DDS: Palo Alto Networks Cortex XSOAR v1.0.0 by jaypatel7-crest · Pull Request #23331 · DataDog/integrations-core

jaypatel7-crest · 2026-04-15T14:15:31Z

What does this PR do?

Motivation

Review checklist (to be filled by reviewers)

Feature or bugfix MUST have appropriate tests (unit, integration, e2e)
Add the qa/skip-qa label if the PR doesn't need to be tested during QA.
If you need to backport this PR to another branch, you can add the backport/<branch-name> label to the PR and it will automatically open a backport PR once this one is merged

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4eb02aadc0

ℹ️ About Codex in GitHub

Codex has been enabled to automatically review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

When you sign up for Codex through ChatGPT, Codex can also answer questions or update the PR, like "@codex address that feedback".

chatgpt-codex-connector · 2026-04-17T12:10:37Z

+		"id": 272995163,
+		"name": "High integration error rate alert",
+		"type": "query alert",
+		"query": "sum(last_10m):sum:palo_alto_networks_cortex_xsoar.api_execution.count{integration_name:*, -api_response_type:successful}.as_count() / sum:palo_alto_networks_cortex_xsoar.api_execution.count{integration_name:*} >= 0.5",


Normalize denominator with as_count in error-rate query

This monitor computes error_count / total_calls but only the numerator is converted to counts (...-api_response_type:successful}.as_count()), while the denominator stays as sum:...api_execution.count{integration_name:*}. That mixes count and rate semantics, so the resulting value is not a true error ratio and can trigger noisy or incorrect alerts; use a consistent count rollup on both sides of the division.

Useful? React with 👍 / 👎.

rtrieu · 2026-04-17T19:38:54Z

Created DOCS-14046 for docs review.

github-actions · 2026-04-21T06:39:23Z

⚠️ Recommendation: Add qa/skip-qa label

This PR does not modify any files shipped with the agent.

To help streamline the release process, please consider adding the qa/skip-qa label if these changes do not require QA testing.

estherk15 · 2026-04-23T22:10:16Z

@@ -0,0 +1,70 @@
+## Overview
+
+[Palo Alto Networks Cortex XSOAR][1] is a security orchestration, automation, and unifying incident response (SOAR) platform that helps teams automate incident handling and integrate security tools to enhance SOC efficiency and reduce remediation time.


Suggested change

[Palo Alto Networks Cortex XSOAR][1] is a security orchestration, automation, and unifying incident response (SOAR) platform that helps teams automate incident handling and integrate security tools to enhance SOC efficiency and reduce remediation time.

[Palo Alto Networks Cortex XSOAR][1] is a security orchestration, automation, and unifying incident response (SOAR) platform that helps teams automate incident handling, integrate security tools, and reduce remediation time.

estherk15 · 2026-04-23T22:12:14Z

+This integration parses and ingests the following types of logs:
+
+- **Audit Logs**: Capture all administrative user activities within Palo Alto Networks Cortex XSOAR.
+- **Incidents**: Capture key details of incidents, including severity, status, type, and ownership, to support tracking and investigation activities in Palo Alto Networks Cortex XSOAR.


Suggested change

- **Incidents**: Capture key details of incidents, including severity, status, type, and ownership, to support tracking and investigation activities in Palo Alto Networks Cortex XSOAR.

- **Incidents**: Capture incident details, including severity, status, type, and ownership, to support tracking and investigation in Palo Alto Networks Cortex XSOAR.

estherk15 · 2026-04-23T22:13:27Z

+- **Audit Logs**: Capture all administrative user activities within Palo Alto Networks Cortex XSOAR.
+- **Incidents**: Capture key details of incidents, including severity, status, type, and ownership, to support tracking and investigation activities in Palo Alto Networks Cortex XSOAR.
+
+You can visualize detailed insights into these logs through the out-of-the-box dashboards. Additionally, ready-to-use Cloud SIEM detection rules are available to help you monitor and respond to potential security threats effectively.


Suggested change

You can visualize detailed insights into these logs through the out-of-the-box dashboards. Additionally, ready-to-use Cloud SIEM detection rules are available to help you monitor and respond to potential security threats effectively.

Visualize detailed insights into these logs with out-of-the-box dashboards. This integration also includes Cloud SIEM detection rules to help you monitor and respond to potential security threats.

estherk15 · 2026-04-23T22:15:38Z

+- **Automation Insight Metrics**: Provide visibility into playbook, task, and command execution activity, including counts, failures, and execution duration, to help monitor automation performance, identify errors, and evaluate operational efficiency.
+- **API Execution Metrics**: Provide visibility into API execution activity, including total calls and rate-limited requests, to help monitor integration usage, detect throttling events, and evaluate API performance.
+- **SLA Metrics**: Provide visibility into incident response timelines, including mean time to detection, triage, containment, and resolution, along with counts of items within and outside SLA thresholds, helping monitor response performance and compliance.


Suggested change

- **Automation Insight Metrics**: Provide visibility into playbook, task, and command execution activity, including counts, failures, and execution duration, to help monitor automation performance, identify errors, and evaluate operational efficiency.

- **API Execution Metrics**: Provide visibility into API execution activity, including total calls and rate-limited requests, to help monitor integration usage, detect throttling events, and evaluate API performance.

- **SLA Metrics**: Provide visibility into incident response timelines, including mean time to detection, triage, containment, and resolution, along with counts of items within and outside SLA thresholds, helping monitor response performance and compliance.

- **Automation Insight Metrics**: Track playbook, task, and command execution activity, including counts, failures, and execution duration.

- **API Execution Metrics**: Track API execution activity, including total calls and rate-limited requests.

- **SLA Metrics**: Track incident response timelines, including mean time to detection, triage, containment, and resolution, along with counts of items within and outside SLA thresholds.

estherk15 · 2026-04-23T22:17:10Z

+- **API Execution Metrics**: Provide visibility into API execution activity, including total calls and rate-limited requests, to help monitor integration usage, detect throttling events, and evaluate API performance.
+- **SLA Metrics**: Provide visibility into incident response timelines, including mean time to detection, triage, containment, and resolution, along with counts of items within and outside SLA thresholds, helping monitor response performance and compliance.
+
+Visualize detailed insights into these metrics through the out-of-the-box dashboards. Additionally, monitors are provided to alert you to any potential issues.


Suggested change

Visualize detailed insights into these metrics through the out-of-the-box dashboards. Additionally, monitors are provided to alert you to any potential issues.

Visualize detailed insights into these metrics with out-of-the-box dashboards. This integration also includes monitors to alert you to any potential issues.

estherk15 · 2026-04-23T22:26:20Z

+	"created_at": "2026-04-16",
+	"last_updated_at": "2026-04-16",
+	"title": "Anomalous spikes in playbook execution failure",
+	"description": "It monitors anomalous spikes in playbook failure rates by comparing failed vs total executions over time. Sudden increases may signal logic issues, integration failures, or dependency problems, impacting automation reliability and efficiency.",


Suggested change

"description": "It monitors anomalous spikes in playbook failure rates by comparing failed vs total executions over time. Sudden increases may signal logic issues, integration failures, or dependency problems, impacting automation reliability and efficiency.",

"description": "Monitors anomalous spikes in playbook failure rates by comparing failed executions against total executions over time. Sudden increases may signal logic issues, integration failures, or dependency problems that impact automation reliability.",

estherk15 · 2026-04-23T22:28:03Z

+	"created_at": "2026-04-17",
+	"last_updated_at": "2026-04-17",
+	"title": "Connectivity errors per integration alert",
+	"description": "It monitors for connectivity-related API execution errors per integration, which may indicate communication failures, network issues, or unavailable external services. Persistent errors can disrupt automation workflows and impact integration reliability in Cortex XSOAR.",


Suggested change

"description": "It monitors for connectivity-related API execution errors per integration, which may indicate communication failures, network issues, or unavailable external services. Persistent errors can disrupt automation workflows and impact integration reliability in Cortex XSOAR.",

"description": "Monitors connectivity-related API execution errors per integration, which may indicate communication failures, network issues, or unavailable external services. Persistent errors can disrupt automation workflows and reduce integration reliability.",

estherk15 · 2026-04-23T22:28:47Z

+    "created_at": "2026-04-16",
+    "last_updated_at": "2026-04-16",
+    "title": "High integration error rate alert",
+    "description": "It monitors for a high rate of integration errors, which may indicate failing commands, authentication problems, or service instability. Sustained error rates can disrupt automation workflows and reduce integration reliability in Cortex XSOAR.",


Suggested change

"description": "It monitors for a high rate of integration errors, which may indicate failing commands, authentication problems, or service instability. Sustained error rates can disrupt automation workflows and reduce integration reliability in Cortex XSOAR.",

"description": "Monitors the rate of integration errors, which may indicate failing commands, authentication problems, or service instability. Sustained error rates can disrupt automation workflows and reduce integration reliability.",

estherk15 · 2026-04-23T22:31:51Z

+        "name": "High integration error rate alert",
+        "type": "query alert",
+        "query": "sum(last_10m):sum:palo_alto_networks_cortex_xsoar.api_execution.count{integration_name:*, -api_response_type:successful}.as_count() / sum:palo_alto_networks_cortex_xsoar.api_execution.count{integration_name:*}.as_count() >= 0.5",
+        "message": "{{#is_warning}}\r\n⚠️ **Warning**: Elevated rate-limited API calls detected**.\r\n\r\n📊 Current error rate is **{{value}}**, which is above the warning threshold.\r\n\r\nPlease monitor API usage and check for potential throttling or quota limits.\r\n\r\n{{/is_warning}}\r\n\r\n{{#is_alert}}\r\n🚨 **Alert**: High integration error rate detected**.\r\n\r\n📊 Current error rate is **{{value}}**, exceeding the alert threshold.\r\n\r\nThis indicates that a significant portion of API calls are being rate-limited. Investigate API usage spikes, integration behavior, or vendor rate limits immediately.\r\n\r\n{{/is_alert}}\r\n\r\n@example@example.com",


Is this correct?
**Warning**: Elevated rate-limited API calls detected**

It was a typo. I’ve corrected it.

estherk15 · 2026-04-23T22:33:20Z

+    "version": 2,
+    "created_at": "2026-04-16",
+    "last_updated_at": "2026-04-16",
+    "title": "High integration error rate alert",


Optional suggestion. For all three monitors, "alert" in the title is redundant since the monitor is already an alert.

This make sense, I've updated the PR.

estherk15

Thanks for making those updates!

Add Palo Alto Networks Cortex XSOAR integration

cb42010

temporal-github-worker-1 Bot added docs/review-requested ecosystems/review-requested product/review-requested labels Apr 15, 2026

dd-octo-sts Bot added documentation dev/testing dev/tooling labels Apr 15, 2026

jaypatel7-crest added 9 commits April 15, 2026 19:49

Merge branch 'master' into palo-alto-networks-cortex-xsoar-v1.0.0

9b2f7a9

Updated assets

fdc1abe

Resolve CI failures

b0b1bcf

Resolve CI failures

8f47167

Resolve CI failures

d0091b5

Resolve CI failures

627a936

Resolve CI failures

edd73a7

Resolve CI failures

6e9b549

Merge branch 'master' into palo-alto-networks-cortex-xsoar-v1.0.0

4eb02aa

jaypatel7-crest marked this pull request as ready for review April 17, 2026 12:04

jaypatel7-crest requested review from a team as code owners April 17, 2026 12:04

dd-octo-sts Bot added team/agent-integrations team/documentation team/logs-integrations-reviewers team/saas-integrations labels Apr 17, 2026

chatgpt-codex-connector Bot reviewed Apr 17, 2026

View reviewed changes

rtrieu self-assigned this Apr 17, 2026

rtrieu added the editorial review Waiting on a more in-depth review from a docs team editor label Apr 17, 2026

Address codex review comment

74a9000

estherk15 reviewed Apr 23, 2026

View reviewed changes

jaypatel7-crest added 4 commits April 24, 2026 09:57

Addressed review comments

5a75c1f

Renamed monitors

edd6f24

Updated manifest

364f144

Merge branch 'master' into palo-alto-networks-cortex-xsoar-v1.0.0

742ba91

estherk15 approved these changes Apr 28, 2026

View reviewed changes

temporal-github-worker-1 Bot added docs/approved and removed docs/review-requested labels Apr 28, 2026

		@@ -0,0 +1,70 @@
		## Overview

		[Palo Alto Networks Cortex XSOAR][1] is a security orchestration, automation, and unifying incident response (SOAR) platform that helps teams automate incident handling and integrate security tools to enhance SOC efficiency and reduce remediation time.

	- Incidents: Capture key details of incidents, including severity, status, type, and ownership, to support tracking and investigation activities in Palo Alto Networks Cortex XSOAR.
	- Incidents: Capture incident details, including severity, status, type, and ownership, to support tracking and investigation in Palo Alto Networks Cortex XSOAR.

	You can visualize detailed insights into these logs through the out-of-the-box dashboards. Additionally, ready-to-use Cloud SIEM detection rules are available to help you monitor and respond to potential security threats effectively.
	Visualize detailed insights into these logs with out-of-the-box dashboards. This integration also includes Cloud SIEM detection rules to help you monitor and respond to potential security threats.

	Visualize detailed insights into these metrics through the out-of-the-box dashboards. Additionally, monitors are provided to alert you to any potential issues.
	Visualize detailed insights into these metrics with out-of-the-box dashboards. This integration also includes monitors to alert you to any potential issues.

	"description": "It monitors anomalous spikes in playbook failure rates by comparing failed vs total executions over time. Sudden increases may signal logic issues, integration failures, or dependency problems, impacting automation reliability and efficiency.",
	"description": "Monitors anomalous spikes in playbook failure rates by comparing failed executions against total executions over time. Sudden increases may signal logic issues, integration failures, or dependency problems that impact automation reliability.",

	"description": "It monitors for connectivity-related API execution errors per integration, which may indicate communication failures, network issues, or unavailable external services. Persistent errors can disrupt automation workflows and impact integration reliability in Cortex XSOAR.",
	"description": "Monitors connectivity-related API execution errors per integration, which may indicate communication failures, network issues, or unavailable external services. Persistent errors can disrupt automation workflows and reduce integration reliability.",

	"description": "It monitors for a high rate of integration errors, which may indicate failing commands, authentication problems, or service instability. Sustained error rates can disrupt automation workflows and reduce integration reliability in Cortex XSOAR.",
	"description": "Monitors the rate of integration errors, which may indicate failing commands, authentication problems, or service instability. Sustained error rates can disrupt automation workflows and reduce integration reliability.",

Conversation

jaypatel7-crest commented Apr 15, 2026

What does this PR do?

Motivation

Review checklist (to be filled by reviewers)

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Apr 17, 2026

Choose a reason for hiding this comment

Uh oh!

rtrieu commented Apr 17, 2026

Uh oh!

github-actions Bot commented Apr 21, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

estherk15 left a comment

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

github-actions Bot commented Apr 21, 2026 •

edited

Loading