# Palo Alto Cortex XDR

The Cortex XDR connector brings the endpoints Cortex XDR manages, and the
incidents it raises, into Mesh. It can also find the AI tools running across
those endpoints: you define the searches, and Mesh runs them against your
Cortex XDR data on a schedule.

Each AI tool a search finds becomes an AI agent in your non-human identity
inventory. It is tied to the endpoint it ran on and owned by the account that
ran it, so it is attributed to a person instead of sitting unattributed.

## What it collects

| What Mesh reads | What it includes | Becomes in Mesh |
| --- | --- | --- |
| **Endpoints** | Every endpoint Cortex XDR manages: its name, IP address, operating system and version, and status | Devices |
| **Incidents** | Each incident's name, severity, status and the hosts it affects | Entries of type **Device** in your non-human identity inventory, one per incident, carrying its severity and status |
| **XQL searches** | The results of the searches you define | AI agents, each tied to the endpoint it was found on and owned by the account that ran it |

Searches are optional. Leave them out and the connector still collects
endpoints and incidents.

> **note**
A search looks for the processes your endpoints actually ran, or the domains
they actually looked up. That is how it finds self-hosted tools, and tools
nobody registered, that no catalog lists. What a search finds depends on the
terms you give it and on the data Cortex XDR holds. See
[Define your searches](./set-up.md#step-5--define-your-searches).

## What you need before you start

| You need | Notes |
| --- | --- |
| A Cortex XDR **Standard** API key and its ID | Created by your Cortex XDR administrator. **Advanced** keys are not supported |
| Your Cortex XDR API URL | In Cortex XDR, go to **Settings › Configurations › API Keys** and select **Copy API URL**. It looks like `https://api-yourcompany.xdr.us.paloaltonetworks.com` |
| A Mesh administrator account | To add connectors |

The API key needs to be able to read endpoints and incidents. If you define
searches, it also needs to be able to run XQL queries.

> **tip**
Create an API key for Mesh rather than reusing one that another tool depends
on. You can then rotate or revoke it without affecting anything else.

## Set it up

| Step | What you do |
| --- | --- |
| **[Set up Cortex XDR](./set-up.md)** | Add the connector, enter your API URL and key, define any searches, and test the connection |

## How often it runs

The connector runs every hour by default.

## Limits to know about

- **Each search returns at most 1,000 rows**, most recent matches first. A
  search that reaches the limit is flagged on the connector. If one of yours
  does, narrow its terms, shorten the search window, or split it into several
  searches.
- **Each search looks back 24 hours by default.** You can change this with the
  **XQL search window** setting. See
  [Set the search window](./set-up.md#step-6--set-the-search-window).