Cortex XDR
Connect Cortex XDR to Safeguard: what it provides, how to set it up, and the frameworks it provides evidence for.
Connect Cortex XDR to collect endpoint detection & response evidence with automated compliance tests, switched on per workspace.
| Category | Endpoint Detection & Response |
| Connect with | API token |
| What a connection produces | Automated compliance tests |
| Cortex XDR's guide | cortex-docs.paloaltonetworks.com |
Connect with an API token
-
In Cortex XDR:
- In Cortex XDR, go to Settings › Configurations › Integrations › API Keys.
- Click + New Key.
- Choose the security level: Standard or Advanced. Safeguard's Key type field records which one you chose.
- Optionally turn on Enable Expiration Date and add a comment that identifies the key as Safeguard's.
- Under Roles, select an existing role with the access Safeguard needs (read-only), or choose Custom for granular permissions.
- Click Generate, then copy the API key before closing the dialog.
Where to find the other values:
- API key ID: The ID column of the API Keys table, next to the key you created.
- API URL: In the API Keys table, right-click the key and select View Examples; the CURL Example URL starts with your tenant address (https://api-<fqdn>). Paste the part up to the host name.
- Key type (optional): The security level you chose when generating the key (Standard or Advanced), also shown in the API Keys table.
Cortex XDR shows the secret only once, so copy it before you leave the page.
Source: cortex-docs.paloaltonetworks.com, checked 2026-10-07.
The permissions Safeguard needs:
Viewer. -
On Compliance › Connectors, open Cortex XDR, click Connect, choose API token and fill in:
Field What to enter API URL Required. For example: https://api-acme.xdr.us.paloaltonetworks.com API key Required. Stored encrypted and never shown again. API key ID Required. Key type (optional) — -
Click Connect with token.
Frameworks
Safeguard's automated tests read Cortex XDR and map to the controls below. When a test passes, the result is evidence toward each control it maps to, in every framework listed. It is evidence toward a control, not proof that the control is met on its own.
| Framework | Evidence | Controls | Tests |
|---|---|---|---|
| SOC2 | Automated tests | CC6.8, CC7.2, CC7.3, CC7.4 | 5 |
| ISO/IEC 27001 | Automated tests | A.5.26, A.8.1, A.8.7, A.8.16 | 5 |
| HIPAA Security Rule | Automated tests | 164.308(a)(5), 164.308(a)(6) | 5 |
| PCI DSS | Automated tests | 5.2.1, 5.3.1, 12.10.1 | 5 |
| NIST CSF 2.0 | Automated tests | DE.AE-02, DE.CM-09, PR.PS-01, RS.MI-02 | 5 |
These tests are switched on per workspace by the Safeguard team.
Related
- Endpoint Detection & Response connectors
- Compliance connectors: how connecting works, card statuses and multiple accounts
- Connector setup reference: every connector in one table
- Frameworks and connectors: how connectors provide evidence for frameworks