cortex-xdr

Palo Alto Networks App for Splunk leverages the data visibility provided by Palo Alto Networks next-generation firewalls and endpoint security with Splunk's extensive investigation and visualization capabilities to deliver an advanced security reporting and analysis tool.

Multi-EDR & SIEM mock server. SentinelOne, CrowdStrike, Defender, Elastic, Cortex XDR, Splunk, M365 and Sentinel — 8 platforms in one process. Real API paths, real auth, deterministic seed data, fault injection, scenario engine, SPL parser. GitHub Action + one-click Render deploy. BSL-1.1

A python-based API client for Cortex XDR API.

Automated threat intelligence collector built with Python and GitHub Actions — fetches recent IOCs from open sources, normalizes and enriches them (IP, URL, hash, CVE), and publishes ready-to-use feeds in CSV, JSON, and STIX formats.

Script to remove the Cortex XDR agent through a common way and using the agent cleaner tool.

XQL query generator, for generating quick Hunting queries. Cortex XDR focussed. A github pages project.

A CLI client and elm package for Palo Alto Networks Cortex API

Rapid7 InsightVM Postgres Reporting built in Python and PostgreSQL Rapid7 InsightVM API tools using Python PaloAlto Cortex XDR API

Wazuh SIEM wodle that ingests alerts and incidents from Palo Alto's Cortex XDR via the Cortex XDR REST API.

CLI tool for Cortex XDR (Palo Alto Networks)

Silently uninstalls Cortex XDR (and Traps) with advanced cleanup and logging.

Cloud incident response playbook using Wiz CNAPP and Palo Alto Cortex XDR — Toxic Combination detection on AWS

Information Security Analyst

Redacted sample logs from Cortex XDR/XSIAM event forwarding to cloud storage — xdr_data (endpoint EDR) and cwp_packages_raw (Cloud Workload Protection) schema/format reference.