EvoHub DocsEvoHub Docs Sign in

Cortex XDR

Use with AI
View as MarkdownThis page as plain text, for pasting into an AI tool Open in ClaudeAsk Claude questions about this page Open in ChatGPTAsk ChatGPT questions about this page
Connect to Cursor / VS Code / ClaudeSearch and read these docs from your AI tool (MCP server)

MCP server URL

https://docs.evohub.io/mcp

Add to CursorAdd to VS Code

Claude Code

claude mcp add --transport http evohub-docs https://docs.evohub.io/mcp

Claude (claude.ai and Claude Desktop): Settings → Connectors → Add custom connector, and paste the URL above.

Claude Desktop — claude_desktop_config.json

{
  "mcpServers": {
    "evohub-docs": {
      "command": "npx",
      "args": [
        "-y",
        "mcp-remote",
        "https://docs.evohub.io/mcp"
      ]
    }
  }
}

Cursor — ~/.cursor/mcp.json

{
  "mcpServers": {
    "evohub-docs": {
      "url": "https://docs.evohub.io/mcp"
    }
  }
}

VS Code — .vscode/mcp.json

{
  "servers": {
    "evohub-docs": {
      "type": "http",
      "url": "https://docs.evohub.io/mcp"
    }
  }
}

llms.txtllms-full.txt

EvoHub receives security issues from Palo Alto Networks Cortex XDR and XSIAM, such as DLP alerts, through webhook forwarding. Cortex sends its own issue JSON, which EvoHub reads as it is. An issue opens an EvoHub alert, and the issue being resolved or closed resolves it.

Requires Cortex XDR 5.x or later, or XSIAM 3.x or later.

Set it up

Create the integration

In EvoHub, go to On-Call → Integrations → + Add Integration, choose Cortex XDR, pick an Escalation Policy and click Create Integration. Copy the Webhook URL.

Add a webhook application

In Cortex, go to Settings → Configurations → Integrations → External Applications → Add Application → Webhook and set URL to your webhook URL, then click Verify. Verification fails until egress to the webhook's host is allowed in the Cortex Gateway's egress configuration.

https://evohub.io/ingest/cortex?key=YOUR_INTEGRATION_KEY

Forward the issues

Go to Settings → Configurations → General → Notifications, add a Forwarding Configuration and pick the issues to forward to the webhook.

Turn on auto-resolve

Nothing extra is needed. When Cortex forwards an issue whose status is resolved or closed, EvoHub resolves the matching alert.

What EvoHub reads

Field names differ between Cortex generations and builds, so EvoHub looks for each value under the names Cortex has used:

EvoHub alert Taken from
Title name, else issue_name, alert_name, incident_name, rule_name, display_name, title or headline; else the description; else "Cortex Alert".
Description description, else issue_description, alert_description, details, message, text or summary.
Labels domain (issue_domain), category, and every other top-level text, number or true/false field as it is (for example host_name or observation_time), up to 40 labels. Nested objects and lists are left out, and long values are cut.
Fingerprint incident_id (XDR incidents), else external_id, else id (XSIAM issues); else the title.

Severity

EvoHub reads severity, or platform_severity when severity is empty. The SEV_050_CRITICAL form (read by its last word), plain words and the older numbers 0–4 all work:

Cortex severity EvoHub severity
SEV_050_CRITICAL, critical, 4 critical
SEV_040_HIGH, high, 3 high
SEV_030_MEDIUM, medium, 2 medium
SEV_…_LOW, low, 1 low
SEV_…_INFO, info, informational, 0 info
anything else medium

Resolve and deduplication

  • An issue whose status (XDR) or resolution_status (XSIAM) contains RESOLVED or CLOSED resolves the open alert with the same ID — for example resolved_threat_handled or STATUS_040_RESOLVED_AUTO. Any other status, such as new or STATUS_010_NEW, opens an alert.
  • Further notifications for an issue whose alert is still open, such as a move to under investigation, are recorded as Retriggered.

Troubleshooting

  • 401 INVALID_KEY: the URL's key is wrong or the integration is disabled. Copy the Webhook URL again from the integration.
  • Alerts are titled "Cortex Alert": your Cortex build sends the issue name under a field EvoHub does not know yet. The alert's labels show every field that arrived; open a ticket from Help & Support with the label names so the field can be mapped (see Get help).
  • Nothing arrives: check that the forwarding configuration selects the issues and uses the webhook application.
Last updated Powered by