Integrations Palo Alto Cortex XSIAM
Integration · XDR, SIEM and SOAR
Put an autonomous SOC on top of Cortex XSIAM.
Many security teams have consolidated SIEM, XDR and automation on Palo Alto Cortex XSIAM. ApexAI works on top of that investment instead of replacing it. It reads your incidents, alerts and assets read-only, investigates them against the evidence already held in XSIAM, and proposes playbooks your team can import, review and run on its own terms.
Status: Preview A read-only XSIAM connection runs in observe mode: incidents, alerts and assets feed investigation, and playbook proposals are prepared for import but never run by ApexAI.
Judgment on top of the platform you chose
XSIAM already groups alerts into incidents and runs automation. What teams still spend their time on is the judgment around it: is this incident real, what else did this host or user do, did the attack succeed, and is a response safe for this asset. ApexAI is built to take on that work, check its conclusions against the raw evidence in your platform, and hand people a short, cited brief instead of another queue.
The connection is read-only by design. Only read operations are allowed; response actions, content changes and anything that touches secrets are refused inside ApexAI before they reach your tenant, whatever rights the API key has. Queries stay within the time window and size limits set for them, and ApexAI keeps to a modest share of your query capacity so your own analysts are never squeezed out.
What XSIAM brings into ApexAI
Incidents and alerts
Security alerts and incidents pulled close to real time and tied to the hosts, users and IP addresses they concern. Posture findings are counted rather than flooding the case queue.
Device verdicts
Whether the platform blocked, detected or only scanned is kept as evidence on the entity, not guessed.
Assets
Hosts, identities, domains and cloud resources from your inventory, with facts such as operating system, agent and isolation state.
Investigation in place
Incident details, related alerts, MITRE ATT&CK techniques and file artifacts are read from XSIAM, and hunting queries run against your datasets as query capacity allows.
Your datasets, understood
A map of which datasets and fields exist and what they mean, so queries match your real data. Only the shape of the data is recorded, never its values.
Tenant separation
Each XSIAM source is bound to its ApexAI tenant by a platform operator. Until it is bound, its data is visible to no workspace.
Import-ready playbooks, your SOAR stays yours
ApexAI does not run your SOAR. Based on what it learns from your incidents and alerts during onboarding, it drafts playbook and automation proposals in the XSIAM format, each with the reason it exists, its triggers, its inputs and outputs and a test plan. Your team decides whether to import one, tests it in its own environment first, and stays in charge of what runs.
The proposed playbooks only enrich, triage and investigate. Every response step, such as isolating a host, blocking an indicator or resetting a password, is left as a manual task for a person to approve.
How the integration rolls out
01
Read-only key
You create an API key with view rights only. ApexAI reports any read permission still missing.
02
Observe
Data is pulled on a schedule and checked for freshness and completeness, without influencing any verdict.
03
Pilot
Once the source is bound and every health check stays green, XSIAM evidence starts feeding cases, briefs and verdicts for that tenant.
04
On
Moving from pilot to full use is a person’s decision. If a health check fails, the source falls back to observe mode on its own.
Questions
Is Cortex XSIAM supported today?
Yes, in preview. ApexAI reads incidents, alerts and assets read-only and uses them in observe mode while results are compared with your team’s.
Will ApexAI run playbooks or response actions in XSIAM?
No. It prepares playbook and automation proposals for your team to import and review. Response steps stay manual tasks, and any future response goes through proposals that people approve.
Will ApexAI use up my XQL query capacity?
ApexAI checks the remaining capacity before each query, keeps to a small daily share and does not start a query when capacity is low. Hunts that need more wait until capacity is available.
See ApexAI on your own alerts.
A walkthrough with your team, in observe mode first: ApexAI scores and proposes, nothing acts on its own.