Cortex Cloud

Cloud Security

Overview

The Cortex Cloud connector integrates with Palo Alto Networks Cortex Cloud (the Cloud Posture Security / CNAPP platform, accessed through the Cortex public_api). It synchronizes cloud asset inventory (cloud resources, hosts, container images, containers, serverless functions), the cloud accounts and asset groups they belong to, CSPM posture and compliance violations with their definitions, and vulnerabilities with their definitions and the packages they affect.

Data retrieved from Cortex Cloud

Connector Object	Required	Maps to Data Model
Cloud Account	Yes	Cloud Account
Asset Group	Yes	Asset Group
Cloud Resource	Yes	Cloud Resource
Host	Yes	Host
Container Image	Yes	Container Image
Container	Yes	Container
Serverless	Yes	Serverless
Violation	Yes	Violation
Violation Definition	Yes	Violation Definition
Vulnerability	Yes	Vulnerability
Vulnerability Definition	Yes	Vulnerability Definition
Installed Package	Yes	Installed Package
Package	Yes	Package

Model relationships

note

For detailed steps on how to view the data retrieved from Cortex Cloud in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Cortex Cloud from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	Yes	https://api-<TENANT>.xdr.<REGION>.paloaltonetworks.com/	Cortex Cloud tenant API base URL (Cloud Posture Security), e.g. https://api-&lt;tenant&gt;.xdr.&lt;region&gt;.paloaltonetworks.com
API key ID	Yes	—	The Cortex Cloud API key ID (sent as the x-xdr-auth-id header)
API key	Yes	—	The Cortex Cloud API key (sent as the Authorization header)
Advanced authentication	No	false	Enable if using an Advanced API key that requires nonce, timestamp, and SHA256 hashing
Page size	No	100	Maximum number of records to get per API request (1-1000, default 100)
Parallelism level	No	number of CPUs (capped at 4)	Number of concurrent requests for per-asset/per-instance fan-out (e.g. compliance)
Request timeout (secs)	No	120	Maximum seconds allotted before a request times out
Maximum retries	No	5	Number of retry attempts before giving up on a failed request (also covers transient 500s on deep compliance pages)

Authentication

The connector authenticates with an API key pair (key ID + key) issued from the Cortex tenant. Two modes are supported, selected by the advancedAuth configuration property.

Method

Mode	Description
Standard (default)	The API key is sent verbatim in the Authorization header.
Advanced	An x-xdr-auth-id + nonce + timestamp SHA-256 signature is generated per request (Cortex "Advanced" API-key security level).

Endpoint

There is no separate token exchange — every request carries the auth headers directly. The connection test performs a minimal request against the assets endpoint:

Method	URL
POST	{url}/public_api/v1/assets

Request Headers (Standard)

Header	Value
x-xdr-auth-id	The API key ID
Authorization	The API key
Content-Type	application/json
Accept	application/json

In Advanced mode the Authorization header instead carries a SHA-256 hash of the API key concatenated with a random nonce and a timestamp, sent alongside the corresponding nonce and timestamp headers.

Usage

The headers are applied to every subsequent API request; there is no bearer token to cache.

Required Role

The API key inherits its assigned role's permissions, and the connector reads across several Cortex Cloud components. The built-in Viewer role is not sufficient — it lacks read access to the Vulnerability Management, Cloudsec, Compliance, and Public API components. Assign either:

• Instance Administrator — simplest; grants full read access, or
• a custom read-only role with View on: Public API, Asset Inventory, Asset Groups, Compliance, Cases and Issues, Cloudsec → Rules, Vulnerability Management, and Data Collection → Data Sources.

The connector is read-only, so no View/Edit permissions are required. If Scope-Based Access Control is enabled on the tenant, scope the role to the asset tags you want synced.

Sync Behavior

The connector supports incremental (delta) sync. It maintains a sync token (epoch milliseconds) and, on a delta run, applies a since filter per model so only records changed since the last run are fetched:

• Assets (Cloud Resource, Host, Container Image, Container, Serverless) — filtered client-side by last_observed >= since.
• Violation — CSPM issues filtered by last_update/observation >= since; the per-asset compliance rows are re-evaluated in full each run.
• Vulnerability family — filtered server-side by LAST_OBSERVED >= since; a beginning-of-time (no token) run instead performs a platform_id hex-prefix sharded backfill.
• Cloud Account, Asset Group, and the Violation Definition / Vulnerability Definition catalogs are re-fetched in full on every run (these are reference catalogs with no incremental filter).

The specific per-model mechanism is documented under each model's Sync Duration Parameter below.

How to obtain Cortex Cloud credentials

Obtain the required credentials (url, apiKeyId, apiKey) from your Cortex Cloud administrator or the Cortex Cloud admin console, then enter them in the connection settings above.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Cloud Account

Source Field Name	SDM Attribute
(sync time)	LAST_CAPTURED
AccountResource.accountName	NAME
AccountResource.accountType	ACCOUNT_TYPE
AccountResource.cloudAccountId	UID
AccountResource.createdAt	SOURCE_CREATED_DATE
AccountResource.environment	ENVIRONMENT
AccountResource.status	STATUS
InstanceResource.cloudProvider	CLOUD_PROVIDER
InstanceResource.instanceId	INSTANCE_ID
InstanceResource.instanceName	INSTANCE_NAME
InstanceResource.scanMode	SCAN_MODE
InstanceResource.scope	SCOPE

Asset Group

Source Field Name	SDM Attribute
(sync time)	LAST_CAPTURED
AssetGroupResource.createdBy	CREATED_BY
AssetGroupResource.creationTime	SOURCE_CREATED_DATE
AssetGroupResource.description	DESCRIPTION
AssetGroupResource.groupType	GROUP_TYPE
AssetGroupResource.id	UID
AssetGroupResource.lastUpdateTime	SOURCE_LAST_MODIFIED
AssetGroupResource.membershipPredicate	MEMBERSHIP_PREDICATE
AssetGroupResource.modifiedBy	MODIFIED_BY
AssetGroupResource.name	NAME
AssetGroupResource.usedBySbac	USED_BY_SBAC

Cloud Resource

Source Field Name	SDM Attribute
(constant)	CATEGORIES
(constant)	STATUS
(sync time)	LAST_CAPTURED
AssetResource.id (xdm.asset.id)	UID
AssetResource.name	NAME
relations[].asset_id	RELATES_TO
xdm.asset.*	EXTERNAL_PROVIDER_ID / STRONG_ID / REALM
xdm.asset.cloud.account.id	CLOUD_ACCOUNT_ID
xdm.asset.cloud.region	REGION
xdm.asset.database.type	DATABASE_TYPE
xdm.asset.first_observed / last_observed	FIRST_FOUND / LAST_FOUND
xdm.asset.group_ids	GROUP_IDS
xdm.asset.provider	CLOUD_PROVIDER
xdm.asset.secret.*	SECRET_STATUS / SECRET_EXPIRATION_TIME / SECRET_IS_EXPIRED
xdm.asset.tags	TAGS
xdm.asset.type.*	TYPE_ID / TYPE_NAME / TYPE_CLASS / TYPE_CATEGORY
xdm.asset.type.is_resource	IS_RESOURCE
xdm.kubernetes.cluster.*	CLUSTER_NAME / CLUSTER_VERSION

Host

Source Field Name	SDM Attribute
(constant)	CATEGORIES
(constant)	STATUS
(sync time)	LAST_CAPTURED
AssetResource.id (xdm.asset.id)	UID
AssetResource.name	NAME
xdm.asset.*	IS_RESOURCE / EXTERNAL_PROVIDER_ID / STRONG_ID / REALM
xdm.asset.*	CLOUD_PROVIDER / CLOUD_ACCOUNT_ID / REGION
xdm.asset.cloud.zone	ZONE
xdm.asset.first_observed / last_observed	FIRST_FOUND / LAST_FOUND
xdm.asset.group_ids / tags / relations[]	GROUP_IDS / TAGS / RELATES_TO
xdm.asset.host.*_ip	IP_ADDRESSES / PRIVATE_IP_ADDRESSES / PUBLIC_IP_ADDRESSES
xdm.asset.host.image	IMAGE
xdm.asset.host.state	STATE
xdm.asset.type.*	TYPE_ID / TYPE_NAME / TYPE_CLASS / TYPE_CATEGORY
xdm.kubernetes.cluster.*	CLUSTER_ID / CLUSTER_NAME

Container Image

Source Field Name	SDM Attribute
(constant)	CATEGORIES
(constant)	STATUS
(sync time)	LAST_CAPTURED
AssetResource.id (xdm.asset.id)	UID
AssetResource.name	NAME
xdm.asset.*	CLOUD_PROVIDER / CLOUD_ACCOUNT_ID / REGION
xdm.asset.* / relations[]	GROUP_IDS / TAGS / RELATES_TO
xdm.asset.first_observed / last_observed	FIRST_FOUND / LAST_FOUND
xdm.asset.image.architecture	ARCHITECTURE
xdm.asset.image.digest	DIGEST
xdm.asset.image.os_distribution	OPERATING_SYSTEM / OS_DISTRIBUTION
xdm.asset.image.os_release	OS_RELEASE
xdm.asset.image.size	IMAGE_SIZE
xdm.asset.image.specification_type	SPECIFICATION_TYPE
xdm.asset.type.*	TYPE_ID / TYPE_NAME / TYPE_CLASS / TYPE_CATEGORY

Container

Source Field Name	SDM Attribute
(constant)	CATEGORIES
(constant)	STATUS
(sync time)	LAST_CAPTURED
AssetResource.id (xdm.asset.id)	UID
AssetResource.name	NAME
xdm.asset.*	CLOUD_PROVIDER / CLOUD_ACCOUNT_ID / REGION
xdm.asset.* / relations[]	GROUP_IDS / TAGS / RELATES_TO
xdm.asset.first_observed / last_observed	FIRST_FOUND / LAST_FOUND
xdm.asset.host.image	IMAGE
xdm.asset.type.*	TYPE_ID / TYPE_NAME / TYPE_CLASS / TYPE_CATEGORY

Serverless

Source Field Name	SDM Attribute
(constant)	CATEGORIES
(constant)	STATUS
(sync time)	LAST_CAPTURED
AssetResource.id (xdm.asset.id)	UID
AssetResource.name	NAME
xdm.asset.*	CLOUD_PROVIDER / CLOUD_ACCOUNT_ID / REGION
xdm.asset.* / relations[]	GROUP_IDS / TAGS / RELATES_TO
xdm.asset.first_observed / last_observed	FIRST_FOUND / LAST_FOUND
xdm.asset.type.*	TYPE_ID / TYPE_NAME / TYPE_CLASS / TYPE_CATEGORY

Violation

Source Field Name	SDM Attribute
(constant)	KIND
(sync time)	LAST_CAPTURED
issue.asset_ids[] (CSPM) / [assetId] (compliance)	TARGETS
issue.case_ids[]	CASE_IDS
issue.category / row.CATEGORY	CATEGORIES
issue.description	DESCRIPTION
issue.description	RESULTS
issue.detection.method	DETECTION_METHOD
issue.detection.rule_id (CSPM) / RULE_IDS[0] (compliance)	TYPE
issue.domain	DOMAIN
issue.external_id (CSPM) / assetId\	UID
issue.name / row.CONTROL	NAME
issue.observation_time / last_update / row.LAST_EVALUATION_TIME	FIRST_FOUND / LAST_FOUND
issue.remediation	RECOMMENDATION
issue.severity / row.SEVERITY	SEVERITY / SOURCE_SEVERITY / SEVERITY_SCORE
issue.status.progress / row.STATUS	STATUS / SOURCE_STATUS / STATUS_CATEGORY
issue.status.progress / row.STATUS	PROVIDER_STATUS
issue.status.resolution_reason	RESOLUTION_REASON
row.STANDARD / CONTROL / RULE_IDS[]	STANDARD / CONTROL / RULE_IDS

Violation Definition

Source Field Name	SDM Attribute
(sync time)	LAST_CAPTURED
issue.detection.method	DETECTION_METHOD
rule.asset_types[]	ASSET_TYPES
rule.compliance_metadata[].control_name / merged row.CONTROL	CONTROL_NAMES
rule.compliance_metadata[].standard_name / merged row.STANDARD	COMPLIANCE_STANDARD
rule.created_on / last_modified_on	SOURCE_CREATED_DATE / SOURCE_LAST_MODIFIED
rule.description / issue.description	DESCRIPTION
rule.enabled / rule.system_default	ENABLED / SYSTEM_DEFAULT
rule.id / issue.detection.rule_id / RULE_IDS[0]	UID
rule.labels[]	TAGS
rule.metadata.issue.recommendation	RECOMMENDATION
rule.name / issue.name / row.CONTROL (first row)	NAME
rule.providers[]	PROVIDERS
rule.query.xql	XQL
rule.rule_class	RULE_CLASS
rule.rule_class / issue.category	CATEGORIES
rule.severity / issue.severity / max row.SEVERITY	SEVERITY / SOURCE_SEVERITY / SEVERITY_SCORE

Vulnerability

Source Field Name	SDM Attribute
(active)	STATUS / SOURCE_STATUS / STATUS_CATEGORY
(sync time)	LAST_CAPTURED
asset_id + assetId\	TARGETS
cortex_vulnerability_risk_score	RISK_SCORE
cvss_severity	SEVERITY / SOURCE_SEVERITY / SEVERITY_SCORE
epss_score	EPSS_SCORE
exploit_level	EXPLOITABILITY
exploitable	EXPLOITABLE
file_path	PATH
finding_sources[]	FINDING_SOURCES
first_observed / last_observed	FIRST_FOUND / LAST_FOUND
fix_available	FIXABLE
fix_date	LAST_FIXED
has_kev	CISA_EXPLOITED
internet_exposed	INTERNET_EXPOSED
issue_id	ISSUE_ID
operating_system	OPERATING_SYSTEM
package_*	PACKAGE_NAME / PACKAGE_VERSION / PACKAGE_URL
VulnFindingResource.cve_id	TYPE
VulnFindingResource.platform_id	UID

Vulnerability Definition

Source Field Name	SDM Attribute
(sync time)	LAST_CAPTURED
cortex_vulnerability_risk_score	RISK_SCORE
cve_id	CVE_IDS / CVE_RECORDS
cvss_severity	SEVERITY / SOURCE_SEVERITY / SEVERITY_SCORE
epss_score / uvem.epss_percentile	EPSS_SCORE / EPSS_PERCENTILE
exploit_level / uvem	EXPLOITABILITY / EXPLOIT_MATURITY
fix_versions[]	FIXED_VERSION
has_kev / uvem.cisa_kev_*	CISA_EXPLOITED / CISA_ADDED_DATE / CISA_DUE_DATE
remediation	RECOMMENDATION
uvem CVSS vector / cvss_score	CVSS_V* metrics
uvem published date	PUBLISHED_DATE
uvem.cwe_details[]	CWE_IDS / WEAKNESSES
uvem.description	DESCRIPTION
uvem.weaknesses[].cweDetails.url	REFERENCES
VulnFindingResource.cve_id	UID
VulnFindingResource.cve_id	NAME

Installed Package

Source Field Name	SDM Attribute
(sync time)	LAST_CAPTURED
assetId\	UID
file_path	PATH
origin_package_name	ORIGIN_PACKAGE_NAME
package_author	PUBLISHER
package_in_use	IN_USE
package_licenses[]	LICENSES
package_purl	PACKAGE_URL
package_type	PACKAGE_TYPE
package_version	CURRENT_VERSION
VulnFindingResource.asset_id	TARGETS
VulnFindingResource.package_name	NAME
VulnFindingResource.package_purl	TYPE

Package

Source Field Name	SDM Attribute
(sync time)	LAST_CAPTURED
origin_package_name	ORIGIN_PACKAGE_NAME
package_author	PUBLISHER
package_licenses[]	LICENSES
package_purl	PACKAGE_URL
package_type	PACKAGE_TYPE
package_version	CURRENT_VERSION
VulnFindingResource.package_name	NAME
VulnFindingResource.package_purl	UID

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Cloud Account

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Cloud Account on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/cloud_onboarding/get_instances

note

• Only status=CONNECTED instances carry accounts; cloud_provider is inherited from the parent instance. Fetched in full on every run.

---

Asset Group

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Asset Group on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/asset-groups

note

• The list endpoint enumerates only a subset of groups (low ids on the dev tenant) while assets may reference higher, non-listable ids — so some asset group_ids may have no matching group object. Fetched in full on every run.

---

The next five models — Cloud Resource, Host, Container Image, Container, and Serverless — all derive from one POST /public_api/v1/assets inventory sweep. The full inventory is fetched once, then split client-side by xdm.asset.type.category (the /assets endpoint does not accept a server-side type filter). They therefore share the common asset attributes listed in each table below (TYPE_*, CLOUD_PROVIDER, REGION, GROUP_IDS, TAGS, RELATES_TO, …), plus their own type-specific fields.

Cloud Resource

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Cloud Resource on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/assets

Host

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Host on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/assets

Container Image

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Container Image on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/assets

Container

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Container on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/assets

Serverless

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Serverless on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/assets

Violation

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Violation on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/issue/search

note

• Only STATUS = FAILED compliance rows become Violations (passing rows are dropped). The get_asset sweep is fetched once per sync transaction and shared with the Violation Definition sync.
• CATEGORIES carries a different taxonomy per KIND, which is deliberate. KIND = CSPM gets the rule detection class from issue.category, normalized (CONFIGURATION → Configuration) so it groups with the rule_class spelling of the same taxonomy on the Violation Definition (config → Configuration too — see that model's notes). KIND = Compliance gets the compliance framework's own family or function from row.CATEGORY (Protect, ACCESS CONTROL, Control 4 : Secure Configuration of Enterprise Assets and Software), passed through verbatim. A compliance Violation's UID is scoped to one standard, so that value is unambiguous, and the framework family is the useful grouping level between STANDARD and CONTROL. The rule is: normalize our own taxonomy, leave external framework labels untouched — title-casing them would damage the sentence-shaped CIS values. The same field is deliberately not mapped on the Violation Definition, which is rule-keyed and spans many standards; see that model's notes.

---

Violation Definition

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Violation Definition on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /public_api/v1/rule/search

note

• Fetched in full on every run (definition catalog). The three sources are deduplicated by rule id in an ephemeral per-transaction on-disk store (first-wins, so the richest rule/search definition keeps the id over the issue/compliance supplements). The compliance/get_asset sweep is shared with the Violation sync.
• A single rule maps to many controls across many standards (many-to-many), so CONTROL_NAMES / COMPLIANCE_STANDARD are multi-valued. A compliance/get_controls control-catalog source was intentionally not synced — its CONTROL_ID id-space is never a Violation TYPE target, and control context is carried by these attributes on each rule instead. Only control names are surfaced (not the opaque control_id UUIDs), since there is no standalone Control object to correlate ids to.
• First-wins applies across sources, but within the compliance supplement the rows for a kept rule id are merged: a compliance row is one (asset × standard × control) result, so one rule id recurs across many rows. The first row is the representative for NAME and severity, while COMPLIANCE_STANDARD and CONTROL_NAMES accumulate the distinct values across every row. Without this a compliance-sourced definition would report a single standard and control no matter how many it maps to.
• On the compliance supplement, SEVERITY is the maximum across every merged row, not the seed row's. A compliance row's SEVERITY belongs to its (standard × control) evaluation rather than to the rule — the same rule is rated SEV_030_MEDIUM under one control and SEV_040_HIGH under another — so seeding from the first row under-reported a rule whose first-seen control happened to be the mildest, and made the value depend on store iteration order (it could flip between syncs with no upstream change). Ranked by FindingUtils severity score, not by the raw SEV_0x0_WORD string. NAME deliberately still comes from the seed row, since there is no "max" for a name.
• The compliance supplement runs in two passes over the same cached rows. Pass 1 keys RULE_IDS[0] and is the only path that may create a definition — keying every position would mint definitions for ids that are never a Violation TYPE target. Pass 2 is merge-only over positions 1..n: RULE_IDS is the control's whole rule mapping, so a rule sits at [0] on some rows and further down on others, and without pass 2 a definition is blind to every standard where its rule is mapped but not listed first. Pass 2 adds no HTTP calls (it replays the same cached rows) and keeps no side index: the store is the only record of which ids are compliance-sourced, so the lookup that finds the definition is also the membership test, and a definition owned by rule/search or issue/search is never modified.
• CATEGORIES is normalized by CortexCloudModel.normalizeCategory in two steps: token casing (saas → SaaS, AI → AI — a plain capitalize would yield Saas / Ai), then a whole-value alias for classes the two endpoints word rather than case differently. A live probe of the rule catalog found the detection-class space to be config, saas, AI, attack_path, identity, data on the rule side and CONFIGURATION, POSTURE on the issue side — one synonym pair in total, so the alias map is the single entry Config → Configuration. Neither map is an allowlist: an unlisted value falls through to plain capitalization rather than being dropped. RULE_CLASS keeps the raw value.
• row.CATEGORY is deliberately not mapped to CATEGORIES. It is the compliance framework's own family or function (NIST 800-53 ACCESS CONTROL, CIS v8.1 Control 4 : Secure Configuration of Enterprise Assets and Software, SCF Cloud Security), so it is scoped to a standard rather than to the rule this object is keyed by — a definition spanning many standards has no single one. It is also a different taxonomy from the rule detection class (rule_class / issue category) that CATEGORIES carries on the other two paths. The standards themselves are kept in COMPLIANCE_STANDARD.

---

Vulnerability

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Vulnerability on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: POST /vulnerability-management/v1/vulnerability-finding/search

note

• The finding stream is fetched once per sync transaction into a shared store (keyed by platform_id) and replayed across the four vulnerability-family models, so it is pulled only once per run.

---

Vulnerability Definition

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Vulnerability Definition on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: derived from the shared vulnerability-finding stream; enriched via

note

• Fetched from the same shared finding stream as Vulnerability; one Vulnerability Definition per distinct CVE. uvem enrichment is best-effort — absent enrichment still yields a valid definition from the finding fields.

---

Installed Package

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Installed Package on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: derived from the shared vulnerability-finding stream (

Package

Operation options

This object does not support any operation options.

Delta sync

Not supported. The connector performs a full sync of Package on every run and applies no incremental date filter.

API

• Type: REST · Endpoint: derived from the shared vulnerability-finding stream (

Changelog

Changelog

The Cortex Cloud connector has undergone the following changes:

Version	Description	Migration Steps
3.1.0	Overview The Cortex Cloud connector integrates with Palo Alto Networks Cortex Cloud to synchronize cloud asset inventory, the cloud accounts and asset groups they belong to, posture and compliance violations with their definitions, and vulnerabilities with their definitions and affected packages. Category: Cloud Security Posture Management Models	N/A