> For the complete documentation index, see [llms.txt](https://docs.threatdefence.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.threatdefence.com/siem-integrations/endpoint-protection/cortex-xdr.md).

# Cortex XDR

By integrating **Cortex XDR** with **ThreatDefence** via Cortex XDR’s APIs, you can seamlessly ingest alerts into ThreatDefence and take advantage of Cortex XDR’s advanced alert stitching and investigation features.

This integration enables ThreatDefence to manage incidents by reviewing and updating incident details, statuses, and assignees directly within your existing workflows. Additionally, ThreatDefence can:

* Retrieve detailed endpoint information
* Trigger response actions on endpoints
* Deploy installation packages through Cortex XDR APIs .

This enhances automation, visibility, and response across your security environment.

***

## Prerequisites

Before proceeding, please ensure that Cortex XDR is properly configured and activated with the necessary permissions.\
If it hasn’t been set up yet, refer to the onboarding checklist here:\
[➡ Cortex XDR Onboarding Checklist](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Cloud-Documentation/Cortex-XDR-onboarding-checklist)

***

## Step 1. Obtain Cortex XDR API Key

1. Access the **Cortex XDR Application Dashboard**.
2. Navigate to **Settings → Configurations**.

   ![Cortex XDR Settings](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-ae10ea3133c867460c95b4b05dacd48b871e5f59%2Fcortex-image1.png?alt=media)
3. Go to **Integrations → API Keys**.

   ![Cortex XDR API Keys](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-1e33b69a5b703608018c7be440d5b520e61f2e8f%2Fcortex-image2.png?alt=media)
4. Select **+ New Keys**.
5. Assign the **Advanced** security level.

   ![Cortex XDR New API Key](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-6489dde8968e4267c9e196c3b2335d7017a8dfbb%2Fcortex-image3.png?alt=media)
6. Copy the **API Key**.

   ![Cortex XDR Copy API Key](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-b09343f9ecc8712b8aa28c6ed2e7209fa7486384%2Fcortex-image4.png?alt=media)

***

## Step 2. Obtain Cortex XDR API ID

1. Navigate to the **API Keys** page.
2. Copy the **API ID** value for the created API Key.

   ![Cortex XDR API ID](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-0162abb16b73d1362901021cd4143949b53b370a%2Fcortex-image5.png?alt=media)

***

## Step 3. Obtain Cortex XDR FQDN

1. On the **API Keys** page, right-click your created API Key and select **View Example**.

   ![Cortex XDR View Example](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-f9d4193cadc07863c4db206194866f60354d9b29%2Fcortex-image6.png?alt=media)
2. Review the CURL Example URL — it contains your unique **FQDN**, for example:

```
https://TENANT.xdr.us.paloaltonetworks.com/
```

![Cortex XDR FQDN Example](https://4191868192-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FOlFHF8fl339QOw3Og8L7%2Fuploads%2Fgit-blob-704dc8ed2af55b7462fa1eaa000fc22194cd0d68%2Fcortex-image7.png?alt=media)

***

## Step 4. Configure ThreatDefence Integration

Provide the following information to ThreatDefence:

* API Key
* API ID
* Cortex URL (FQDN)

***


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.threatdefence.com/siem-integrations/endpoint-protection/cortex-xdr.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.