Palo Alto Networks Cortex XSOAR API

Name: Cortex XSOAR API
Brand: Cortex XSOAR API
Availability: InStock

✓ Official Vendor SpecSecurityThreat DetectionapiKey27 Endpoints

Install Jentic One Beta

Connect the Cortex XSOAR API to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Cortex XSOAR API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Capabilities

What an agent can do with Cortex XSOAR API.

Search, create, update, and close security incidents with custom fields and severity

Manage indicators of compromise (IOCs) including IPs, domains, URLs, hashes, and emails

Execute playbooks and automation scripts for incident response workflows

GET STARTED

Start building with Cortex XSOAR API

Explore with Jentic

View OpenAPI Document

For Agents

Manage Cortex XSOAR incidents, indicators, playbooks, war rooms, evidence, users, and automation scripts for security orchestration and response workflows.

Use for: Create a new security incident in XSOAR, Search for incidents by severity or status, Add an indicator of compromise to XSOAR, Execute a playbook on an incident

Not supported: Does not generate threat intelligence, scan networks, or perform endpoint detection - use for orchestrating multi-tool security workflows, managing incidents, and executing playbooks only. Security data comes from integrated tools like SIEM, EDR, and threat intel feeds.

Palo Alto Networks Cortex XSOAR (formerly Demisto) is a Security Orchestration, Automation and Response (SOAR) platform. The REST API provides endpoints for managing incidents, indicators of compromise (IOCs), playbooks, integrations, war rooms, evidence, users, roles, investigations, and automation scripts. The API supports incident lifecycle management from creation through investigation, enrichment, remediation, and closure, with playbook execution, indicator enrichment, and evidence tracking. Authentication uses API keys passed in the Authorization header.

Use Cases

Patterns agents use Cortex XSOAR API for, with concrete tasks.

★ Automated Incident Creation from SIEM Alerts

Automatically create XSOAR incidents from SIEM alerts, threat intelligence feeds, or monitoring systems. POST /incident with name, type, severity, customFields, and labels creates a new incident that triggers playbook execution. This supports workflows where alerts from Splunk, QRadar, or Sentinel are converted into XSOAR incidents for orchestrated response, with deduplication based on alert fingerprints.

POST /incident with IncidentCreate payload containing name, type, severity, customFields, and labels to trigger playbook-driven response.

Indicator Enrichment and Threat Intelligence

Enrich security incidents with indicators of compromise (IOCs) by creating or updating indicators via the API. Indicators include IP addresses, domains, URLs, file hashes, and email addresses with reputation scores, threat actor associations, and expiration dates. This supports automated threat intel ingestion from STIX/TAXII feeds, VirusTotal, or custom sources, centralizing IOC data for playbook-driven enrichment.

POST /indicators/create with indicator type, value, reputation, and metadata to populate the XSOAR threat intel database.

Playbook Execution and Orchestration

Trigger playbook execution on incidents programmatically to automate investigation and remediation workflows. Playbooks define sequences of actions like enriching IOCs, querying EDR, isolating endpoints, notifying stakeholders, and closing incidents. The API supports starting playbooks, querying their status, and retrieving outputs, enabling external systems to orchestrate XSOAR workflows in response to real-time threats.

POST /playbook/execute with incidentId and playbookId to trigger automated response workflows.

War Room Collaboration and Evidence Tracking

Manage war rooms for collaborative incident investigation by adding notes, evidence, and attachments via the API. War rooms aggregate timeline data, analyst comments, IOC lookups, and external tool outputs. POST /entry creates war room entries with markdown-formatted notes, file attachments, or structured evidence like EDR query results. This supports multi-analyst investigations and audit-ready incident documentation.

POST /entry with incidentId, contents, and tags to add investigation notes, evidence, or attachments to the war room.

AI Agent for SOC Automation

Let an AI agent handle SOC workflows like creating incidents from alerts, enriching IOCs, executing playbooks, adding analysis notes, and closing incidents with resolution summaries. Through Jentic, the agent searches by intent (e.g., 'create xsoar incident'), loads the schema, and executes with the API key injected securely, enabling conversational security orchestration.

Use Jentic search 'create xsoar incident' to find POST /incident, load schema, execute with name, type, severity, and customFields.

Key Endpoints

27 endpoints — palo alto networks cortex xsoar (formerly demisto) is a security orchestration, automation and response (soar) platform.

METHOD

PATH

DESCRIPTION

POST

/incident

Create a new incident

POST

/incidents/search

Search incidents with filters

POST

/incident/update

Update an incident

POST

/indicators/create

Create an indicator

POST

/playbook/execute

Execute a playbook on an incident

POST

/entry

Add a war room entry

POST

/incident

Create a new incident

POST

/incidents/search

Search incidents with filters

POST

/incident/update

Update an incident

POST

/indicators/create

Create an indicator

POST

/playbook/execute

Execute a playbook on an incident

POST

Why Jentic?

Three things that make agents converge on Jentic-routed access.

Credential isolation

Your Cortex XSOAR key is stored once, encrypted, by your own Jentic One instance and injected as the Authorization header at execution time. It never enters the agent's prompt, logs, or context.

Intent-based discovery

Agents search Jentic by intent such as 'create an XSOAR incident' or 'execute a playbook', and Jentic returns the matching Cortex XSOAR operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

Time to first call

FAQs

Specific to using Cortex XSOAR API through Jentic.

What authentication does the Cortex XSOAR API use?

The Cortex XSOAR API uses API key authentication via the Authorization header. API keys are generated in the XSOAR web interface under Settings > Integrations > API Keys. Through Jentic, keys are stored encrypted and injected at execution time.

Can I create incidents programmatically with the XSOAR API?

Yes. POST /incident with name, type, severity, customFields, and labels creates a new incident. This supports automated incident creation from SIEM alerts, threat intel feeds, and monitoring systems.

How do I execute a playbook via the XSOAR API?

Use POST /playbook/execute with incidentId and playbookId to trigger playbook execution. Playbooks automate investigation and remediation workflows like IOC enrichment, endpoint isolation, and stakeholder notification.

Does the XSOAR API support indicator management?

Yes. The API provides endpoints for creating, updating, and searching indicators of compromise (IOCs) including IPs, domains, URLs, hashes, and emails with reputation scores and threat intel metadata.

Is the Cortex XSOAR API free?

Cortex XSOAR is a commercial SOAR platform from Palo Alto Networks with various licensing tiers. The API is included with XSOAR licenses. Contact Palo Alto Networks for pricing details.

Can I add evidence to incidents via the API?

Yes. Use POST /entry with incidentId, contents, and tags to add notes, evidence, or attachments to incident war rooms. This supports collaborative investigation and audit-ready documentation.

Can I limit what my agent is allowed to do with the Cortex XSOAR API?

Yes. Because you run Jentic One yourself, your own rules decide which Cortex XSOAR operations and credentials the agent may use. Since XSOAR takes incident and indicator targets in the request body rather than the URL path, you scope the agent to the specific operations it needs, such as creating incidents with POST /incident or searching them with POST /incidents/search. Higher-impact operations like executing a playbook with POST /playbook/execute stay off limits unless you explicitly grant them.

Palo Alto Networks Cortex XSOAR API

Connect the Cortex XSOAR API to your agent

Capabilities

Start building with Cortex XSOAR API

Use Cases

Key Endpoints

Why Jentic?

Related APIs

FAQs