9},"children":["Step 2: Configure the Integration in Capsule"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Once you have the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API URL"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API Key ID"]},", ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API Key"]}," and ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["security level"]},", you can install the integration."]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"steps-1","__idx":10},"children":["Steps"]},{"$$mdtype":"Tag","name":"ol","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Log in to the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Capsule Security"]}," portal."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Integrations"]}," in the left sidebar."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Find the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Palo Alto Cortex XDR"]}," card and click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Set up Integration"]},"."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The setup form asks for four values:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API URL"]}," - your tenant API address (e.g. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https://api-acme.xdr.us.paloaltonetworks.com"]},"). Must be a valid ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https"]}," URL."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API Key ID"]}," - the numeric ID shown next to the key in the console."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API Key"]}," - paste the key from Step 1."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Security Level"]}," - ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Advanced"]}," or ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Standard"]},", matching how the key was created."]}]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Capsule validates the credentials by making a read-only call against your tenant. A green ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Connected to Cortex XDR"]}," message confirms the key is accepted."]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Click ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Save"]},"."]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"after-setup","__idx":11},"children":["After setup"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Initial sync begins automatically."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The first sync walks a 7-day backlog in bounded windows, so it may take several runs to catch up on a busy tenant."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["View synced endpoints in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Inventory → Devices"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["View detected AI coding agents and AI apps in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Discovery → Agents"]},", mapped back to the device and signed-in user they ran on."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Discovery runs on a recurring schedule to pick up new endpoints, decommissioned endpoints, and newly observed AI activity."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"query-volume","__idx":12},"children":["Query Volume"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["Use these figures when sizing the integration against your XQL quota. They are per connected Cortex XDR tenant."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Phase"},"children":["Phase"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"XQL queries"},"children":["XQL queries"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Steady state"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["12 per day"]}," - 2 per sync, 6 syncs a day"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["First sync backfill"]}]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["14"]}," - 7 daily windows x 2, once"]}]}]}]}]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Each sync runs exactly two queries"]}," - one for process launches, one for network and DNS activity - regardless of how many endpoints you have or how many AI products Capsule looks for. Capsule aggregates inside the query rather than paging raw events, and it does not run a query per AI product."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Syncs run every 4 hours"]},", so a connected tenant issues 2 x 6 = ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["12 XQL queries per day"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["The first sync backfills 7 days"]}," in 24-hour windows - 7 windows x 2 queries = ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["14 queries"]},", issued once. Subsequent syncs are back to 2."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["A failed sync does not add to the total."]}," Capsule holds its checkpoint and replays the same window on the next sync rather than moving on, so a query that fails is retried, not accumulated."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Device inventory costs no XQL quota."]}," It uses the Endpoints API, which is metered separately."]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If your quota is tight, contact support - the window size Capsule walks is configurable, and a larger window means fewer queries to cover the same period."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"feature-availability","__idx":13},"children":["Feature Availability"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["The integration runs with whatever your API key's role and your tenant's licensing allow. Use this matrix to understand what you'll see in Capsule."]},{"$$mdtype":"Tag","name":"div","attributes":{"className":"md-table-wrapper"},"children":[{"$$mdtype":"Tag","name":"table","attributes":{"className":"md"},"children":[{"$$mdtype":"Tag","name":"thead","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Capsule feature"},"children":["Capsule feature"]},{"$$mdtype":"Tag","name":"th","attributes":{"data-label":"Requires"},"children":["Requires"]}]}]},{"$$mdtype":"Tag","name":"tbody","attributes":{},"children":[{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Device inventory"]}," (hostnames, OS, agent version, IPs, signed-in users)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":["API key with read access to endpoints"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AI coding-agent detection"]}," (Claude Code, Cursor, Copilot, Codex, and others)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["XQL"]}," available + remaining query quota"]}]},{"$$mdtype":"Tag","name":"tr","attributes":{},"children":[{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["AI app detection"]}," (AI services used from the browser)"]},{"$$mdtype":"Tag","name":"td","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["XQL"]}," available + remaining query quota"]}]}]}]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"without-xql","__idx":14},"children":["Without XQL"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["If your tenant does not license XQL - or a query fails, times out, or exhausts your quota during a sync - Capsule ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["downgrades gracefully"]},": device inventory still syncs in full, and the run completes without error. Capsule also holds its checkpoint, so the window that failed is retried on the next run rather than being skipped."]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["To enable AI discovery, work with your Palo Alto account team to confirm XQL entitlement and quota - no other reconfiguration is needed."]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"troubleshooting","__idx":15},"children":["Troubleshooting"]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"invalid-cortex-xdr-api-key-key-id-or-security-level--connection-test-fails-with-401","__idx":16},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Invalid Cortex XDR API key, key ID, or security level"]}," / connection test fails with 401"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The key, key ID, or security level is wrong. All three must match: a key created as ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Standard"]}," fails if ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Advanced"]}," is selected, and vice versa."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The key may have been revoked. Generate a fresh key in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Configurations → Integrations → API Keys"]}," and re-enter all four values."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Confirm the ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API URL"]}," points at the same tenant the key was issued from - keys are not portable across tenants."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"cortex-xdr-api-key-lacks-the-required-permissions-403","__idx":17},"children":[{"$$mdtype":"Tag","name":"code","attributes":{},"children":["Cortex XDR API key lacks the required permissions"]}," (403)"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The role is missing view access to XQL (Query Center) or to the endpoint/XDR datasets. ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Viewer"]}," includes both - if you're on a custom role, confirm it kept those permissions."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["Re-issue the key with a role that has the required access, or edit the existing role in ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Configurations → Access Management → Roles"]},"."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"api-url-rejected","__idx":18},"children":["API URL rejected"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["The ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["API URL"]}," must be a valid ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["https"]}," URL. ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["http"]},", bare hostnames, and non-URL values are rejected. Capsule strips any path or query string and adds the ",{"$$mdtype":"Tag","name":"code","attributes":{},"children":["api-"]}," prefix if you paste a console URL."]}]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":3,"id":"devices-appear-but-no-ai-agents-or-apps-are-discovered","__idx":19},"children":["Devices appear but no AI agents or apps are discovered"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":["This is expected when ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["XQL"]}," is unavailable or the tenant's query quota is exhausted - device inventory still syncs. See ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"#feature-availability"},"children":["Feature availability"]},"."]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":["If XQL is available, confirm AI agents have actually launched, or AI apps have actually been reached, on managed endpoints within the window Capsule is currently processing. A tenant catching up on a backlog processes older windows first."]}]},{"$$mdtype":"Tag","name":"hr","attributes":{},"children":[]},{"$$mdtype":"Tag","name":"Heading","attributes":{"level":2,"id":"support","__idx":20},"children":["Support"]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For help with this integration:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Email"]},": support@capsule.security"]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Include"]},": Your tenant ID, integration status, API URL, and any error messages from the Capsule portal"]}]},{"$$mdtype":"Tag","name":"p","attributes":{},"children":["For Cortex XDR API key, role, or quota issues:"]},{"$$mdtype":"Tag","name":"ul","attributes":{},"children":[{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Cortex console"]},": ",{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Settings → Configurations → Integrations → API Keys"]}]},{"$$mdtype":"Tag","name":"li","attributes":{},"children":[{"$$mdtype":"Tag","name":"strong","attributes":{},"children":["Reference"]},": ",{"$$mdtype":"Tag","name":"MarkdownLink","attributes":{"href":"https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-API/Get-Started-with-Cortex-XDR-APIs"},"children":["Get Started with Cortex XDR APIs"]}]}]}]},"headings":[{"value":"Palo Alto Cortex XDR Integration","id":"palo-alto-cortex-xdr-integration","depth":1},{"value":"Overview","id":"overview","depth":2},{"value":"Prerequisites","id":"prerequisites","depth":2},{"value":"Step 1: Create an API Key in the Cortex Console","id":"step-1-create-an-api-key-in-the-cortex-console","depth":2},{"value":"Steps","id":"steps","depth":3},{"value":"What the key can access","id":"what-the-key-can-access","depth":3},{"value":"Using a custom role instead of Viewer","id":"using-a-custom-role-instead-of-viewer","depth":3},{"value":"Standard vs Advanced security level","id":"standard-vs-advanced-security-level","depth":3},{"value":"Security notes","id":"security-notes","depth":3},{"value":"Step 2: Configure the Integration in Capsule","id":"step-2-configure-the-integration-in-capsule","depth":2},{"value":"Steps","id":"steps-1","depth":3},{"value":"After setup","id":"after-setup","depth":3},{"value":"Query Volume","id":"query-volume","depth":2},{"value":"Feature Availability","id":"feature-availability","depth":2},{"value":"Without XQL","id":"without-xql","depth":3},{"value":"Troubleshooting","id":"troubleshooting","depth":2},{"value":"Invalid Cortex XDR API key, key ID, or security level / connection test fails with 401","id":"invalid-cortex-xdr-api-key-key-id-or-security-level--connection-test-fails-with-401","depth":3},{"value":"Cortex XDR API key lacks the required permissions (403)","id":"cortex-xdr-api-key-lacks-the-required-permissions-403","depth":3},{"value":"API URL rejected","id":"api-url-rejected","depth":3},{"value":"Devices appear but no AI agents or apps are discovered","id":"devices-appear-but-no-ai-agents-or-apps-are-discovered","depth":3},{"value":"Support","id":"support","depth":2}],"frontmatter":{"seo":{"title":"Palo Alto Cortex XDR Integration"}},"lastModified":"2026-11-02T11:57:20.605Z","pagePropGetterError":{"message":"","name":""}},"slug":"/guides/cortex-xdr","userData":{"isAuthenticated":false,"teams":["anonymous"]},"isPublic":true}