Overview

The Palo Alto Networks integration ingests:

  • PAN-OS Traffic, Threat, URL Filtering, WildFire, Data Filtering, and System logs (via the PAN-OS XML API)
  • Cortex XDR alerts and incidents (via the Cortex XDR API)
  • Configuration audit events

This page covers PAN-OS firewall and Panorama setup. For Cortex XDR, switch the Source field to cortex_xdr and supply the Cortex API key in place of the PAN-OS API key.

Prerequisites

  • A PAN-OS firewall (or Panorama) reachable from Atatus, or a Cortex XDR tenant.
  • Superuser (or read-only XML API admin) credentials for PAN-OS, or an API key for Cortex XDR.

Step 1a: Generate a PAN-OS API key

  1. Sign in to the firewall or Panorama as an admin.
  2. Create or use an existing administrator with XML API access (Device → Admin Roles → enable XML API).
  3. Generate the API key from a workstation:
   curl -k "https://<firewall>/api/?type=keygen&user=<admin>&password=<password>"
  1. Copy the returned <key> value.

Step 1b: Generate a Cortex XDR API key

  1. Sign in to the Cortex XDR console.
  2. Go to Settings → Configurations → Integrations → API Keys.
  3. Click + New Key, choose Standard, and grant a read-only role.
  4. Copy the API Key, API Key ID, and the FQDN of your tenant.

Step 2: Connect Palo Alto Networks in Atatus

  1. In Atatus, go to Security → Cloud SIEM → Integrations.
  2. Locate the Palo Alto Networks card and click Connect.
  3. Fill in the form:
Field Description Example
Source pan_os for firewall/Panorama, cortex_xdr for XDR. pan_os
Hostname FQDN or IP of the firewall, Panorama, or Cortex XDR API host. firewall.example.com
API Key PAN-OS API key or Cortex XDR API key. ••••••••
API Key ID Cortex XDR only — numeric API key ID. 42
Poll Interval (minutes) How often to fetch new events. 5
Enabled Turn collection on. true
  1. Click Connect.

Verification

  • The Palo Alto Networks card shows Configured.
  • Logs appear in Security → Cloud SIEM → Audit Logs → Events with source palo_alto.