> For the complete documentation index, see [llms.txt](https://docs.prismacloud.io/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.prismacloud.io/content-collections/administration/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-cortex-xsoar.md). # Integrate Prisma Cloud with Cortex XSOAR Learn how to integrate Prisma® Cloud with Cortex XSOAR (formerly Demisto®) to send alerts and enable multi-step automated remediation using Cortex XSOAR playbooks. You can integrate Prisma Cloud and Cortex XSOAR (formerly Demisto) to create an outbound or push-based connection. This integration allows you to send alerts generated by policy violations from Prisma Cloud to Cortex XSOAR. Using this integration, your Security Operations team can define custom or out-of-the-box playbooks on Cortex XSOAR to create multi-step workflows for incident management of your cloud resources that is an alternative to the [pull-based integration](https://xsoar.pan.dev/docs/reference/integrations/prisma-cloud-v2) that you can configure from Cortex XSOAR. Using the policy ID in the alert, Cortex XSOAR categorizes the alert as a specific incident type. For an incident type, the Prisma Cloud alert payload is mapped to a Cortex XSOAR layout that specifies the incident fields for data classification and mapping on Cortex XSOAR. The current list of incident types is AWS CloudTrail Misconfiguration, AWS EC2 Instance Misconfiguration, AWS IAM Policy Misconfiguration, Azure AKS Misconfiguration, Azure Network Misconfiguration, Azure SQL Misconfiguration, Azure Storage Misconfiguration, GCP Compute Engine Misconfiguration, GCP Kubernetes Engine Misconfiguration, and Prisma Cloud. If the policy ID is not categorized to a specific incident type, it is automatically mapped to the generic Prisma Cloud incident type. Every incident type is mapped to a Cortex XSOAR layout and associated with a playbook to enable autoremediation of the violating resource, except for the generic Prisma Cloud incident type. On autoremediation, Prisma Cloud performs a scan to detect that the issue is resolved and marks the alert as resolved. Currently, this integration does not support the use of notification templates and Prisma Cloud does not receive state change notifications from Cortex XSOAR after it resolves an open alert. * [Enable the Cortex XSOAR Integration on Prisma Cloud](#id7b793439-6819-40b7-a8fc-dceceaaaa4fb) * [Set Up the Integration on Cortex XSOAR](#id0a507320-bf49-4523-81c0-5557cca623e6) ## Enable the Cortex XSOAR Integration on Prisma Cloud Set up Cortex XSOAR as an external integration on Prisma Cloud. If you have a firewall or cloud Network Security Group between the internet and Cortex XSOAR, you must ensure network reachability and [Enable Access to the Prisma Cloud Console](/content-collections/get-started/access-prisma-cloud.md). For the push-based integration, you must use Cortex XSOAR versions 6.0.0 or 8.0.0 and above, along with the latest Prisma Cloud content pack. 1. Log in to Prisma Cloud. 2. Navigate to **Settings > Integrations & Notifications**. 3. Select **Add Integration > Cortex XSOAR**. A modal window opens where you can add the details for Cortex integration. 4. Enter the **Integration Name** and an optional **Description**. 5. Choose either **Xsoar version 6.0** or **Xsoar version 8.0** as the **Version Available** for integration with Prisma Cloud. 1. For Xsoar version 6.0, add the following details:
cortex xsoar int for 6 ver
1. Enter your **Cortex XSOAR Instance FQDN/IP** address. If you are adding a Cortex XSOAR instance that is part of a multi-tenant deployment, enter the tenant URL without the protocol (http or https). For example, enter `.com` without or . 2. Enter the **API Key** associated with the Cortex XSOAR administrative user account. The API key you provide must belong to a Cortex XSOAR administrative user with read-write permissions required to enable this push-based integration. Within Cortex XSOAR, navigate to **Settings > Integrations > API Keys** and **Get Your Key**. 2. For Xsoar version 8.0, add the following details:
cortex xsoar int 1
1. Enter your **Cortex XSOAR Instance FQDN/IP** address. If you are adding a Cortex XSOAR instance that is part of a multi-tenant deployment, enter the tenant URL without the protocol (http or https). For example, enter `.com` without or . 2. Enter the **API Key** associated with the Cortex XSOAR administrative user account. The API key you provide must belong to a Cortex XSOAR administrative user with read-write permissions required to enable this push-based integration. Within Cortex XSOAR, navigate to **Settings & Info > Settings > Integrations > API Keys** and get your API key. 3. Enter the **API Key ID** which is **ID** number of the API Key.
cortex xsoar int 2
6. Click **Next**, review the **Summary** and then **Test Integration**. 7. **Save Integration** if the test is successful.
cortex xsoar int 3
Once you successfully set up the integration, you will find it listed on the Integrations page. You can **View**, **Edit**, or **Delete** the integration from the **Actions** panel. You can also check the integration status periodically by clicking on the **Get Status** link.
cortex xsoar int 4
8. Modify an existing Alert Rule or create a new Alert Rule to send [alert notifications](/content-collections/alerts/send-prisma-cloud-alert-notifications-to-third-party-tools.md) to Cortex XSOAR. 9. Get your Prisma Cloud Access Key. If you do not have an access key, see [Create and Manage Access Keys](/content-collections/administration/create-access-keys.md). You need the **Access Key ID** and **Secret Key ID** to complete the integration on Cortex XSOAR. 10. Set up the integration on Cortex XSOAR. ## Set Up the Integration on Cortex XSOAR Before you can view Prisma Cloud alerts as incidents on Cortex XSOAR, you need to install the **Prisma Cloud by Palo Alto Networks** content pack from the **Marketplace**. The content pack includes the incident fields required for this push-based integration. When you have the content pack, the classifier, incident types, and layouts are available automatically. Cortex XSOAR maps Prisma Cloud alerts to out-of-the-box incident types such as AWS CloudTrail Misconfiguration, AWS EC2 Instance Misconfiguration, AWS IAM Policy Misconfiguration, Azure AKS Misconfiguration, Azure Network Misconfiguration, Azure SQL Misconfiguration, Azure Storage Misconfiguration, GCP Compute Engine Misconfiguration, GCP Kubernetes Engine Misconfiguration, and Prisma Cloud. If the policy ID is not categorized to a specific incident type, it is automatically mapped to the generic Prisma Cloud incident type by default. The out-of-box, *Incident Classifier & Mapping* is required for classifying incidents to the correct incident type and mapping the fields in the Prisma Cloud alert payload to the Cortex XSOAR incident fields. When an incident is created, the playbook attached to the incident type automatically executes. Find all the [Cortex XSOAR playbooks](https://github.com/demisto/content/tree/master/Packs/PrismaCloud/Playbooks) that are available to support remediation on Prisma Cloud for example Prisma Cloud Remediation - AWS EC2 Instance Misconfiguration and Prisma Cloud Remediation - GCP VPC Network Misconfiguration; search for `playbook-PCR_` . If you want to use the pull-based integration from Cortex XSOAR, see [Cortex documentation](https://xsoar.pan.dev/docs/reference/integrations/prisma-cloud-v2). In a pull-based integration, you must enable the instance to **Fetches incidents**.
demisto integration pull based prisma cloud
1. Log in to Cortex XSOAR and select **Marketplace > Browse**. 2. Search for **Prisma Cloud by Palo Alto Networks** content pack and **Install**. 3. Enable the connection between Cortex XSOAR and Prisma Cloud. 1. Navigate to **Settings > Objects Setup > Classification & Mapping**. 2. Click the triple dot button at the upper right and select **API Endpoint Mapping**.
demisto api end mapping
3. In the row for **Prisma Cloud**, select: * Classifier—**Prisma Cloud App - Classifier** * Mapper (Incoming)—**Prisma Cloud App - Incoming Mapper**
demisto prisma classifier
4. **Save**. 4. (tt:\[Optional]) Enable the connection between Cortex XSOAR and Prisma Cloud by Adding an instance. 1. Navigate to **Settings > Integrations > Instances**. 2. Search for **Prisma Cloud v2** and **Add Instance**.
demisto pc v2 instance
3. Complete the set up. 1. Provide a **Name** for the Prisma Cloud instance you are integrating (the name must be unique from other Integrations within Cortex XSOAR). 2. The **Server URL** that corresponds to the API endpoint for the Prisma Cloud instance, and your access key and secret keys as username and password. For more details, see [Create and Manage Access Keys](/content-collections/administration/create-access-keys.md). If you access your Prisma Cloud instance at , the [API endpoint](https://pan.dev/prisma-cloud/api/cspm/api-urls/) is 3. Do not enable **Fetches incidents**. 4. **Test** the instance.
demisto optional add integration
5. **Save & Exit**. 5. (tt:\[Optional]) Review the classification mapping for incident types. When Prisma Cloud pushes alerts to the Cortex XSOAR endpoint, the alerts are classified in **Settings > Objects Setup > Incidents > Classification & Mapping** under the **Prisma Cloud App - Classifier**.
demisto integration path
You can view the names of playbooks associated with each incident type are in **Settings > Objects Setup > Incidents > Types**. You can view the actual playbooks under the **Playbooks** tab.
demisto integration prisma cloud incident playbooks
6. View incidents on Cortex XSOAR. Verify that the integration is working as expected and that Prisma Cloud alerts display as incidents and are mapped to specific incident types.
demisto integration prisma cloud alerts
7. (tt:\[Optional]) Create additional classification and mapping rules and incident layouts to classify Prisma Cloud alerts to distinct incident types on Cortex XSOAR. Cortex XSOAR includes a few incident types for Prisma Cloud to which you can associate one of the AWS playbooks (listed above) for autoremediation. Refer to the [Cortex XSOAR documentation](https://xsoar.pan.dev/docs/incidents/incident-classification-mapping) for detailed instructions about customizing your incident types, creating different classifications, mapping and layouts for Prisma Cloud alerts, and to associate different playbooks to take action and enable incident resolution for other cloud platforms. Refer to the [Cortex XSOAR GitHub](https://github.com/demisto/content/tree/master/Packs/PrismaCloud/Playbooks) repository for some sample packs. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://docs.prismacloud.io/content-collections/administration/configure-external-integrations-on-prisma-cloud/integrate-prisma-cloud-with-cortex-xsoar.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.