# Cortex XDR

EvoHub receives security issues from Palo Alto Networks Cortex XDR and XSIAM, such as DLP alerts, through webhook forwarding. Cortex sends its own issue JSON, which EvoHub reads as it is. An issue opens an EvoHub alert, and the issue being resolved or closed resolves it.

Requires Cortex XDR 5.x or later, or XSIAM 3.x or later.

## Set it up

:::steps
### Create the integration
In EvoHub, go to **On-Call → Integrations → + Add Integration**, choose **Cortex XDR**, pick an **Escalation Policy** and click **Create Integration**. Copy the **Webhook URL**.
### Add a webhook application
In Cortex, go to **Settings → Configurations → Integrations → External Applications → Add Application → Webhook** and set **URL** to your webhook URL, then click **Verify**. Verification fails until egress to the webhook's host is allowed in the Cortex Gateway's egress configuration.

```text
https://evohub.io/ingest/cortex?key=YOUR_INTEGRATION_KEY
```
### Forward the issues
Go to **Settings → Configurations → General → Notifications**, add a **Forwarding Configuration** and pick the issues to forward to the webhook.
:::

## Turn on auto-resolve

Nothing extra is needed. When Cortex forwards an issue whose status is resolved or closed, EvoHub resolves the matching alert.

## What EvoHub reads

Field names differ between Cortex generations and builds, so EvoHub looks for each value under the names Cortex has used:

| EvoHub alert | Taken from |
| --- | --- |
| Title | `name`, else `issue_name`, `alert_name`, `incident_name`, `rule_name`, `display_name`, `title` or `headline`; else the description; else "Cortex Alert". |
| Description | `description`, else `issue_description`, `alert_description`, `details`, `message`, `text` or `summary`. |
| Labels | `domain` (`issue_domain`), `category`, and every other top-level text, number or true/false field as it is (for example `host_name` or `observation_time`), up to 40 labels. Nested objects and lists are left out, and long values are cut. |
| Fingerprint | `incident_id` (XDR incidents), else `external_id`, else `id` (XSIAM issues); else the title. |

### Severity

EvoHub reads `severity`, or `platform_severity` when `severity` is empty. The `SEV_050_CRITICAL` form (read by its last word), plain words and the older numbers 0–4 all work:

| Cortex severity | EvoHub severity |
| --- | --- |
| `SEV_050_CRITICAL`, `critical`, `4` | critical |
| `SEV_040_HIGH`, `high`, `3` | high |
| `SEV_030_MEDIUM`, `medium`, `2` | medium |
| `SEV_…_LOW`, `low`, `1` | low |
| `SEV_…_INFO`, `info`, `informational`, `0` | info |
| anything else | medium |

## Resolve and deduplication

- An issue whose `status` (XDR) or `resolution_status` (XSIAM) contains **RESOLVED** or **CLOSED** resolves the open alert with the same ID — for example `resolved_threat_handled` or `STATUS_040_RESOLVED_AUTO`. Any other status, such as `new` or `STATUS_010_NEW`, opens an alert.
- Further notifications for an issue whose alert is still open, such as a move to under investigation, are recorded as **Retriggered**.

## Troubleshooting

- **`401 INVALID_KEY`**: the URL's key is wrong or the integration is disabled. Copy the **Webhook URL** again from the integration.
- **Alerts are titled "Cortex Alert"**: your Cortex build sends the issue name under a field EvoHub does not know yet. The alert's labels show every field that arrived; open a ticket from **Help & Support** with the label names so the field can be mapped (see [Get help](https://docs.evohub.io/get-help.md)).
- **Nothing arrives**: check that the forwarding configuration selects the issues and uses the webhook application.

## Related

- [Integrations overview](https://docs.evohub.io/integrations-overview.md)
- [Wazuh](https://docs.evohub.io/wazuh.md)
- [Escalation policies](https://docs.evohub.io/escalation-policies.md)