Connecting Palo Alto Cortex XDR to Landfall

Cortex XDR is a real trigger source, not just a lookup during an investigation someone else already started: its own incident-notification webhook can open a Landfall war room the moment a detection fires, pre-classified as a security incident. This guide covers three things: generating a Standard-type API key and pasting it in, what the diagnosis agent can read once connected, and, under its own section below, wiring Cortex XDR's signed webhook so it opens a Landfall war room automatically.

What you'll need

• A Cortex XDR tenant with admin access to Settings → Configurations → Integrations → API Keys.
• An admin on your Landfall organization, to save the connection under Settings → Integrations.
• Your tenant's full API origin (scheme + host), e.g. https://api-<tenant>.xdr.us.paloaltonetworks.com — shown alongside the key, or derivable from your Cortex XDR console URL.

1. Generate a Standard API key in Cortex XDR

Landfall only ever reads from Cortex XDR: it verifies the key against a low-privilege call and then reads alerts/incidents when a security-classified incident is being investigated. Two key types exist — Standard and Advanced. Only Standard is supported today; choosing Advanced in Landfall's connection form fails immediately with a clear message rather than a confusing generic auth error.

1. Cortex XDR → Settings → Configurations → Integrations → API Keys → New Key

   Choose Standard. Scope the key to the narrowest role that can read alerts/incidents — never an admin-scoped key.

   Cortex XDR → Settings → Configurations → Integrations → API Keys

   🖼Cortex XDR's New API Key dialog, Standard type selected, scoped to a low-privilege read role.

2. Copy the API Key and the API Key ID

   Both are shown once, next to each other, when the key is generated. Copy them now — you'll paste them straight into Landfall in the next step.

   Cortex XDR → API Keys → newly created key

   🖼Cortex XDR showing a newly generated API Key value alongside its numeric API Key ID.

2. Add it to Landfall

In Landfall, open Settings → Integrations → Cortex XDR for your organization. It asks for the API key, the API key ID, the API key type (leave as Standard), and your tenant's API base URL.

1. Paste the API key, key ID, and full API base URL, then Test connection

   The API base URL field takes the FULL origin — scheme and host, e.g. https://api-<tenant>.xdr.us.paloaltonetworks.com — not just the hostname. Landfall calls Cortex XDR's own incidents/get_incidents endpoint with a 1-row bound before saving anything: a rejected key, an under-scoped key, or an unreachable tenant are each reported with a distinct reason rather than stored as "configured but unverified."

   Settings → Integrations → Cortex XDR

   🖼Landfall's Cortex XDR integration panel showing a green connected status and the message Cortex XDR tenant verified.

2. Save integration

   Cortex XDR now shows Configured alongside your organization's other connectors.

3. Triggering Landfall from Cortex XDR

Connecting Cortex XDR (above) lets the diagnosis agent read your alerts and incidents during an investigation. It's a separate step to have a Cortex XDR incident notification open that investigation in the first place; see Triggering Integrations → Cortex XDR for the signed webhook setup, the exact body Cortex XDR sends, and worked examples. The two are independent; most teams eventually set up both.

Reference