Palo Alto Cortex XDR CCP
Solution: Palo Alto Cortex XDR
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊
| Attribute | Value |
|---|---|
| Publisher | Microsoft Corporation |
| Support Tier | Microsoft |
| Support Link | https://support.microsoft.com |
| Categories | Security - Threat Protection |
| Version | 3.0.5 |
| Author | Microsoft |
| First Published | 2024-12-07 |
| Last Updated | 2026-06-16 |
| Solution Folder | Palo Alto Cortex XDR |
| Marketplace | Azure Marketplace · Popularity: 🔵 Medium (67%) |
The Palo Alto Cortex XDR data connector allows ingesting logs from the Palo Alto Cortex XDR API into Microsoft Sentinel. The data connector is built on Microsoft Sentinel Codeless Connector Platform. It uses the Palo Alto Cortex XDR API to fetch agents, alerts, incidents, management and endpoint logs and it supports DCR-based ingestion time transformations that parses the received security data into a custom table, thus resulting in better performance.
Contents
Data Connectors
This solution provides 1 data connector(s):
Tables Used
This solution uses 5 table(s):
| Table | Used By Connectors | Used By Content |
|---|---|---|
PaloAltoCortexXDR_Alerts_CL |
Palo Alto Cortex XDR | - |
PaloAltoCortexXDR_Audit_Agent_CL |
Palo Alto Cortex XDR | - |
PaloAltoCortexXDR_Audit_Management_CL |
Palo Alto Cortex XDR | - |
PaloAltoCortexXDR_Endpoints_CL |
Palo Alto Cortex XDR | - |
PaloAltoCortexXDR_Incidents_CL |
Palo Alto Cortex XDR | Analytics |
Content Items
This solution includes 4 content item(s):
| Content Type | Count |
|---|---|
| Analytic Rules | 3 |
| Parsers | 1 |
Analytic Rules
| Name | Severity | Tactics | Tables Used |
|---|---|---|---|
| Cortex XDR Incident - High | High | - | PaloAltoCortexXDR_Incidents_CL |
| Cortex XDR Incident - Low | Low | - | PaloAltoCortexXDR_Incidents_CL |
| Cortex XDR Incident - Medium | Medium | - | PaloAltoCortexXDR_Incidents_CL |
Parsers
| Name | Description | Tables Used |
|---|---|---|
| PaloAltoCortexXDR | - | - |
Release Notes
| Version | Date Modified (DD-MM-YYYY) | Change History |
|---|---|---|
| 3.0.5 | 22-07-2026 | Adding parser & analytic rules from legacy Cortex XDR connector and removed 'CCP' from solution name |
| 3.0.4 | 12-06-2026 | Updating CCF Polling file to implement parameters |
| 3.0.3 | 09-04-2025 | Updating CCF connector parameters |
| 3.0.2 | 10-02-2025 | Advancing CCF Data Connector from Public preview to Global Availability. |
| 3.0.1 | 22-01-2025 | Added Preview tag to Data Connector |
| 3.0.0 | 17-12-2024 | Initial Solution Release |
Browse: 🏠 · Solutions · Connectors · Methods · Tables · Content · Parsers · ASIM Parsers · ASIM Products · Logic Apps · 📊