Connectors · Identity & security

Palo Alto Networks Cortex XSOAR MCP server for AI agents.

actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Palo Alto Networks Cortex XSOAR and the rest of your systems. It gives your agent 96 Palo Alto Networks Cortex XSOAR actions (43 reads, 37 writes and 16 that wait for a confirmation) and holds the Palo Alto Networks Cortex XSOAR credential itself, so the agent never does. It paces Palo Alto Networks Cortex XSOAR's limits and records every call.

Connect Palo Alto Networks Cortex XSOAR free See pricing

100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you.

claude mcp add --transport http actionlake https://connect.actionlake.com/mcp

96actionsin one signed file
43readlook, never change
37writecreate and update
16wait for a yesdestructive, confirmed first

Set up

Connect Palo Alto Networks Cortex XSOAR in three steps.

01
Add actionlake to Claude.
Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us.
https://connect.actionlake.com/mcp
02
Connect Palo Alto Networks Cortex XSOAR.
Header credentials. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key.
- api_keyCortex XSOAR 8 Standard API key
- api_key_idThe key's ID from the ID column of the API Keys table
- hostWhere your Palo Alto Networks Cortex XSOAR lives: your host
```
account { op: "connections.requirements", service: "palo_alto_cortex_xsoar" }
# free: exactly what to paste, and what is found for you
```

Make the first call. Check before a write.

Ask in plain words; Claude picks the action. Before anything changes, check validates the call and prices it, for free.

do    { action: "palo_alto_cortex_xsoar.users.list" }# get users · read · 1 upstream callcheck { action: "palo_alto_cortex_xsoar.api_keys.create", input: { … } }# free: inputs, permissions, cost and confirmations, nothing sent

Palo Alto Networks Cortex XSOAR at a glance

Sign-in: Header credentials. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead.
You provide: api_keyapi_key_id
Setup fields: host
Limits we pace to: 10 calls a second, per connection
API covered: Cortex XSOAR 8.x REST API (XSOAR 8 Cloud and 8.x on-prem), at your Palo Alto Networks Cortex XSOAR instance's API base URL, which you enter when connecting
Built from: Palo Alto Networks Cortex XSOAR's documentation, read 23 October 2026cortex-docs.paloaltonetworks.com cortex-docs.paloaltonetworks.com cortex-docs.paloaltonetworks.com
Service file: Version 1.0.0, signed (Ed25519)
Cached reads: 40 of 43 reads, for up to 5 minutes; a write clears what it affects
Shared entities: 6, so ask can line Palo Alto Networks Cortex XSOAR up with your other systems
Data: Processed and stored in Sydney, Australia. No US region yet

Capabilities

What an AI agent can do in Palo Alto Networks Cortex XSOAR.

96 actions in 32 areas. Every one carries its effect, so a key can allow the reads and hold the rest.

43readlook, never change
37writecreate and update
16destructivewait for a confirmation

Incidents
9
2 read · 6 write · 1 destructive
Search incidents by filter · Get a specific incident · Create an incident from JSON · Batch export incidents to CSV
Engines
6
2 read · 3 write · 1 destructive
Create an engine · Get all engines · Get details by engine ID · Update engine configuration
Indicators
6
1 read · 4 write · 1 destructive
Create an indicator · Create feed indicators from JSON · Batch export indicators to CSV · Search indicators
Integration instances
6
3 read · 2 write · 1 destructive
Fetch an integration instance's execution history · Get details on integration instances, engines, and health · Get an integration instance by its ID · Reset integration instance last run timestamp
Investigations
6
4 read · 2 write · 0 destructive
Retrieve an investigation workplan task list · Get investigation ID context · Close an investigation · Retrieve an incident investigation
Authentication settings
5
2 read · 2 write · 1 destructive
Get authentication settings for all configured domains · Create authentication settings for IdP SSO or metadata URL · Update authentication settings · Delete authentication settings by domain
Syslog servers
5
2 read · 2 write · 1 destructive
Create a syslog integration · Get all or filtered syslog servers · Test syslog integration · Update a syslog integration
Entries
4
0 read · 2 write · 2 destructive
Create a new incident War Room entry · Create new entry in existing investigation · Mark entry as note or delete entry · Set tags on incident War Room entry

24 more areas · 49 actions

Jobs 4
Lists 4
Scripts 4
Content packs 3
Credentials 3
Playbook tasks 3
Playbooks 3
API keys 2
Content 2
Content changes 2
Dashboards 2
Evidence 2
Incident fields 2
Indicator relationships 2
Users 2
Audit management logs 1
Incident types 1
Indicator exclusions 1
Integrations 1
Reports 1
Roles 1
System 1
User groups 1
Widgets 1

Top actions

The Palo Alto Networks Cortex XSOAR API, shaped for agents.

The ids your agent types, what each does, and the one name it shares with other systems. 25 of Palo Alto Networks Cortex XSOAR's 25 action names are shared with at least one other connector, so an agent learns them once.

Action	What it does	Effect	Same name in
`palo_alto_cortex_xsoar.users.list`Get users	Get users.	read	`identity.user.list`474 connectors
`palo_alto_cortex_xsoar.user_groups.list`Get user groups	Get user groups.	read	`identity.group.list`262 connectors
`palo_alto_cortex_xsoar.roles.list`Get roles	Get roles.	read	`identity.role.list`184 connectors
`palo_alto_cortex_xsoar.reports.list`Get all reports	Get all reports.	read	`analytics.report.list`37 connectors
`palo_alto_cortex_xsoar.api_keys.create`Generate an API key	Generate an API key.	destructive	`identity.api_key.create`100 connectors
`palo_alto_cortex_xsoar.playbooks.get`Get playbook by ID	Get playbook by ID.	read	`automation.workflow.get`51 connectors
`palo_alto_cortex_xsoar.authentication_settings.list`Get authentication settings for all configured domains	Get authentication settings for all configured domains.	read	`identity.identity_provider.list`22 connectors
`palo_alto_cortex_xsoar.api_keys.delete`Delete API keys	Delete API keys.	destructive	`identity.api_key.delete`76 connectors
`palo_alto_cortex_xsoar.authentication_settings.create`Create authentication settings for IdP SSO or metadata URL	Create authentication settings for IdP SSO or metadata URL.	write	`identity.identity_provider.create`15 connectors
`palo_alto_cortex_xsoar.playbooks.search`Search playbooks using queries	Search playbooks using queries.	read	`automation.workflow.search`8 connectors
`palo_alto_cortex_xsoar.authentication_settings.update`Update authentication settings	Update authentication settings.	write	`identity.identity_provider.update`17 connectors
`palo_alto_cortex_xsoar.jobs.create`Create a new job	Create a new job.	write	`infra.job.create`10 connectors

Try it

Prompts to paste into Claude.

Each one names the Palo Alto Networks Cortex XSOAR actions it will call, so you know what it reads and what it changes before you send it.

Readread
Which Palo Alto Networks Cortex XSOAR incidents are open, and how long has each been open?
callspalo_alto_cortex_xsoar.incidents.search
Writewrite
Create authentication settings for IdP SSO or metadata URL in Palo Alto Networks Cortex XSOAR. Show me exactly what you will send before you save it.
callspalo_alto_cortex_xsoar.authentication_settings.create

Governance for Palo Alto Networks Cortex XSOAR

Destructive actions wait for a yes.

16 Palo Alto Networks Cortex XSOAR actions are destructive. These are all of them:

Generate an API keypalo_alto_cortex_xsoar.api_keys.create
Delete API keyspalo_alto_cortex_xsoar.api_keys.delete
Delete authentication settings by domainpalo_alto_cortex_xsoar.authentication_settings.delete
Delete the specified jobpalo_alto_cortex_xsoar.jobs.delete
Create a new incident War Room entrypalo_alto_cortex_xsoar.entries.create
Create new entry in existing investigationpalo_alto_cortex_xsoar.entries.execute_sync
Delete a batch of incidentspalo_alto_cortex_xsoar.incidents.delete_batch
Batch delete indicators or add them to the exclusion listpalo_alto_cortex_xsoar.indicators.delete_batch
Execute task in running investigationpalo_alto_cortex_xsoar.playbook_tasks.execute
Set a user rolepalo_alto_cortex_xsoar.users.set_role
Delete a listpalo_alto_cortex_xsoar.lists.delete
Delete an enginepalo_alto_cortex_xsoar.engines.delete
Delete evidencepalo_alto_cortex_xsoar.evidence.delete
Delete credentialspalo_alto_cortex_xsoar.credentials.delete
Delete all or filtered syslog integrationspalo_alto_cortex_xsoar.syslog_servers.delete
Delete an integration instance by its IDpalo_alto_cortex_xsoar.integration_instances.delete

A destructive action runs only with confirm: true. Under the human policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after.

dopalo_alto_cortex_xsoar.api_keys.deleteconfirm_policy: human

Delete API keys?

intent: the user asked me to delete API keys

run suspended · waiting for a named person · key palo-alto-cortex-xsoar-agent cannot confirm itself

In the console, or from an emailed signed link.

a key for this connector

account {  op: "keys.create", name: "palo-alto-cortex-xsoar-agent",  allowed_actions: ["palo_alto_cortex_xsoar.*"], cap_calls: 2000,  confirm_policy: "human_for_writes",  approval_rules: [    { match: "palo_alto_cortex_xsoar.api_keys.create", approver: "[email protected]" },    { match: "palo_alto_cortex_xsoar.api_keys.delete", approver: "[email protected]" },    { match: "palo_alto_cortex_xsoar.authentication_settings.delete", approver: "[email protected]" }  ]}

Illustrative. Scoped to Palo Alto Networks Cortex XSOAR only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person.

Cost

What Palo Alto Networks Cortex XSOAR costs on actionlake.

Every Palo Alto Networks Cortex XSOAR action is one upstream call, the only thing actionlake bills. Searching, check, cost, account and any call Palo Alto Networks Cortex XSOAR refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

1upstream call per actionall 96 Palo Alto Networks Cortex XSOAR actions
96actions pageeach page of a long list is one call
40reads can be cacheda cache hit costs nothing
100,000calls a month, freepaid plans from US$49 a month for 250,000

See pricing

Action index

Every Palo Alto Networks Cortex XSOAR action.

96 actions by area: the id your agent calls, what it does, and its effect.

Incidents9

palo_alto_cortex_xsoar.incidents.closeClose an incidentwrite
palo_alto_cortex_xsoar.incidents.create_from_jsonCreate an incident from JSONwrite
palo_alto_cortex_xsoar.incidents.delete_batchDelete a batch of incidentsdestructive
palo_alto_cortex_xsoar.incidents.export_csvBatch export incidents to CSVwrite
palo_alto_cortex_xsoar.incidents.getGet a specific incidentread
palo_alto_cortex_xsoar.incidents.investigateInvestigate an incidentwrite
palo_alto_cortex_xsoar.incidents.saveCreate or update an incidentwrite
palo_alto_cortex_xsoar.incidents.searchSearch incidents by filterread
palo_alto_cortex_xsoar.incidents.update_batchUpdate incidents in a batchwrite

Engines6

palo_alto_cortex_xsoar.engines.createCreate an enginewrite
palo_alto_cortex_xsoar.engines.deleteDelete an enginedestructive
palo_alto_cortex_xsoar.engines.getGet details by engine IDread
palo_alto_cortex_xsoar.engines.listGet all enginesread
palo_alto_cortex_xsoar.engines.update_configUpdate engine configurationwrite
palo_alto_cortex_xsoar.engines.upgradeUpgrade specified engineswrite

Indicators6

palo_alto_cortex_xsoar.indicators.createCreate an indicatorwrite
palo_alto_cortex_xsoar.indicators.create_feedCreate feed indicators from JSONwrite
palo_alto_cortex_xsoar.indicators.delete_batchBatch delete indicators or add them to the exclusion listdestructive
palo_alto_cortex_xsoar.indicators.export_csvBatch export indicators to CSVwrite
palo_alto_cortex_xsoar.indicators.searchSearch indicatorsread
palo_alto_cortex_xsoar.indicators.updateEdit indicatorwrite

Integration instances6

palo_alto_cortex_xsoar.integration_instances.deleteDelete an integration instance by its IDdestructive
palo_alto_cortex_xsoar.integration_instances.getGet an integration instance by its IDread
palo_alto_cortex_xsoar.integration_instances.get_fetch_historyFetch an integration instance's execution historyread
palo_alto_cortex_xsoar.integration_instances.reset_last_runReset integration instance last run timestampwrite
palo_alto_cortex_xsoar.integration_instances.saveCreate an instance of an integrationwrite
palo_alto_cortex_xsoar.integration_instances.searchGet details on integration instances, engines, and healthread

Investigations6

palo_alto_cortex_xsoar.investigations.closeClose an investigationwrite
palo_alto_cortex_xsoar.investigations.getRetrieve an incident investigationread
palo_alto_cortex_xsoar.investigations.get_workplanGet investigation workplanread
palo_alto_cortex_xsoar.investigations.list_workplan_tasksRetrieve an investigation workplan task listread
palo_alto_cortex_xsoar.investigations.query_contextGet investigation ID contextread
palo_alto_cortex_xsoar.investigations.reopenReopen a closed incidentwrite

Authentication settings5

palo_alto_cortex_xsoar.authentication_settings.createCreate authentication settings for IdP SSO or metadata URLwrite
palo_alto_cortex_xsoar.authentication_settings.deleteDelete authentication settings by domaindestructive
palo_alto_cortex_xsoar.authentication_settings.get_metadataGet IdP metadataread
palo_alto_cortex_xsoar.authentication_settings.listGet authentication settings for all configured domainsread
palo_alto_cortex_xsoar.authentication_settings.updateUpdate authentication settingswrite

Syslog servers5

palo_alto_cortex_xsoar.syslog_servers.createCreate a syslog integrationwrite
palo_alto_cortex_xsoar.syslog_servers.deleteDelete all or filtered syslog integrationsdestructive
palo_alto_cortex_xsoar.syslog_servers.listGet all or filtered syslog serversread
palo_alto_cortex_xsoar.syslog_servers.testTest syslog integrationread
palo_alto_cortex_xsoar.syslog_servers.updateUpdate a syslog integrationwrite

Entries4

palo_alto_cortex_xsoar.entries.createCreate a new incident War Room entrydestructive
palo_alto_cortex_xsoar.entries.execute_syncCreate new entry in existing investigationdestructive
palo_alto_cortex_xsoar.entries.set_noteMark entry as note or delete entrywrite
palo_alto_cortex_xsoar.entries.set_tagsSet tags on incident War Room entrywrite

Jobs4

palo_alto_cortex_xsoar.jobs.createCreate a new jobwrite
palo_alto_cortex_xsoar.jobs.deleteDelete the specified jobdestructive
palo_alto_cortex_xsoar.jobs.searchSearch for jobsread
palo_alto_cortex_xsoar.jobs.set_statusSets the specified job to the specified statuswrite

Lists4

palo_alto_cortex_xsoar.lists.deleteDelete a listdestructive
palo_alto_cortex_xsoar.lists.getGet the specified listread
palo_alto_cortex_xsoar.lists.listGet all listsread
palo_alto_cortex_xsoar.lists.saveCreate or update a listwrite

Scripts4

palo_alto_cortex_xsoar.scripts.getGet details about a specific scriptread
palo_alto_cortex_xsoar.scripts.list_metadataGet metadata details about all scripts in this tenantread
palo_alto_cortex_xsoar.scripts.saveCreate or update a scriptwrite
palo_alto_cortex_xsoar.scripts.searchSearch scriptsread

Content packs3

palo_alto_cortex_xsoar.content_packs.get_item_dependenciesRetrieve content pack item dependenciesread
palo_alto_cortex_xsoar.content_packs.list_installedGet metadata for all installed content packsread
palo_alto_cortex_xsoar.content_packs.search_marketplaceSearch for content packsread

Credentials3

palo_alto_cortex_xsoar.credentials.deleteDelete credentialsdestructive
palo_alto_cortex_xsoar.credentials.listGet all credentialsread
palo_alto_cortex_xsoar.credentials.saveCreate or update credentialswrite

Playbook tasks3

palo_alto_cortex_xsoar.playbook_tasks.add_adhocAdd ad-hoc playbook taskwrite
palo_alto_cortex_xsoar.playbook_tasks.executeExecute task in running investigationdestructive
palo_alto_cortex_xsoar.playbook_tasks.uncompleteMark a completed task in a running playbook as not completewrite

Playbooks3

palo_alto_cortex_xsoar.playbooks.cloneDuplicate a playbookwrite
palo_alto_cortex_xsoar.playbooks.getGet playbook by IDread
palo_alto_cortex_xsoar.playbooks.searchSearch playbooks using queriesread

API keys2

palo_alto_cortex_xsoar.api_keys.createGenerate an API keydestructive
palo_alto_cortex_xsoar.api_keys.deleteDelete API keysdestructive

Content2

palo_alto_cortex_xsoar.content.check_newCheck for new contentread
palo_alto_cortex_xsoar.content.installInstall content on a production tenantwrite

Content changes2

palo_alto_cortex_xsoar.content_changes.commitPush custom content to production tenantwrite
palo_alto_cortex_xsoar.content_changes.list_uncommittedGet a list of content available to be pushed to productionread

Dashboards2

palo_alto_cortex_xsoar.dashboards.getGet dashboard details for the specified dashboardread
palo_alto_cortex_xsoar.dashboards.listGet all dashboards detailsread

Evidence2

palo_alto_cortex_xsoar.evidence.deleteDelete evidencedestructive
palo_alto_cortex_xsoar.evidence.searchSearch evidenceread

Incident fields2

palo_alto_cortex_xsoar.incident_fields.createCreate a new incident fieldwrite
palo_alto_cortex_xsoar.incident_fields.listGet all incident fields in the tenantread

Indicator relationships2

palo_alto_cortex_xsoar.indicator_relationships.createCreate a relationship between indicatorswrite
palo_alto_cortex_xsoar.indicator_relationships.searchSearch for indicator relationshipsread

Users2

palo_alto_cortex_xsoar.users.listGet usersread
palo_alto_cortex_xsoar.users.set_roleSet a user roledestructive

Audit management logs1

palo_alto_cortex_xsoar.audit_management_logs.listGet audit management logread

Incident types1

palo_alto_cortex_xsoar.incident_types.saveCreate a new incident typewrite

Indicator exclusions1

palo_alto_cortex_xsoar.indicator_exclusions.saveCreate an indicator exclusion listwrite

Integrations1

palo_alto_cortex_xsoar.integrations.listGet all integrationsread

Reports1

palo_alto_cortex_xsoar.reports.listGet all reportsread

Roles1

palo_alto_cortex_xsoar.roles.listGet rolesread

System1

palo_alto_cortex_xsoar.system.get_health_metricsGet System Health Metricsread

User groups1

palo_alto_cortex_xsoar.user_groups.listGet user groupsread

Widgets1

palo_alto_cortex_xsoar.widgets.query_statisticsGet widget statisticsread

Questions

The Palo Alto Networks Cortex XSOAR MCP server, answered.

Is there a Palo Alto Networks Cortex XSOAR MCP server for Claude?

Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 96 Palo Alto Networks Cortex XSOAR actions across incidents, engines, indicators and integration instances, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Palo Alto Networks Cortex XSOAR.

What do I need to connect Palo Alto Networks Cortex XSOAR?

Cortex XSOAR 8 Standard API key and The key's ID from the ID column of the API Keys table. Plus your host. The free call account { op: "connections.requirements", service: "palo_alto_cortex_xsoar" } lists exactly what to paste.

Can an AI agent delete or change things in Palo Alto Networks Cortex XSOAR?

Only if its key allows it, and only with an explicit confirmation. 16 Palo Alto Networks Cortex XSOAR actions are destructive, including generate an API key, delete API keys and delete authentication settings by domain. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it.

Will an AI agent use up my Palo Alto Networks Cortex XSOAR API limit?

actionlake paces every call to the limits in the Palo Alto Networks Cortex XSOAR service file: 10 calls a second per connection. Repeated reads are answered from cache (40 Palo Alto Networks Cortex XSOAR actions can be), which never reaches Palo Alto Networks Cortex XSOAR.

What does a Palo Alto Networks Cortex XSOAR action cost?

One upstream call, the only unit actionlake bills. A list that pages bills one call per page (96 Palo Alto Networks Cortex XSOAR actions page). Cache hits, searches, dry runs and calls Palo Alto Networks Cortex XSOAR refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000.

Which Palo Alto Networks Cortex XSOAR API does it cover?

The Cortex XSOAR 8.x REST API (XSOAR 8 Cloud and 8.x on-prem) at your Palo Alto Networks Cortex XSOAR instance's API base URL, which you enter when connecting. It is built from Palo Alto Networks Cortex XSOAR's documentation as read on 23 October 2026. 96 actions in 32 areas, each one in the signed service file (version 1.0.0).

Does actionlake keep my Palo Alto Networks Cortex XSOAR data, and where?

actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Palo Alto Networks Cortex XSOAR credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models.

Which AI clients can use it?

Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names.

Give your agent Palo Alto Networks Cortex XSOAR today.

Connect Palo Alto Networks Cortex XSOAR free See pricing

Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free.

Palo Alto Networks Cortex XSOAR MCP server for AI agents.

Connect Palo Alto Networks Cortex XSOAR in three steps.

Add actionlake to Claude.

Connect Palo Alto Networks Cortex XSOAR.

Make the first call. Check before a write.

What an AI agent can do in Palo Alto Networks Cortex XSOAR.

Incidents

Engines

Indicators

Integration instances

Investigations

Authentication settings

Syslog servers

Entries