Opening a war room from a Cortex XDR incident

This page is about opening incidents automatically the moment Cortex XDR's own outbound webhook fires. It is not about reading telemetry; if you want the investigation agent to query your Cortex XDR alerts/incidents once an incident already exists, see Connecting Cortex XDR instead. The two are independent, and most teams eventually set up both.

How it works

Unlike Datadog, Coralogix, CloudWatch, or Sentry — which all share one endpoint authenticated by a single bearer ingest token — Cortex XDR signs every webhook delivery it sends with an HMAC-SHA256 signature, using a secret configured in Cortex XDR's own notification settings. Landfall verifies that signature per organization, the same dedicated verification mode PagerDuty and GitHub's webhooks already use. This is a deliberate design choice, not an oversight: Cortex XDR's own incident objects carry a tags field, which would collide with Datadog's own detector on the shared endpoint if Cortex XDR were placed there — using its own signed, per-organization route avoids that collision structurally rather than by careful ordering.

What you'll need

• An admin seat on your Landfall organization, to set the Cortex XDR webhook signing secret.
• Admin access to Cortex XDR's own Settings → Configurations → Integrations → External Applications area.
• A Cortex XDR connection already saved in Landfall (see Connecting Cortex XDR) — the same connection panel holds the webhook signing secret field.

1. Set a webhook signing secret

In Landfall, open Settings → Integrations → Cortex XDR and fill in the Webhook signing secret field with any secret value you choose (Cortex XDR does not generate one for you) — this is the same shared secret both sides will use to sign/verify deliveries, matching how PagerDuty's own webhook signing secret works.

2. Point Cortex XDR at Landfall

In Cortex XDR, add a new webhook-forwarding External Application pointed at your organization's own trigger URL:

Cortex XDR signs every delivery with X-XDR-HMAC-SHA256 — an HMAC-SHA256 of the exact request body, using the secret above. Landfall verifies this signature before ever looking at the body's shape; an unsigned or wrongly-signed delivery is refused with the same uniform 401 every other signed-webhook source in Landfall returns, with no hint about which organization it was addressed to.

What Cortex XDR's fields become

Every field besides incident_id is optional in the mapping: a wrong field-presence assumption degrades to "field absent, hint not derived" rather than a rejected delivery.

3. Test it

Cortex XDR's own webhook-forwarding settings don't offer a built-in test-payload button, so the fastest check is signing and posting a realistic body yourself:

BODY='{
  "incident_id": "7",
  "creation_time": 1700000000000,
  "severity": "high",
  "status": "new",
  "description": "Suspicious PowerShell execution",
  "alert_count": 3,
  "alert_sources": ["XDR Agent"]
}'
SIGNATURE=$(printf '%s' "$BODY" | openssl dgst -sha256 -hmac "<your webhook signing secret>" | sed 's/^.* //')

curl -i -X POST https://api.landfalls.ai/triggers/cortex-xdr/<your-org-slug> \
  -H "X-XDR-HMAC-SHA256: $SIGNATURE" \
  -H "Content-Type: application/json" \
  -d "$BODY"

Opens an incident titled Cortex XDR incident 7 at sev2 (from high), category suggested security.

Troubleshooting

Reference