--- title: "Palo Alto Networks Cortex XSOAR MCP server - actionlake" description: "Give Claude 96 Palo Alto Networks Cortex XSOAR actions through one MCP server: incidents. Your agent never holds the credential. 100,000 calls a month free." canonical: https://actionlake.com/connectors/palo-alto-networks-cortex-xsoar updated: 2026-10-23 --- Connectors · Identity & security # Palo Alto Networks Cortex XSOAR MCP server for AI agents. actionlake is an MCP gateway: one remote MCP server that connects Claude and other MCP clients to Palo Alto Networks Cortex XSOAR and the rest of your systems. It gives your agent 96 Palo Alto Networks Cortex XSOAR actions (43 reads, 37 writes and 16 that wait for a confirmation) and holds the Palo Alto Networks Cortex XSOAR credential itself, so the agent never does. It paces Palo Alto Networks Cortex XSOAR's limits and records every call. [Connect Palo Alto Networks Cortex XSOAR free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) 100,000 free calls a month. No card, no email, no password: press Start a free sandbox on the next screen and keep the key it shows you. `claude mcp add --transport http actionlake https://connect.actionlake.com/mcp` the first call ``` do { action: "palo_alto_cortex_xsoar.users.list", intent: "check which Palo Alto Networks Cortex XSOAR account is connected" } # Get users · read · 1 upstream call ``` - 96 actions in one signed file - 43 read look, never change - 37 write create and update - 16 wait for a yes destructive, confirmed first Set up ## Connect Palo Alto Networks Cortex XSOAR in three steps. 1. 01 ### Add actionlake to Claude. Run the command once in Claude Code; its consent page can create a free sandbox: 100,000 calls a month, no card. In the Claude app, add a custom connector with the URL below and paste your key on the consent page. Creating a new sandbox from the Claude app is not yet tested by us. `https://connect.actionlake.com/mcp` 2. 02 ### Connect Palo Alto Networks Cortex XSOAR. Header credentials. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. actionlake stores what you paste write-only, sealed under your tenant's key. - `api_key` Cortex XSOAR 8 Standard API key - `api_key_id` The key's ID from the ID column of the API Keys table - `host` Where your Palo Alto Networks Cortex XSOAR lives: your host ``` account { op: "connections.requirements", service: "palo_alto_cortex_xsoar" } # free: exactly what to paste, and what is found for you ``` 3. 03 ### Make the first call. Check before a write. Ask in plain words; Claude picks the action. Before anything changes, `check` validates the call and prices it, for free. ``` do { action: "palo_alto_cortex_xsoar.users.list" } # get users · read · 1 upstream call check { action: "palo_alto_cortex_xsoar.api_keys.create", input: { … } } # free: inputs, permissions, cost and confirmations, nothing sent ``` Palo Alto Networks Cortex XSOAR at a glance **Sign-in** Header credentials. No consent screen: your agent can connect it for you, but the key then passes through your chat. To keep it out of the model's context, paste it in the console instead. **You provide** `api_key` `api_key_id` **Setup fields** `host` **Limits we pace to** 10 calls a second, per connection **API covered** Cortex XSOAR 8.x REST API (XSOAR 8 Cloud and 8.x on-prem), at your Palo Alto Networks Cortex XSOAR instance's API base URL, which you enter when connecting **Built from** Palo Alto Networks Cortex XSOAR's documentation, read 23 October 2026[cortex-docs.paloaltonetworks.com](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/get-started-with-cortex-xsoar-8-apis) [cortex-docs.paloaltonetworks.com](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/incidents) [cortex-docs.paloaltonetworks.com](https://cortex-docs.paloaltonetworks.com/xsoar-8-api/cortex-xsoar-8.x-apis/indicators) **Service file** Version 1.0.0, signed (Ed25519) **Cached reads** 40 of 43 reads, for up to 5 minutes; a write clears what it affects **Shared entities** 6, so ask can line Palo Alto Networks Cortex XSOAR up with your other systems **Data** Processed and stored in Sydney, Australia. No US region yet Capabilities ## What an AI agent can do in Palo Alto Networks Cortex XSOAR. 96 actions in 32 areas. Every one carries its effect, so a key can allow the reads and hold the rest. - **43** read look, never change - **37** write create and update - **16** destructive wait for a confirmation 1. ### Incidents 9 2 read · 6 write · 1 destructive Search incidents by filter · Get a specific incident · Create an incident from JSON · Batch export incidents to CSV 2. ### Engines 6 2 read · 3 write · 1 destructive Create an engine · Get all engines · Get details by engine ID · Update engine configuration 3. ### Indicators 6 1 read · 4 write · 1 destructive Create an indicator · Create feed indicators from JSON · Batch export indicators to CSV · Search indicators 4. ### Integration instances 6 3 read · 2 write · 1 destructive Fetch an integration instance's execution history · Get details on integration instances, engines, and health · Get an integration instance by its ID · Reset integration instance last run timestamp 5. ### Investigations 6 4 read · 2 write · 0 destructive Retrieve an investigation workplan task list · Get investigation ID context · Close an investigation · Retrieve an incident investigation 6. ### Authentication settings 5 2 read · 2 write · 1 destructive Get authentication settings for all configured domains · Create authentication settings for IdP SSO or metadata URL · Update authentication settings · Delete authentication settings by domain 7. ### Syslog servers 5 2 read · 2 write · 1 destructive Create a syslog integration · Get all or filtered syslog servers · Test syslog integration · Update a syslog integration 8. ### Entries 4 0 read · 2 write · 2 destructive Create a new incident War Room entry · Create new entry in existing investigation · Mark entry as note or delete entry · Set tags on incident War Room entry **24 more areas · 49 actions** - Jobs **4** - Lists **4** - Scripts **4** - Content packs **3** - Credentials **3** - Playbook tasks **3** - Playbooks **3** - API keys **2** - Content **2** - Content changes **2** - Dashboards **2** - Evidence **2** - Incident fields **2** - Indicator relationships **2** - Users **2** - Audit management logs **1** - Incident types **1** - Indicator exclusions **1** - Integrations **1** - Reports **1** - Roles **1** - System **1** - User groups **1** - Widgets **1** Top actions ## The Palo Alto Networks Cortex XSOAR API, shaped for agents. The ids your agent types, what each does, and the one name it shares with other systems. 25 of Palo Alto Networks Cortex XSOAR's 25 action names are shared with at least one other connector, so an agent learns them once. | Action | What it does | Effect | Same name in | | --- | --- | --- | --- | | `palo_alto_cortex_xsoar.users.list` Get users | Get users. | read | `identity.user.list` 474 connectors | | `palo_alto_cortex_xsoar.user_groups.list` Get user groups | Get user groups. | read | `identity.group.list` 262 connectors | | `palo_alto_cortex_xsoar.roles.list` Get roles | Get roles. | read | `identity.role.list` 184 connectors | | `palo_alto_cortex_xsoar.reports.list` Get all reports | Get all reports. | read | `analytics.report.list` 37 connectors | | `palo_alto_cortex_xsoar.api_keys.create` Generate an API key | Generate an API key. | destructive | `identity.api_key.create` 100 connectors | | `palo_alto_cortex_xsoar.playbooks.get` Get playbook by ID | Get playbook by ID. | read | `automation.workflow.get` 51 connectors | | `palo_alto_cortex_xsoar.authentication_settings.list` Get authentication settings for all configured domains | Get authentication settings for all configured domains. | read | `identity.identity_provider.list` 22 connectors | | `palo_alto_cortex_xsoar.api_keys.delete` Delete API keys | Delete API keys. | destructive | `identity.api_key.delete` 76 connectors | | `palo_alto_cortex_xsoar.authentication_settings.create` Create authentication settings for IdP SSO or metadata URL | Create authentication settings for IdP SSO or metadata URL. | write | `identity.identity_provider.create` 15 connectors | | `palo_alto_cortex_xsoar.playbooks.search` Search playbooks using queries | Search playbooks using queries. | read | `automation.workflow.search` 8 connectors | | `palo_alto_cortex_xsoar.authentication_settings.update` Update authentication settings | Update authentication settings. | write | `identity.identity_provider.update` 17 connectors | | `palo_alto_cortex_xsoar.jobs.create` Create a new job | Create a new job. | write | `infra.job.create` 10 connectors | Try it ## Prompts to paste into Claude. Each one names the Palo Alto Networks Cortex XSOAR actions it will call, so you know what it reads and what it changes before you send it. 1. Read read Which Palo Alto Networks Cortex XSOAR incidents are open, and how long has each been open? calls `palo_alto_cortex_xsoar.incidents.search` 2. Write write Create authentication settings for IdP SSO or metadata URL in Palo Alto Networks Cortex XSOAR. Show me exactly what you will send before you save it. calls `palo_alto_cortex_xsoar.authentication_settings.create` Governance for Palo Alto Networks Cortex XSOAR ## Destructive actions wait for a yes. 16 Palo Alto Networks Cortex XSOAR actions are destructive. These are all of them: - Generate an API key `palo_alto_cortex_xsoar.api_keys.create` - Delete API keys `palo_alto_cortex_xsoar.api_keys.delete` - Delete authentication settings by domain `palo_alto_cortex_xsoar.authentication_settings.delete` - Delete the specified job `palo_alto_cortex_xsoar.jobs.delete` - Create a new incident War Room entry `palo_alto_cortex_xsoar.entries.create` - Create new entry in existing investigation `palo_alto_cortex_xsoar.entries.execute_sync` - Delete a batch of incidents `palo_alto_cortex_xsoar.incidents.delete_batch` - Batch delete indicators or add them to the exclusion list `palo_alto_cortex_xsoar.indicators.delete_batch` - Execute task in running investigation `palo_alto_cortex_xsoar.playbook_tasks.execute` - Set a user role `palo_alto_cortex_xsoar.users.set_role` - Delete a list `palo_alto_cortex_xsoar.lists.delete` - Delete an engine `palo_alto_cortex_xsoar.engines.delete` - Delete evidence `palo_alto_cortex_xsoar.evidence.delete` - Delete credentials `palo_alto_cortex_xsoar.credentials.delete` - Delete all or filtered syslog integrations `palo_alto_cortex_xsoar.syslog_servers.delete` - Delete an integration instance by its ID `palo_alto_cortex_xsoar.integration_instances.delete` A destructive action runs only with `confirm: true`. Under the `human` policy the agent cannot confirm for itself: the run stops until a named person approves, in the console or from a signed link in an email. The cap on a key is refused before the call is sent, never after. do palo_alto_cortex_xsoar.api_keys.delete confirm_policy: **human** Delete API keys? **intent:** the user asked me to delete API keys run suspended · waiting for a named person · key _palo-alto-cortex-xsoar-agent_ cannot confirm itself In the console, or from an emailed signed link. a key for this connector ``` account { op: "keys.create", name: "palo-alto-cortex-xsoar-agent", allowed_actions: ["palo_alto_cortex_xsoar.*"], cap_calls: 2000, confirm_policy: "human_for_writes", approval_rules: [ { match: "palo_alto_cortex_xsoar.api_keys.create", approver: "lead@example.com" }, { match: "palo_alto_cortex_xsoar.api_keys.delete", approver: "lead@example.com" }, { match: "palo_alto_cortex_xsoar.authentication_settings.delete", approver: "lead@example.com" } ] } ``` Illustrative. Scoped to Palo Alto Networks Cortex XSOAR only, capped at 2,000 upstream calls, every write confirmed, and the destructive ones approved by a named person. Cost ## What Palo Alto Networks Cortex XSOAR costs on actionlake. Every Palo Alto Networks Cortex XSOAR action is one upstream call, the only thing actionlake bills. Searching, `check`, `cost`, `account` and any call Palo Alto Networks Cortex XSOAR refused with 401, 403, 429 or a 5xx are free. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. - 1 upstream call per action all 96 Palo Alto Networks Cortex XSOAR actions - 96 actions page each page of a long list is one call - 40 reads can be cached a cache hit costs nothing - 100,000 calls a month, free paid plans from US$49 a month for 250,000 [See pricing](https://actionlake.com/pricing) Action index ## Every Palo Alto Networks Cortex XSOAR action. 96 actions by area: the id your agent calls, what it does, and its effect. **Incidents 9** - `palo_alto_cortex_xsoar.incidents.close` Close an incident write - `palo_alto_cortex_xsoar.incidents.create_from_json` Create an incident from JSON write - `palo_alto_cortex_xsoar.incidents.delete_batch` Delete a batch of incidents destructive - `palo_alto_cortex_xsoar.incidents.export_csv` Batch export incidents to CSV write - `palo_alto_cortex_xsoar.incidents.get` Get a specific incident read - `palo_alto_cortex_xsoar.incidents.investigate` Investigate an incident write - `palo_alto_cortex_xsoar.incidents.save` Create or update an incident write - `palo_alto_cortex_xsoar.incidents.search` Search incidents by filter read - `palo_alto_cortex_xsoar.incidents.update_batch` Update incidents in a batch write **Engines 6** - `palo_alto_cortex_xsoar.engines.create` Create an engine write - `palo_alto_cortex_xsoar.engines.delete` Delete an engine destructive - `palo_alto_cortex_xsoar.engines.get` Get details by engine ID read - `palo_alto_cortex_xsoar.engines.list` Get all engines read - `palo_alto_cortex_xsoar.engines.update_config` Update engine configuration write - `palo_alto_cortex_xsoar.engines.upgrade` Upgrade specified engines write **Indicators 6** - `palo_alto_cortex_xsoar.indicators.create` Create an indicator write - `palo_alto_cortex_xsoar.indicators.create_feed` Create feed indicators from JSON write - `palo_alto_cortex_xsoar.indicators.delete_batch` Batch delete indicators or add them to the exclusion list destructive - `palo_alto_cortex_xsoar.indicators.export_csv` Batch export indicators to CSV write - `palo_alto_cortex_xsoar.indicators.search` Search indicators read - `palo_alto_cortex_xsoar.indicators.update` Edit indicator write **Integration instances 6** - `palo_alto_cortex_xsoar.integration_instances.delete` Delete an integration instance by its ID destructive - `palo_alto_cortex_xsoar.integration_instances.get` Get an integration instance by its ID read - `palo_alto_cortex_xsoar.integration_instances.get_fetch_history` Fetch an integration instance's execution history read - `palo_alto_cortex_xsoar.integration_instances.reset_last_run` Reset integration instance last run timestamp write - `palo_alto_cortex_xsoar.integration_instances.save` Create an instance of an integration write - `palo_alto_cortex_xsoar.integration_instances.search` Get details on integration instances, engines, and health read **Investigations 6** - `palo_alto_cortex_xsoar.investigations.close` Close an investigation write - `palo_alto_cortex_xsoar.investigations.get` Retrieve an incident investigation read - `palo_alto_cortex_xsoar.investigations.get_workplan` Get investigation workplan read - `palo_alto_cortex_xsoar.investigations.list_workplan_tasks` Retrieve an investigation workplan task list read - `palo_alto_cortex_xsoar.investigations.query_context` Get investigation ID context read - `palo_alto_cortex_xsoar.investigations.reopen` Reopen a closed incident write **Authentication settings 5** - `palo_alto_cortex_xsoar.authentication_settings.create` Create authentication settings for IdP SSO or metadata URL write - `palo_alto_cortex_xsoar.authentication_settings.delete` Delete authentication settings by domain destructive - `palo_alto_cortex_xsoar.authentication_settings.get_metadata` Get IdP metadata read - `palo_alto_cortex_xsoar.authentication_settings.list` Get authentication settings for all configured domains read - `palo_alto_cortex_xsoar.authentication_settings.update` Update authentication settings write **Syslog servers 5** - `palo_alto_cortex_xsoar.syslog_servers.create` Create a syslog integration write - `palo_alto_cortex_xsoar.syslog_servers.delete` Delete all or filtered syslog integrations destructive - `palo_alto_cortex_xsoar.syslog_servers.list` Get all or filtered syslog servers read - `palo_alto_cortex_xsoar.syslog_servers.test` Test syslog integration read - `palo_alto_cortex_xsoar.syslog_servers.update` Update a syslog integration write **Entries 4** - `palo_alto_cortex_xsoar.entries.create` Create a new incident War Room entry destructive - `palo_alto_cortex_xsoar.entries.execute_sync` Create new entry in existing investigation destructive - `palo_alto_cortex_xsoar.entries.set_note` Mark entry as note or delete entry write - `palo_alto_cortex_xsoar.entries.set_tags` Set tags on incident War Room entry write **Jobs 4** - `palo_alto_cortex_xsoar.jobs.create` Create a new job write - `palo_alto_cortex_xsoar.jobs.delete` Delete the specified job destructive - `palo_alto_cortex_xsoar.jobs.search` Search for jobs read - `palo_alto_cortex_xsoar.jobs.set_status` Sets the specified job to the specified status write **Lists 4** - `palo_alto_cortex_xsoar.lists.delete` Delete a list destructive - `palo_alto_cortex_xsoar.lists.get` Get the specified list read - `palo_alto_cortex_xsoar.lists.list` Get all lists read - `palo_alto_cortex_xsoar.lists.save` Create or update a list write **Scripts 4** - `palo_alto_cortex_xsoar.scripts.get` Get details about a specific script read - `palo_alto_cortex_xsoar.scripts.list_metadata` Get metadata details about all scripts in this tenant read - `palo_alto_cortex_xsoar.scripts.save` Create or update a script write - `palo_alto_cortex_xsoar.scripts.search` Search scripts read **Content packs 3** - `palo_alto_cortex_xsoar.content_packs.get_item_dependencies` Retrieve content pack item dependencies read - `palo_alto_cortex_xsoar.content_packs.list_installed` Get metadata for all installed content packs read - `palo_alto_cortex_xsoar.content_packs.search_marketplace` Search for content packs read **Credentials 3** - `palo_alto_cortex_xsoar.credentials.delete` Delete credentials destructive - `palo_alto_cortex_xsoar.credentials.list` Get all credentials read - `palo_alto_cortex_xsoar.credentials.save` Create or update credentials write **Playbook tasks 3** - `palo_alto_cortex_xsoar.playbook_tasks.add_adhoc` Add ad-hoc playbook task write - `palo_alto_cortex_xsoar.playbook_tasks.execute` Execute task in running investigation destructive - `palo_alto_cortex_xsoar.playbook_tasks.uncomplete` Mark a completed task in a running playbook as not complete write **Playbooks 3** - `palo_alto_cortex_xsoar.playbooks.clone` Duplicate a playbook write - `palo_alto_cortex_xsoar.playbooks.get` Get playbook by ID read - `palo_alto_cortex_xsoar.playbooks.search` Search playbooks using queries read **API keys 2** - `palo_alto_cortex_xsoar.api_keys.create` Generate an API key destructive - `palo_alto_cortex_xsoar.api_keys.delete` Delete API keys destructive **Content 2** - `palo_alto_cortex_xsoar.content.check_new` Check for new content read - `palo_alto_cortex_xsoar.content.install` Install content on a production tenant write **Content changes 2** - `palo_alto_cortex_xsoar.content_changes.commit` Push custom content to production tenant write - `palo_alto_cortex_xsoar.content_changes.list_uncommitted` Get a list of content available to be pushed to production read **Dashboards 2** - `palo_alto_cortex_xsoar.dashboards.get` Get dashboard details for the specified dashboard read - `palo_alto_cortex_xsoar.dashboards.list` Get all dashboards details read **Evidence 2** - `palo_alto_cortex_xsoar.evidence.delete` Delete evidence destructive - `palo_alto_cortex_xsoar.evidence.search` Search evidence read **Incident fields 2** - `palo_alto_cortex_xsoar.incident_fields.create` Create a new incident field write - `palo_alto_cortex_xsoar.incident_fields.list` Get all incident fields in the tenant read **Indicator relationships 2** - `palo_alto_cortex_xsoar.indicator_relationships.create` Create a relationship between indicators write - `palo_alto_cortex_xsoar.indicator_relationships.search` Search for indicator relationships read **Users 2** - `palo_alto_cortex_xsoar.users.list` Get users read - `palo_alto_cortex_xsoar.users.set_role` Set a user role destructive **Audit management logs 1** - `palo_alto_cortex_xsoar.audit_management_logs.list` Get audit management log read **Incident types 1** - `palo_alto_cortex_xsoar.incident_types.save` Create a new incident type write **Indicator exclusions 1** - `palo_alto_cortex_xsoar.indicator_exclusions.save` Create an indicator exclusion list write **Integrations 1** - `palo_alto_cortex_xsoar.integrations.list` Get all integrations read **Reports 1** - `palo_alto_cortex_xsoar.reports.list` Get all reports read **Roles 1** - `palo_alto_cortex_xsoar.roles.list` Get roles read **System 1** - `palo_alto_cortex_xsoar.system.get_health_metrics` Get System Health Metrics read **User groups 1** - `palo_alto_cortex_xsoar.user_groups.list` Get user groups read **Widgets 1** - `palo_alto_cortex_xsoar.widgets.query_statistics` Get widget statistics read Questions ## The Palo Alto Networks Cortex XSOAR MCP server, answered. **Is there a Palo Alto Networks Cortex XSOAR MCP server for Claude?** Yes. actionlake is an MCP gateway: a remote MCP server that gives Claude, or another MCP client, 96 Palo Alto Networks Cortex XSOAR actions across incidents, engines, indicators and integration instances, through the same eight tools it uses for every other connector. actionlake is independent; it is not made or endorsed by Palo Alto Networks Cortex XSOAR. **What do I need to connect Palo Alto Networks Cortex XSOAR?** Cortex XSOAR 8 Standard API key and The key's ID from the ID column of the API Keys table. Plus your host. The free call account { op: "connections.requirements", service: "palo_alto_cortex_xsoar" } lists exactly what to paste. **Can an AI agent delete or change things in Palo Alto Networks Cortex XSOAR?** Only if its key allows it, and only with an explicit confirmation. 16 Palo Alto Networks Cortex XSOAR actions are destructive, including generate an API key, delete API keys and delete authentication settings by domain. Each runs only with confirm: true. Under the human confirm policy, or an approval rule on the key, the run waits until a named person approves it. **Will an AI agent use up my Palo Alto Networks Cortex XSOAR API limit?** actionlake paces every call to the limits in the Palo Alto Networks Cortex XSOAR service file: 10 calls a second per connection. Repeated reads are answered from cache (40 Palo Alto Networks Cortex XSOAR actions can be), which never reaches Palo Alto Networks Cortex XSOAR. **What does a Palo Alto Networks Cortex XSOAR action cost?** One upstream call, the only unit actionlake bills. A list that pages bills one call per page (96 Palo Alto Networks Cortex XSOAR actions page). Cache hits, searches, dry runs and calls Palo Alto Networks Cortex XSOAR refused with 401, 403, 429 or a 5xx are free. The Free plan includes 100,000 calls a month with no card. Paid plans start at US$49 a month for 250,000 calls, with overage from US$0.30 down to US$0.18 per 1,000. **Which Palo Alto Networks Cortex XSOAR API does it cover?** The Cortex XSOAR 8.x REST API (XSOAR 8 Cloud and 8.x on-prem) at your Palo Alto Networks Cortex XSOAR instance's API base URL, which you enter when connecting. It is built from Palo Alto Networks Cortex XSOAR's documentation as read on 23 October 2026. 96 actions in 32 areas, each one in the signed service file (version 1.0.0). **Does actionlake keep my Palo Alto Networks Cortex XSOAR data, and where?** actionlake processes and stores data in Sydney, Australia; there is no US region yet. Reads may be cached for up to 5 minutes, and a write clears the reads it affects. Each run's request and response is kept, sealed, for your plan's trace window: 1 day on Free, 3 days on Starter, 7 days on Pro, 14 days on Team, 30 days on Business and 30 days on Enterprise. Your Palo Alto Networks Cortex XSOAR credential is sealed under your tenant's key, never logged and never returned. Your traffic is not used to train models. **Which AI clients can use it?** Claude Code, tested by us end to end, and the Claude app as a custom connector, tested by us with an existing key. Other MCP clients that support remote servers over Streamable HTTP (MCP revisions 2025-06-18 and 2025-11-25) and OAuth dynamic client registration, or a bearer header, should connect the same way; we have not tested them. Or plain REST, under the same action names. ## More connectors like Palo Alto Networks Cortex XSOAR Shares the most action names with - [Palo Alto Networks Cortex XDR 11](https://actionlake.com/connectors/palo-alto-networks-cortex-xdr) - [Clerk 9](https://actionlake.com/connectors/clerk) - [Trend Vision One 8](https://actionlake.com/connectors/trend-vision-one) - [Keycloak Admin REST API 7](https://actionlake.com/connectors/keycloak-admin-rest-api) - [Auth0 Management API 7](https://actionlake.com/connectors/auth0-management-api) - [GitGuardian 6](https://actionlake.com/connectors/gitguardian) Joins with, on shared entities - [Opsgenie 4](https://actionlake.com/connectors/opsgenie) - [HaloPSA 3](https://actionlake.com/connectors/halopsa) - [Fortinet FortiGate 3](https://actionlake.com/connectors/fortinet-fortigate) - [Genesys Cloud CX 3](https://actionlake.com/connectors/genesys-cloud-cx) - [Commvault Cloud 3](https://actionlake.com/connectors/commvault-cloud) - [Delinea Secret Server 3](https://actionlake.com/connectors/delinea-secret-server) Browse - [All Identity & security connectors](https://actionlake.com/connectors/category/identity-and-security) - [All connectors](https://actionlake.com/connectors) - [How actionlake compares](https://actionlake.com/compare) actionlake is independent. It is not made or endorsed by Palo Alto Networks Cortex XSOAR; the name is the vendor's own. Counts are from the Palo Alto Networks Cortex XSOAR service file, version 1.0.0. ## Give your agent Palo Alto Networks Cortex XSOAR today. [Connect Palo Alto Networks Cortex XSOAR free](https://actionlake.com/console?start=sandbox) [See pricing](https://actionlake.com/pricing) Start free - 100,000 calls/month, no card. No signup. Hard caps on every key. Cached answers are free. --- Source: https://actionlake.com/connectors/palo-alto-networks-cortex-xsoar More: https://actionlake.com/llms.txt