Palo Alto Networks Cortex XSIAM

What is Palo Alto Cortex XSIAM? #

Palo Alto Networks Cortex XSIAM is a next-generation SOC platform that unifies XDR, SIEM, automation, threat intelligence, and attack surface management.

Why Should You Use the Palo Alto Cortex XSIAM Connector? #

The Palo Alto Cortex XSIAM connector provides visibility into the assets in your environment. You can use this visibility to:

• ensure assets are managed per your security policies
• derive relationships between assets, users, applications, and data

How Does This Connector Work? #

Meridian executes rad-only requests to the Palo Alto Cortex XSIAM REST API and ingests only meta-data about Palo Alto Cortex XSIAM devices. Meridian does not retrieve any data stored on your assets.

Configuring the Connector in Meridian #

Source Documentation #

Creating Credentials #

To create an API Key:

Manage API keys • Cortex XSIAM 3.x Documentation • Palo Alto Networks documentation portal

Required Permissions #

The Palo Alto Cortex XSIAM token must have read access to asset data, endpoint data, and user data. To assign read-only access to your API Key, assign the Viewer role.

If you have the ASM add-on to XSIAM, you can create a custom role by copying the Viewer role and then adding view-only permissions for Attack Surface Management and External Services. For details, see Manage user roles • Cortex XSIAM Documentation • Palo Alto Networks documentation portal.

API Documentation #

Cortex XSIAM APIs • Cortex XSIAM REST API • Palo Alto Networks documentation portal

Cortex XSIAM APIs • Cortex XSIAM REST API • Palo Alto Networks documentation portal