Palo Alto Networks Cortex XSOAR API
Browse all Paloaltonetworks APIs✓ Official Vendor SpecSecuritySoarapiKey27 EndpointsREST
For Agents
Manage Cortex XSOAR incidents, indicators, playbooks, war rooms, evidence, users, and automation scripts for security orchestration and response workflows.
Use for: Create a new security incident in XSOAR, Search for incidents by severity or status, Add an indicator of compromise to XSOAR, Execute a playbook on an incident
Not supported: Does not generate threat intelligence, scan networks, or perform endpoint detection — use for orchestrating multi-tool security workflows, managing incidents, and executing playbooks only. Security data comes from integrated tools like SIEM, EDR, and threat intel feeds.
Palo Alto Networks Cortex XSOAR (formerly Demisto) is a Security Orchestration, Automation and Response (SOAR) platform. The REST API provides endpoints for managing incidents, indicators of compromise (IOCs), playbooks, integrations, war rooms, evidence, users, roles, investigations, and automation scripts. The API supports incident lifecycle management from creation through investigation, enrichment, remediation, and closure, with playbook execution, indicator enrichment, and evidence tracking. Authentication uses API keys passed in the Authorization header.
Install Jentic One Beta
Connect the Cortex XSOAR API to your agent
Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Cortex XSOAR API, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.
Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.
1
Step 1: Jentic One Host machine
# On the machine that will host your Jentic One instance:
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh2
Step 2: Agent machine
# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL https://raw.githubusercontent.com/jentic/jentic-one/main/tools/install.sh | sh
jentic register # connects your agent to your Jentic One instanceJentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.
Capabilities
What an agent can do with Cortex XSOAR API.
Search, create, update, and close security incidents with custom fields and severity
Manage indicators of compromise (IOCs) including IPs, domains, URLs, hashes, and emails
Execute playbooks and automation scripts for incident response workflows
Add evidence, notes, and attachments to incidents and war rooms
Manage war rooms for collaborative incident investigation
Administer users, roles, and permissions for XSOAR access control
Query and manage integrations with third-party security tools
Track investigations and incident timelines
Use Cases
Patterns agents use Cortex XSOAR API for, with concrete tasks.
★ Automated Incident Creation from SIEM Alerts
Automatically create XSOAR incidents from SIEM alerts, threat intelligence feeds, or monitoring systems. POST /incident with name, type, severity, customFields, and labels creates a new incident that triggers playbook execution. This supports workflows where alerts from Splunk, QRadar, or Sentinel are converted into XSOAR incidents for orchestrated response, with deduplication based on alert fingerprints.
POST /incident with IncidentCreate payload containing name, type, severity, customFields, and labels to trigger playbook-driven response.
Indicator Enrichment and Threat Intelligence
Enrich security incidents with indicators of compromise (IOCs) by creating or updating indicators via the API. Indicators include IP addresses, domains, URLs, file hashes, and email addresses with reputation scores, threat actor associations, and expiration dates. This supports automated threat intel ingestion from STIX/TAXII feeds, VirusTotal, or custom sources, centralizing IOC data for playbook-driven enrichment.
POST /indicators/create with indicator type, value, reputation, and metadata to populate the XSOAR threat intel database.
Playbook Execution and Orchestration
Trigger playbook execution on incidents programmatically to automate investigation and remediation workflows. Playbooks define sequences of actions like enriching IOCs, querying EDR, isolating endpoints, notifying stakeholders, and closing incidents. The API supports starting playbooks, querying their status, and retrieving outputs, enabling external systems to orchestrate XSOAR workflows in response to real-time threats.
POST /playbook/execute with incidentId and playbookId to trigger automated response workflows.
War Room Collaboration and Evidence Tracking
Manage war rooms for collaborative incident investigation by adding notes, evidence, and attachments via the API. War rooms aggregate timeline data, analyst comments, IOC lookups, and external tool outputs. POST /entry creates war room entries with markdown-formatted notes, file attachments, or structured evidence like EDR query results. This supports multi-analyst investigations and audit-ready incident documentation.
POST /entry with incidentId, contents, and tags to add investigation notes, evidence, or attachments to the war room.
AI Agent for SOC Automation
Let an AI agent handle SOC workflows like creating incidents from alerts, enriching IOCs, executing playbooks, adding analysis notes, and closing incidents with resolution summaries. Through Jentic, the agent searches by intent (e.g., 'create xsoar incident'), loads the schema, and executes with the API key injected securely, enabling conversational security orchestration.
Use Jentic search 'create xsoar incident' to find POST /incident, load schema, execute with name, type, severity, and customFields.
Key Endpoints
27 endpoints — palo alto networks cortex xsoar (formerly demisto) is a security orchestration, automation and response (soar) platform.
METHOD
PATH
DESCRIPTION
POST
/incident
Create a new incident
POST
/incidents/search
Search incidents with filters
POST
/incident/update
Update an incident
POST
/indicators/create
Create an indicator
POST
/playbook/execute
Execute a playbook on an incident
POST
/entry
Add a war room entry
POST
/incident
Create a new incident
POST
/incidents/search
Search incidents with filters
POST
/incident/update
Update an incident
POST
/indicators/create
Create an indicator
POST
/playbook/execute
Execute a playbook on an incident
POST
/entry
Add a war room entry
Why Jentic?
Three things that make agents converge on Jentic-routed access.
Credential isolation
Cortex XSOAR API keys are stored encrypted in the Jentic vault and injected as the Authorization header at execution time. Raw keys never appear in agent prompts, transcripts, or response payloads.
Intent-based discovery
Agents search by intent such as 'create xsoar incident' or 'execute xsoar playbook' and Jentic returns the matching endpoint with its schema and required parameters.
Time to first call
Direct Cortex XSOAR integration: 2-4 days to model incidents, indicators, playbooks, and war rooms. Through Jentic: under 1 hour — search, load schema, execute.
Related APIs
Alternatives and complements available in the Jentic catalogue.
FAQs
Specific to using Cortex XSOAR API through Jentic.
What authentication does the Cortex XSOAR API use?
The Cortex XSOAR API uses API key authentication via the Authorization header. API keys are generated in the XSOAR web interface under Settings > Integrations > API Keys. Through Jentic, keys are stored encrypted and injected at execution time.
Can I create incidents programmatically with the XSOAR API?
Yes. POST /incident with name, type, severity, customFields, and labels creates a new incident. This supports automated incident creation from SIEM alerts, threat intel feeds, and monitoring systems.
How do I execute a playbook via the XSOAR API?
Use POST /playbook/execute with incidentId and playbookId to trigger playbook execution. Playbooks automate investigation and remediation workflows like IOC enrichment, endpoint isolation, and stakeholder notification.
Does the XSOAR API support indicator management?
Yes. The API provides endpoints for creating, updating, and searching indicators of compromise (IOCs) including IPs, domains, URLs, hashes, and emails with reputation scores and threat intel metadata.
Is the Cortex XSOAR API free?
Cortex XSOAR is a commercial SOAR platform from Palo Alto Networks with various licensing tiers. The API is included with XSOAR licenses. Contact Palo Alto Networks for pricing details.
Can I add evidence to incidents via the API?
Yes. Use POST /entry with incidentId, contents, and tags to add notes, evidence, or attachments to incident war rooms. This supports collaborative investigation and audit-ready documentation.
GET STARTED