Security
Cortex XDR
Palo Alto Networks XDR for endpoint, network, and cloud threat detection.
Command it in chat
Ask the Orbit Assistant about your Cortex XDR data in plain English — it plans the API calls and answers clearly, not with raw JSON.
Automate it with skills
Put Cortex XDR inside autonomous skills and playbooks that run on schedules, webhooks, or events — and chain it with your other tools.
Governed by default
Set action policies and member access, require approvals where needed, and review recorded activity. Supported autonomy modes depend on your plan.
4 one-click shortcuts — plus the full API
These cover common tasks. API exploration depends on your plan, vendor permissions and supported endpoints. Workspace simulations use fictional data and may use AI Power. Real actions follow workspace approval policies and vendor limits.
List incidents
get_incidents
List endpoints
get_endpoints
Isolate endpoint
isolate_endpoint
Un-isolate endpoint
unisolate_endpoint
Explore before you connect
Explore Cortex XDR in a workspace with fictional sample data before adding credentials. Workspace simulations may use AI Power; signup may require a beta invite.
Explore in a workspace