Connect Qevlar to Palo Alto Cortex (Cortex XDR / XSIAM) to investigate Cortex alerts and run XQL queries against tenant telemetry. This page lists the API permissions Qevlar requires and how to grant them.
Overview
Cortex XDR and Cortex XSIAM share the same public API, authentication, and key setup, so Qevlar connects to either platform the same way — follow the steps on this page regardless of which one you run.
Qevlar authenticates to Cortex with an Advanced API key. Each request is signed with the API Key ID, a random nonce, a timestamp, and an SHA-256 authorization hash — no user account or interactive sign-in. Access is governed by the security level and role assigned to the API key. The connector is read-only.
| API | Purpose | Base URL |
|---|---|---|
| Cortex XDR public API | Run XQL queries and read incident data | https://api-{fqdn}/public_api/v1/ |
{fqdn} is your Cortex tenant domain, for example your-tenant.xdr.us.paloaltonetworks.com.
Connection details
Enter these values when configuring the connector in Qevlar:
| Field | Where to find it | Required |
|---|---|---|
| Tenant FQDN | Your Cortex tenant URL, e.g. your-tenant.xdr.<region>.paloaltonetworks.com | Yes |
| API Key ID | Settings → Configurations → Integrations → API Keys (the ID column) | Yes |
| API Key | Shown once when the API key is created | Yes |
Enter the FQDN without the https:// prefix and without the api- host prefix; Qevlar adds them.
Required permissions
Cortex governs API access through the security level and role assigned to the API key. Create the key with both of the following:
| Setting | Value | Why |
|---|---|---|
| Security level | Advanced | Qevlar signs each request with a nonce and timestamp, which requires an Advanced key. A Standard key will not authenticate. |
| Role | Viewer + Investigator (or a custom read-only role with both capabilities) | Viewer grants read access to incidents and alerts — the alert Qevlar investigates. Investigator is the minimum predefined role that can run XQL queries against tenant telemetry; the Viewer role alone cannot run XQL. |
The API key's role must grant both: view incidents and alerts (the Viewer capability) and run XQL queries (the Investigator capability). A custom read-only role covering both also works. No write or response permissions are needed.
Setup
- Open API key management. In the Cortex console, go to Settings → Configurations → Integrations → API Keys.
- Create a new key. Select New Key, set Security Level to Advanced, and assign a role that grants both incident/alert view (Viewer) and XQL query access (Investigator) — or a custom read-only role with both. The Viewer role alone cannot run XQL queries.
- Record the credentials. Copy the API Key immediately — it is shown only once — and note the API Key ID from the ID column.
- Get the tenant FQDN. Take it from your Cortex console URL, e.g.
your-tenant.xdr.<region>.paloaltonetworks.com. - Configure the connector. In Qevlar, add the Palo Alto Cortex connector and enter the connection details above.
Verify the connection
After saving, Qevlar runs a health check by submitting a minimal XQL query. If it fails, check, in order:
- The API key security level is Advanced, not Standard.
- The key's role grants incident/alert view and XQL query permissions.
- The API Key and API Key ID belong to the same key (the ID is the integer next to the key in the ID column).
- The FQDN is the tenant domain only, without
https://or theapi-prefix.
API reference
| Operation | HTTP | Endpoint |
|---|---|---|
| Start XQL query | POST | api-{fqdn}/public_api/v1/xql/start_xql_query |
| Get query results | POST | api-{fqdn}/public_api/v1/xql/get_query_results |
| Get incident extra data | POST | api-{fqdn}/public_api/v1/incidents/get_incident_extra_data |
Each request is signed with x-xdr-auth-id (API Key ID), x-xdr-nonce, x-xdr-timestamp, and an SHA-256 Authorization hash.