Palo Alto Networks Cortex XSIAM REST API

REST API for the Cortex XSIAM (Extended Security Intelligence and Automation Management) AI-driven security operations platform. Provides programmatic access to incidents, alerts, endpoints, XQL queries, assets, audit logs, and data source ingestion. XSIAM extends Cortex XDR with a full SOC platform including SIEM, SOAR, and threat intelligence capabilities. Authentication uses a custom HMAC-SHA256 scheme: generate an API key ID and secret from the XSIAM settings, then include x-xdr-auth-id, x-x

• Cloud Security
• Cybersecurity
• Firewall
• Network Security
• SASE
• SOAR
• Threat Intelligence
• XDR
• Postman Collection

Overview

Palo Alto Networks Cortex XSIAM REST API is a Postman Collection published by Palo Alto Networks on the APIs.io network.

REST API for the Cortex XSIAM (Extended Security Intelligence and Automation Management) AI-driven security operations platform. Provides programmatic access to incidents, alerts, endpoints, XQL queries, assets, audit logs, and data source ingestion. XSIAM extends Cortex XDR with a full SOC platform including SIEM, SOAR, and threat intelligence capabilities. Authentication uses a custom HMAC-SHA256 scheme: generate an API key ID and secret from the XSIAM settings, then include x-xdr-auth-id, x-x

The collection contains 8 requests organised into 16 folders.

Tagged areas include Cloud Security, Cybersecurity, Firewall, Network Security, and SASE.

Requests & Folders

incidents

alerts

xql

assets

endpoints

audits

ingestion