---
id: palo-alto-cortex-xdr
title: Palo Alto Cortex XDR
sidebar_label: Palo Alto Cortex XDR
description: The Sumo Logic app for Palo Alto Cortex XDR provides comprehensive visibility and analysis of alerts and incidents to improve overall security posture.
slug: /help/docs/integrations/saas-cloud/palo-alto-cortex-xdr/
canonical: https://www.sumologic.com/help/docs/integrations/saas-cloud/palo-alto-cortex-xdr/
---

import useBaseUrl from '@docusaurus/useBaseUrl';

<img src={useBaseUrl('/img/integrations/security-threat-detection/pan6.png')} alt="Palo Alto icon" width="100"/>

The Sumo Logic app for Palo Alto Cortex XDR provides comprehensive visibility and analysis of alerts and incidents from the Palo Alto Networks Cortex XDR platform. Our app empowers your security teams to proactively monitor and respond to security threats, strengthen incident response processes, improve overall security posture, and protect critical assets from advanced threats and attacks.

Key features of the Palo Alto Networks Cortex XDR app include:
- **Real-Time Monitoring**. Gain real-time visibility into security events and incidents across your organization's infrastructure. Monitor and analyze alerts, threats, and suspicious activities to detect and promptly respond to potential threats.
- **Interactive Dashboards**. Explore interactive dashboards that provide a holistic view of alerts, incidents, and threat intelligence. Visualize data with pre-built charts, graphs, and tables to understand trends, patterns, and anomalies.
- **Incident Management**. Streamline incident management processes by tracking security incidents. Monitor incident status, and collaborate with your security team for effective incident response.

## Log types

This app uses [Palo Alto Cortex XDR](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/palo-alto-cortex-xdr-source/) source to collect [alerts](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Alerts) and [incidents](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Prevent-Administrator-Guide/Incidents) from Palo Alto Cortex XDR.

## Sample log messages

<details>
<summary>View Sample Log Message</summary>

```json title="Alert Message"
{
   "action": "DETECTED",
   "action_pretty": "Detected",
   "agent_os_sub_type": "Windows 11 [10.0 (Build 22621)]",
   "agent_os_type": "Windows",
   "agent_version": "7.9.1.26645",
   "alert_id": "161",
   "alert_type": "Unclassified",
   "bioc_category_enum_key": "IP",
   "category": "IP",
   "description": "IOC ( IP = 103.36.10.156 )",
   "detection_timestamp": 1677153320321,
   "endpoint_id": "eba0735df9a24a67b95b75ecfdf3c77f",
   "external_id": "6d6806d1-dbc2-4da0-b3b6-b16d097f20eb",
   "host_ip": [
      "192.168.5.5"
   ],
   "host_name": "DESKTOP-DLU1NRR",
   "is_pcap": false,
   "is_whitelisted": false,
   "local_insert_ts": 1677153820311,
   "matching_service_rule_id": "5",
   "matching_status": "MATCHED",
   "name": "IOC (103.36.10.156)",
   "original_tags": [
      "DS:PANW/XDR Agent"
   ],
   "resolution_status": "STATUS_010_NEW",
   "severity": "critical",
   "source": "XDR IOC",
   "starred": false,
   "tags": [
      "DS:PANW/XDR Agent"
   ]
}
```

```json title="Incident Message"
{
  "incident_id": "4",
  "incident_name": null,
  "creation_time": 1677067079585,
  "modification_time": 1677154139505,
  "detection_time": null,
  "status": "remediated",
  "severity": "medium",
  "description": "'IOC (trunapol.xyz)' along with 139 other alerts generated by XDR Agent and XDR IOC detected on host desktop-dlu1nrr involving 2 users",
  "assigned_user_mail": "ksh@gmail.com",
  "assigned_user_pretty_name": "ksha",
  "alert_count": 140,
  "low_severity_alert_count": 0,
  "med_severity_alert_count": 25,
  "high_severity_alert_count": 35,
  "critical_severity_alert_count": 80,
  "user_count": 2,
  "host_count": 1,
  "notes": null,
  "resolve_comment": null,
  "resolved_timestamp": null,
  "manual_severity": null,
  "manual_description": null,
  "xdr_url": "https://sumologic-partner.xdr.us.paloaltonetworks.com/incident-view?caseId=4",
  "starred": false,
  "hosts": [
    "desktop-dlu1nrr:eba0735df9a24a67b95b75ecfdf3c77f"
  ],
  "users": [
    "n/a\\crest_sophos_logs_",
    "desktop-dlu1nrr\\crest_sophos_logs_"
  ],
  "incident_sources": [
    "XDR Agent",
    "XDR IOC"
  ],
  "rule_based_score": null,
  "predicted_score": null,
  "manual_score": null,
  "aggregated_score": null,
  "wildfire_hits": 20,
  "alerts_grouping_status": "Disabled",
  "mitre_tactics_ids_and_names": [
    "TA0002 - Execution",
    "TA0006 - Malfunction Check"
  ],
  "mitre_techniques_ids_and_names": [
    "TA0002 - Execution",
    "TA0006 - Malfunction Check"
  ],
  "alert_categories": [
    "Domain Name",
    "File Name",
    "IP",
    "Malware"
  ],
  "original_tags": [
    "DS:PANW/XDR Agent"
  ],
  "tags": [
    "DS:PANW/XDR Agent"
  ]
}
```

</details>

## Sample queries

<details>
<summary>View sample queries</summary>

```sumo title="Alerts Triggered"
_sourceCategory="palo_alto_cortex_xdr" "alert_id" "is_whitelisted"
| json "alert_id","name","severity","source","host_ip","alert_type","action_pretty","agent_os_type","category","detection_timestamp","is_whitelisted","resolution_status" as alert_id,name,severity,source,host_ip,alert_type,action_pretty,agent_os_type,category,detection_timestamp,is_whitelisted,resolution_status nodrop
| action_pretty as action
| where severity matches "{{severity}}"
| where category matches "{{category}}"
| where source matches "{{source}}"
| where action matches "{{action}}"
| where agent_os_type matches "{{agent_os}}"
| where alert_type matches "{{alert_type}}"
| where is_whitelisted matches "{{is_whitelisted}}"
| count_distinct(alert_id)
```

```sumo title="Incidents Created"
_sourceCategory="palo_alto_cortex_xdr" "incident_id" "incident_name"
| json "incident_id","incident_name","creation_time","modification_time","status","severity","assigned_user_mail","alert_count","high_severity_alert_count","critical_severity_alert_count","user_count","xdr_url","wildfire_hits","alerts_grouping_status","mitre_tactics_ids_and_names","mitre_techniques_ids_and_names" as incident_id,incident_name,creation_time,modification_time,status,severity,assigned_user_mail,alert_count,high_severity_alert_count,critical_severity_alert_count,user_count,xdr_url,wildfire_hits,alerts_grouping_status,mitre_tactics_ids_and_names,mitre_techniques_ids_and_names nodrop
| where alerts_grouping_status matches"{{alerts_grouping_status}}"
| where severity matches "{{severity}}"
| where status matches "{{status}}"
| count_distinct(incident_id)
```
</details>

## Collection configuration and app installation

import CollectionConfiguration from '../../reuse/apps/collection-configuration.md';

<CollectionConfiguration/>

:::important
Use the [Cloud-to-Cloud Integration for Palo Alto Cortex XDR](/docs/send-data/hosted-collectors/cloud-to-cloud-integration-framework/palo-alto-cortex-xdr-source) to create the source and use the same source category while installing the app. By following these steps, you can ensure that your Palo Alto Cortex XDR app is properly integrated and configured to collect and analyze your Palo Alto Cortex XDR data.
:::

### Create a new collector and install the app

import AppCollectionOPtion1 from '../../reuse/apps/app-collection-option-1.md';

<AppCollectionOPtion1/>

### Use an existing collector and install the app

import AppCollectionOPtion2 from '../../reuse/apps/app-collection-option-2.md';

<AppCollectionOPtion2/>

### Use an existing source and install the app

import AppCollectionOPtion3 from '../../reuse/apps/app-collection-option-3.md';

<AppCollectionOPtion3/>

## Viewing Palo Alto Cortex XDR dashboards​

import ViewDashboards from '../../reuse/apps/view-dashboards.md';

<ViewDashboards/>

### Alerts Overview

The **Palo Alto Cortex XDR - Alerts Overview** dashboard provides real-time analysis of the alerts triggered and white-listed. This dashboard offers insights into the alerts based on severity over time, most frequent sources, types of triggered alerts,  geo location of all alerts, and alerts originating from high-risk countries. This dashboard provides information on the most frequent actions taken in response to alerts, the top categories of alerts, and a summary of recent alerts for quick reference.<br/><img src={useBaseUrl('img/integrations/saas-cloud/Palo-Alto-Cortex-XDR-Alerts-Overview.png')} alt="Palo Alto Cortex XDR Alerts Overview" width="800"/>

### Incidents Overview

The **Palo Alto Cortex XDR - Incidents Overview** dashboard provides the number of incidents created and disabled. This dashboard offers insights into the incidents based on severity over time and incidents by status. This dashboard also highlights the most frequently assigned users to handle incidents, information about the commonly observed MITRE techniques and tactics utilized, and a summary of recent incidents for quick reference.<br/><img src={useBaseUrl('img/integrations/saas-cloud/Palo-Alto-Cortex-XDR-Incidents-Overview.png')} alt="Palo Alto Cortex XDR Incidents Overview" width="800"/>

## Upgrade/Downgrade the Palo Alto Cortex XDR app (Optional)

import AppUpdate from '../../reuse/apps/app-update.md';

<AppUpdate/>

## Uninstalling the Palo Alto Cortex XDR app (Optional)

import AppUninstall from '../../reuse/apps/app-uninstall.md';

<AppUninstall/>