Palo Alto Cortex XDR
The Cortex XDR connector brings the endpoints Cortex XDR manages, and the incidents it raises, into Mesh. It can also find the AI tools running across those endpoints: you define the searches, and Mesh runs them against your Cortex XDR data on a schedule.
Each AI tool a search finds becomes an AI agent in your non-human identity inventory. It is tied to the endpoint it ran on and owned by the account that ran it, so it is attributed to a person instead of sitting unattributed.
What it collects
| What Mesh reads | What it includes | Becomes in Mesh |
|---|---|---|
| Endpoints | Every endpoint Cortex XDR manages: its name, IP address, operating system and version, and status | Devices |
| Incidents | Each incident's name, severity, status and the hosts it affects | Entries of type Device in your non-human identity inventory, one per incident, carrying its severity and status |
| XQL searches | The results of the searches you define | AI agents, each tied to the endpoint it was found on and owned by the account that ran it |
Searches are optional. Leave them out and the connector still collects endpoints and incidents.
A search looks for the processes your endpoints actually ran, or the domains they actually looked up. That is how it finds self-hosted tools, and tools nobody registered, that no catalog lists. What a search finds depends on the terms you give it and on the data Cortex XDR holds. See Define your searches.
What you need before you start
| You need | Notes |
|---|---|
| A Cortex XDR Standard API key and its ID | Created by your Cortex XDR administrator. Advanced keys are not supported |
| Your Cortex XDR API URL | In Cortex XDR, go to Settings › Configurations › API Keys and select Copy API URL. It looks like https://api-yourcompany.xdr.us.paloaltonetworks.com |
| A Mesh administrator account | To add connectors |
The API key needs to be able to read endpoints and incidents. If you define searches, it also needs to be able to run XQL queries.
Create an API key for Mesh rather than reusing one that another tool depends on. You can then rotate or revoke it without affecting anything else.
Set it up
| Step | What you do |
|---|---|
| Set up Cortex XDR | Add the connector, enter your API URL and key, define any searches, and test the connection |
How often it runs
The connector runs every hour by default.
Limits to know about
- Each search returns at most 1,000 rows, most recent matches first. A search that reaches the limit is flagged on the connector. If one of yours does, narrow its terms, shorten the search window, or split it into several searches.
- Each search looks back 24 hours by default. You can change this with the XQL search window setting. See Set the search window.