Cortex XDR

Endpoint Protection

Overview

The Cortex XDR Connector fetches and synchronizes extended detection and response (XDR) security data from Palo Alto Networks Cortex XDR. It connects to the Cortex XDR public API using API Key authentication (standard or advanced) and maps retrieved objects to the Brinqa Data Model.

Data retrieved from Cortex XDR Connector

Connector Object	Required	Maps to Data Model
Asset	Yes	Asset
Alert	Yes	Alert
Alert Definition	Yes	Alert Definition
Endpoint	Yes	Host
Incident	Yes	Incident
Incident Definition	Yes	Incident Definition
Software	Yes	Package
Installed Software	Yes	Installed Package
Violation	Yes	Violation
Violation Definition	Yes	Violation Definition
Vulnerability	Yes	Vulnerability
Vulnerability Definition	Yes	Vulnerability Definition

Model relationships

note

For detailed steps on how to view the data retrieved from Cortex XDR Connector in the Brinqa Platform, see How to view your data.

Setup

Connection settings

When setting up a data integration, select Cortex XDR Connector from the Connector dropdown and provide the following:

Setting	Required	Default	Description
API URL	No	required	Cortex XDR API base URL
API Key ID	No	required	The Cortex XDR api account api key ID
API Key	No	required	The Cortex XDR api account api key
Advanced Authentication	No	false	Enable if using an Advanced API key that requires nonce, timestamp, and SHA256 hashing
Request timeout (secs)	No	120	Maximum seconds allotted before a request times out
Maximum retries	No	5	Number of retry attempts before giving up on a failed request
Page size	No	—	Maximum number of records to get per API request (1-100, default 100)

Authentication

Cortex XDR uses API Key authentication. The connector supports two modes, selected by the advancedAuth configuration flag, and authenticates every request via HTTP headers (there is no separate token-exchange call).

Standard Authentication (default)

The API key is sent directly in the Authorization header, with the matching key ID in x-xdr-auth-id.

Header	Value
Authorization	The Cortex XDR API key
x-xdr-auth-id	The Cortex XDR API key ID
Content-Type	application/json
Accept	application/json

Advanced Authentication (advancedAuth = true)

An Advanced API key is hashed per request. The connector generates a random 64-character nonce and the current timestamp, computes Authorization = SHA-256(apiKey + nonce + timestamp), and sends:

Header	Value
x-xdr-auth-id	The Cortex XDR API key ID
x-xdr-nonce	Random 64-character nonce
x-xdr-timestamp	Current time in milliseconds
Authorization	SHA-256 hash of apiKey + nonce + timestamp
Content-Type	application/json
Accept	application/json

Connectivity Test Endpoint

Method	URL
POST	/public_api/v1/alerts/get_alerts

Request Body

{
  "request_data": {
    "search_from": 0,
    "search_to": 1
  }
}

Sample Response

{
  "reply": {
    "total_count": 1,
    "result_count": 1,
    "alerts": [
      { "alert_id": "1", "severity": "high" }
    ]
  }
}

Response Fields

Field	Description
reply.total_count	Total number of records matching the request
reply.result_count	Number of records returned in this page
reply.<data array>	Page of resource objects (varies by endpoint)

A non-2xx status causes the connector to surface the platform error message. The same header set is applied to every subsequent request for the session.

Sync Behavior

The connector performs an incremental (delta) sync for every model. It maintains a sync token between runs and applies it as a lower bound on each request, so a delta run fetches only records created or first observed since the previous run:

• REST models (Asset, Alert, Alert Definition, Endpoint, Incident, Incident Definition, Violation, Violation Definition) pass the token as a server-side gte filter on the model's timestamp field.
• XQL models (Software, Installed Software, Vulnerability, Vulnerability Definition) pass the token as the timeframe.from bound of the XQL query.

A beginning-of-time run (no stored token) sends no filter for REST models and timeframe.from = 0 for XQL models, which fetches the complete history.

How to obtain Cortex XDR Connector credentials

Obtain the required credentials from your Cortex XDR Connector administrator or the Cortex XDR Connector admin console, then enter them in the connection settings above.

Data & mappings

Attribute mappings

Expand the sections below to view the mappings between the source and the Brinqa data model attributes:

Asset

Source Field Name	SDM Attribute
AssetResource.xdmAssetFirstObserved()	FIRST_FOUND
AssetResource.xdmAssetGroupIds()	GROUP_IDS
AssetResource.xdmAssetId()	UID
AssetResource.xdmAssetLastObserved()	LAST_FOUND
AssetResource.xdmAssetName()	NAME
AssetResource.xdmAssetRealm()	REALM
AssetResource.xdmAssetRegion()	REGION
AssetResource.xdmAssetRelatedCasesCasesBreakdown()	CASES_BREAKDOWN
AssetResource.xdmAssetRelatedCasesCriticalCases()	CASES_CRITICAL
AssetResource.xdmAssetRelatedIssuesCriticalIssues()	ISSUES_CRITICAL
AssetResource.xdmAssetRelatedIssuesIssuesBreakdown()	ISSUES_BREAKDOWN
AssetResource.xdmAssetStrongId()	STRONG_ID
AssetResource.xdmAssetTypeClass()	AGENT_TYPE
AssetResource.xdmAssetTypeId()	TYPE_ID
AssetResource.xdmAssetTypeName()	TYPE_NAME
AssetResource.xdmAssetTypeName() / AssetResource.xdmAssetTypeCategory()	CATEGORIES
AssetResource.xdmHostIpv4Addresses()	IP_ADDRESSES
xdmHostIpv4Addresses() (!AssetUtils.isLocalIP)	PUBLIC_IP_ADDRESSES
xdmHostIpv4Addresses() (AssetUtils.isLocalIP)	PRIVATE_IP_ADDRESSES

Alert

Source Field Name	SDM Attribute
AlertResource.action	ACTION
AlertResource.actionCountry	ACTION_COUNTRY
AlertResource.actionPretty	ACTION_PRETTY
AlertResource.actionRemoteIp	ACTION_REMOTE_IP
AlertResource.actionRemotePort	ACTION_REMOTE_PORT
AlertResource.alertId	UID
AlertResource.alertId	NAME
AlertResource.category	CATEGORIES
AlertResource.creationTime	SOURCE_CREATED_DATE
AlertResource.creationTime	FIRST_FOUND
AlertResource.description	DESCRIPTION
AlertResource.detectionTimestamp	LAST_FOUND
AlertResource.getResults()	RESULTS
AlertResource.hostIp	IP_ADDRESSES
AlertResource.hostName	HOSTNAMES
AlertResource.macAddress	MAC_ADDRESSES
AlertResource.name	TYPE
AlertResource.resolutionStatus	PROVIDER_STATUS
AlertResource.serverCreationTime	SERVER_CREATION_TIME
AlertResource.severity	SEVERITY
AlertResource.tags	TAGS
Derived: endpointId	TARGETS
Derived: resolutionStatus (getAlertStatus → normalizeFindingStatus)	SOURCE_STATUS

Alert Definition

Source Field Name	SDM Attribute
AlertResource.category	CATEGORIES
AlertResource.description	DESCRIPTION
AlertResource.mitreTacticIdAndName	MITRE_TACTIC_ID_AND_NAME
AlertResource.mitreTechniqueIdAndName	MITRE_TECHNIQUE_ID_AND_NAME
AlertResource.name	UID
AlertResource.name	NAME
AlertResource.severity	SOURCE_SEVERITY
AlertResource.severity (normalizeFindingSeverity)	SEVERITY
normalized severity (getFindingSeverityScore)	SEVERITY_SCORE

Endpoint

Source Field Name	SDM Attribute
EndpointResource.alias	alias
EndpointResource.assignedExtensionsPolicy	assigned_extensions_policy
EndpointResource.assignedPreventionPolicy	assigned_prevention_policy
EndpointResource.contentReleaseTimestamp	content_release_timestamp
EndpointResource.contentStatus	content_status
EndpointResource.contentVersion	CURRENT_VERSION
EndpointResource.domain	domain
EndpointResource.endpointId	UID
EndpointResource.endpointName	NAME
EndpointResource.endpointName	HOSTNAMES
EndpointResource.endpointStatus	SOURCE_STATUS
EndpointResource.endpointType	CATEGORIES
EndpointResource.endpointVersion	endpoint_version
EndpointResource.firstSeen	FIRST_SEEN
EndpointResource.groupName	group_name
EndpointResource.installationPackage	installation_package
EndpointResource.installDate	INSTALL_DATE
EndpointResource.isIsolated	is_isolated
EndpointResource.lastContentUpdateTime	SOURCE_LAST_MODIFIED
EndpointResource.lastSeen	LAST_SEEN
EndpointResource.macAddress	MAC_ADDRESSES
EndpointResource.operatingSystem OR osType + osVersion	OPERATING_SYSTEM
EndpointResource.operationalStatus	operational_status
EndpointResource.operationalStatusDescription	operational_status_description
EndpointResource.scanStatus	LAST_SCAN_STATUS
EndpointResource.tags.endpointTags	TAGS
EndpointResource.users	users
endpointStatus (normalizeAssetStatus)	STATUS
ip + ipv6 + publicIp	IP_ADDRESSES
IP_ADDRESSES (!AssetUtils.isLocalIP) + publicIp	PUBLIC_IP_ADDRESSES
IP_ADDRESSES (AssetUtils.isLocalIP)	PRIVATE_IP_ADDRESSES

Incident

Source Field Name	SDM Attribute
IncidentResource.alertCount	ALERT_COUNT
IncidentResource.alertsGroupingStatus	ALERTS_GROUPING_STATUS
IncidentResource.creationTime	SOURCE_CREATED_DATE
IncidentResource.detectionTime	LAST_FOUND
IncidentResource.hostCount	HOST_COUNT
IncidentResource.hosts (endpointId part after :)	ENDPOINT_IDS
IncidentResource.hosts (hostname part before :)	HOSTNAMES
IncidentResource.hosts + IncidentResource.users	TARGETS
IncidentResource.incidentDomain	INCIDENT_DOMAIN
IncidentResource.incidentId	UID
IncidentResource.incidentId	TYPE
IncidentResource.incidentId	INCIDENT_ID
IncidentResource.modificationTime	SOURCE_LAST_MODIFIED
IncidentResource.originalTags	ORIGINAL_TAGS
IncidentResource.resolvedTimestamp	LAST_FIXED
IncidentResource.ruleBasedScore	RULE_BASED_SCORE
IncidentResource.starred	STARRED
IncidentResource.starredManually	STARRED_MANUALLY
IncidentResource.status	PROVIDER_STATUS
IncidentResource.status (getAlertStatus → normalizeFindingStatus)	SOURCE_STATUS
IncidentResource.tags	TAGS
IncidentResource.userCount	USER_COUNT
IncidentResource.users	USERS
IncidentResource.wildfireHits	WILDFIRE_HITS
IncidentResource.xdrUrl	XDR_URL

Incident Definition

Source Field Name	SDM Attribute
IncidentResource.alertCategories	ALERT_CATEGORIES
IncidentResource.description	DESCRIPTION
IncidentResource.incidentDomain	INCIDENT_DOMAIN
IncidentResource.incidentId	UID
IncidentResource.incidentSources	INCIDENT_SOURCES
IncidentResource.manualDescription	MANUAL_DESCRIPTION
IncidentResource.mitreTactics	MITRE_TACTICS_IDS_AND_NAMES
IncidentResource.mitreTechniques	MITRE_TECHNIQUES_IDS_AND_NAMES
IncidentResource.severity	SOURCE_SEVERITY
IncidentResource.severity (normalizeFindingSeverity)	SEVERITY
normalized severity (getFindingSeverityScore)	SEVERITY_SCORE

Software

Source Field Name	SDM Attribute
ApplicationResource.applicationName	NAME
ApplicationResource.applicationName	APP_NAME
ApplicationResource.identifier	APP_ID
ApplicationResource.isFromAppStore	IS_FROM_APPSTORE
ApplicationResource.keyName	KEY_NAME
ApplicationResource.managerName	MANAGER_NAME
ApplicationResource.rawVersion	RAW_VERSION
ApplicationResource.uninstallString	UNINSTALL_STRING
ApplicationResource.urlInfoAbout	URL_INFO_ABOUT
ApplicationResource.urlUpdateInfo	URL_UPDATE_INFO
ApplicationResource.vendor	VENDOR
ApplicationResource.version	CURRENT_VERSION
ApplicationResource.winInstaller	WIN_INSTALLER
packageUid(ApplicationResource)	UID

Installed Software

Source Field Name	SDM Attribute
ApplicationResource.installDate	INSTALL_DATE
ApplicationResource.installedForSid	INSTALLED_FOR_SID
HostInventoryResource.agentId	TARGETS
HostInventoryResource.agentId	AGENT_ID
HostInventoryResource.hostName	HOSTNAMES
HostInventoryResource.product	INVENTORY_PRODUCT
HostInventoryResource.time	INVENTORY_TIME
HostInventoryResource.vendor	INVENTORY_VENDOR
installedSoftwareUid(HostInventoryResource, pkgUid)	UID
packageUid(ApplicationResource)	TYPE

Violation

Source Field Name	SDM Attribute
constant "active"	PROVIDER_STATUS
constant "active"	SOURCE_STATUS
ip, hostname, endpointId	TARGETS
ViolationResource.endpointId	ENDPOINT_ID
ViolationResource.hostname	HOSTNAMES
ViolationResource.ip	IP_ADDRESSES
ViolationResource.product	PRODUCT
ViolationResource.productId	PRODUCT_ID
ViolationResource.serial	SERIAL_NUMBER
ViolationResource.timestamp	LAST_FOUND
ViolationResource.type	TYPE
ViolationResource.username	USERNAME
ViolationResource.vendor	VENDOR
ViolationResource.vendorId	VENDOR_ID
ViolationResource.violationId	UID
ViolationResource.violationId	VIOLATION_ID

Violation Definition

Source Field Name	SDM Attribute
Derived: same as UID	NAME
Derived: ViolationResource.type (fallback: "UNKNOWN")	UID

Vulnerability

Source Field Name	SDM Attribute
Constant "active"	PROVIDER_STATUS
EndpointVulnerabilityResource.cveId	TYPE
EndpointVulnerabilityResource.endpointId	ENDPOINT_ID
EndpointVulnerabilityResource.endpointName	TARGETS
EndpointVulnerabilityResource.endpointName	HOSTNAMES
EndpointVulnerabilityResource.endpointType	ENDPOINT_TYPE
EndpointVulnerabilityResource.lastCalculationTime	LAST_FOUND
EndpointVulnerabilityResource.lastReportTime	SOURCE_LAST_MODIFIED
EndpointVulnerabilityResource.osType	OPERATING_SYSTEM
EndpointVulnerabilityResource.severity	MAX_SEVERITY
EndpointVulnerabilityResource.severityScore	MAX_SEVERITY_SCORE
MD5(endpoint_id + cves)	UID
normalizeFindingStatus("active")	SOURCE_STATUS
now	LAST_CAPTURED

Vulnerability Definition

Source Field Name	SDM Attribute
Collections.singletonList(VulnerabilityResource.cveId)	CVE_IDS
getFindingSeverityScore(normalizeFindingSeverity(severity))	SEVERITY_SCORE
normalizeFindingSeverity(VulnerabilityResource.severity)	SEVERITY
now (Instant at sync time)	LAST_CAPTURED
VulnerabilityResource.affectedProducts	AFFECTED
VulnerabilityResource.availability	AVAILABILITY
VulnerabilityResource.confidentiality	CONFIDENTIALITY
VulnerabilityResource.description	DESCRIPTION
VulnerabilityResource.exploitabilityScore	EXPLOITABILITY_SCORE
VulnerabilityResource.impactScore	IMPACT_SCORE
VulnerabilityResource.integrity	INTEGRITY
VulnerabilityResource.name or cveId	UID
VulnerabilityResource.name or cveId	NAME
VulnerabilityResource.severity	SOURCE_SEVERITY
VulnerabilityResource.severityScore	SOURCE_SEVERITY_SCORE

Operations & API

Operations & API

Expand each connector object to see its operation options, delta-sync behavior, and the API it uses. See connector operation options for how to apply operation options (keys and values are case-sensitive).

Asset

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on xdm.asset.first_observed.

API

• Type: REST · Endpoint: POST /public_api/v1/assets
• Default filters: AND wrapper; delta filter only

Alert

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on creation_time.

API

• Type: REST · Endpoint: POST /public_api/v1/alerts/get_alerts
• Default filters: None (filters are added only when a delta token or operation option is set)

Alert Definition

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on creation_time.

API

• Type: REST · Endpoint: POST /public_api/v1/alerts/get_alerts
• Default filters: None (filters are added only when a delta token or operation option is set)

Endpoint

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on first_seen.

API

• Type: REST · Endpoint: POST /public_api/v1/endpoints/get_endpoint
• Default filters: None (filters are added only when a delta token or operation option is set)

Incident

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on creation_time.

API

• Type: REST · Endpoint: POST /public_api/v1/incidents/get_incidents
• Default filters: None (filters are added only when a delta token or operation option is set)

Incident Definition

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on creation_time.

API

• Type: REST · Endpoint: POST /public_api/v1/incidents/get_incidents
• Default filters: None (filters are added only when a delta token or operation option is set)

Software

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on timeframe.from.

API

• Type: XQL query (REST transport) · Endpoint: POST /public_api/v1/xql/start_xql_query/

Installed Software

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on timeframe.from.

API

• Type: XQL query (REST transport) · Endpoint: POST /public_api/v1/xql/start_xql_query/

Violation

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on timestamp.

API

• Type: REST · Endpoint: POST /public_api/v1/device_control/get_violations
• Default filters: None (filters are added only when a delta token or operation option is set)

Violation Definition

Operation options

This object does not support any operation options.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on timestamp.

API

• Type: REST · Endpoint: POST /public_api/v1/device_control/get_violations
• Default filters: None (filters are added only when a delta token or operation option is set)

Vulnerability

Operation options

Option	Type	Default	Description
affected_hosts	String (comma-separated)	—	Limits findings to specific hosts; appended to the XQL as a filter endpoint_name in (...) clause
endpoint_id_shards	Integer (power of 16)	16	Number of endpoint_id shards the va_endpoints query is fanned out across. The connector generates zero-padded hex prefixes of length log16(N) and runs one XQL query per prefix, unioning results client-side. 1 disables sharding; 256 (two-hex-char) and 4096 (three-hex-char) suit tenants where 16 shards still breach the 1,000,000-row cap. Non-power-of-16 values are rejected with an error.

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on timeframe.from.

API

• Type: XQL query (REST transport) · Endpoint: POST /public_api/v1/xql/start_xql_query/

note

• The sync runs this query once per endpoint_id hex-prefix shard (16 by default, configurable via the endpoint_id_shards operation option; must be a power of 16). Sharding keeps each query under Cortex XDR's 1,000,000-row XQL result cap on large tenants.
• | arrayexpand cves is deliberately not used — the post-expand row count breaches the same cap. The (endpoint, CVE) fan-out is performed client-side over the row's cves array instead.
• The | filter endpoint_id and | filter endpoint_name clauses appear only when sharding is active and when the affected_hosts option is set, respectively.

---

Vulnerability Definition

Operation options

Option	Type	Default	Description
affected_hosts	String (comma-separated)	—	Filters to one or more affected hosts; split on commas and appended to the XQL query as an in filter

Delta sync

Supported. The connector performs an incremental (delta) sync via the since sync token, filtering on timeframe.from.

API

• Type: XQL query (REST transport) · Endpoint: POST /public_api/v1/xql/start_xql_query/

Changelog

Changelog

The Cortex XDR Connector connector has undergone the following changes:

Version	Description	Migration Steps
3.1.0	Improvements - Advanced Authentication: per-request nonces are now generated with a cryptographically secure random source, hardening the Advanced API key signing against nonce prediction.	N/A
3.0.6	No changes in this release.	N/A
3.0.5	Improvements - Vulnerability Findings: switched the Vulnerability object source from va_cves (one row per CVE with a list of affected hosts) to va_endpoints (one row per endpoint with a cves array, fanned out client-side to one ConnectorObject per (endpoint, CVE)). Eliminates the high-cardinality targets relationship that was triggering the 20,000-relationship limit and the 2–3 minute UI loads. XQL arrayexpand cves is intentionally not used — the post-expand row count breaches Cortex XDR's 1,000,000-row XQL result cap on large tenants and was silently truncating the sync. - Vulnerability Definition continues to source from va_cves and is unchanged. Per-CVE severity/CVSS metadata stays on the Definition; per-host findings link via TYPE = cve_id. - XQL stream parsing in CortexXdrModel no longer buffers the entire NDJSON response in memory before iterating — rows are consumed as they are parsed. Required for va_endpoints (millions of rows on large tenants) and benefits Software / Installed Software syncs as well. - Vulnerability Sharding: the va_endpoints XQL query is now sharded by endpoint_id hex prefix and run once per shard, with results unioned client-side, so tenants with >1M endpoints no longer get truncated at the 1,000,000-row XQL result cap. The shard count is configurable per sync via the endpoint_id_shards OperationOption (must be a power of 16): default 16, bump to 256 for tenants beyond ~16M endpoints, or set to 1 to disable sharding.	• Vulnerability: UID is now MD5(endpoint_id + cve_id) (was cve_id). TARGETS and HOSTNAMES continue to carry the host name (now single-valued per finding) so UDM Vulnerability→Asset correlation rules keep working. The schema lost AFFECTED_HOSTS, AFFECTED_HOSTS_COUNT, MODIFICATION_DATE, IS_EXCLUDED, AFFECTED, EXPLOITABILITY_SCORE, IMPACT_SCORE, CONFIDENTIALITY, INTEGRITY, AVAILABILITY, PUBLISHED_DATE (those metrics live on Vulnerability Definition); it gained ENDPOINT_ID, ENDPOINT_TYPE, MAX_SEVERITY / MAX_SEVERITY_SCORE (host-overall worst, not per-CVE), LAST_FOUND (= last_calculation_time). Action: re-sync. • License: the va_endpoints dataset requires Cortex XDR Pro per Endpoint (Host Insights) — same license tier as va_cves.
3.0.4	Improvements - Added a configurable Page Size setting for XDR API requests, allowing control over the number of records fetched per API call (1–100, default 100). - Improved asset retrieval with dedicated pagination logic, ensuring more reliable data fetching for large asset inventories. - API response fields are now handled as optional, improving connector resilience when the API returns incomplete responses. Bug Fixes - Fixed the Group IDs attribute data type from text to numeric to correctly match the values returned by the Cortex XDR API.	• Asset: Group IDs attribute data type changed from String to Integer — Action: re-sync.
3.0.3	New Features - Vulnerability and Vulnerability Definition models are now synchronized, surfacing per-host vulnerability findings alongside the CVE-level definitions (severity, CVSS, and related metadata) discovered through Cortex XDR.	N/A
3.0.2	Improvements - Streamlined the Asset schema by removing rarely populated agent, host OS, and identity-exposure attributes, keeping the synchronized asset record focused on the fields customers actually use. - Reorganized XDR API request handling and endpoint definitions for more reliable data retrieval. Bug Fixes - Corrected the Action Remote Port attribute on the Alert model to a numeric type so port values are stored and queried as numbers.	• Asset: the Type id attribute was renamed to Type ID (a new Type name attribute was also added), and the Agent identifier, Agent version, Agent install time, OS family/distribution/release, and identity-exposure attributes were removed from the schema — Action: re-sync. • Alert: the Action remote port attribute data type changed from text to numeric — Action: re-sync.
3.0.1	New Features - Software and Installed Software models are now synchronized, providing visibility into the software inventory reported by Cortex XDR host endpoints.	N/A
3.0.0	Overview The Cortex XDR connector integrates with Palo Alto Networks Cortex XDR to synchronize endpoint and asset inventory along with the alerts, incidents, and policy violations raised across the environment. Category: Extended Detection and Response Models	N/A