Are these APIs free to use?

Both Prisma Cloud and Cortex XSOAR are commercial Palo Alto Networks products with licensing tiers, and the APIs are included with those licenses. Contact Palo Alto Networks for pricing. Jentic provides the integration layer, not the underlying subscriptions.

What kinds of security work fall outside these two APIs?

These APIs cover cloud posture and orchestration, not endpoint detection, network firewall management, vulnerability scanning, or application-layer security. Security data feeding XSOAR often comes from separate integrated tools like SIEM, EDR, and threat intel feeds.

Palo Alto Networks APIs for AI Agents

SecurityComplianceThreat DetectionMixed ProvenanceBearer tokenAPI keyAgent Ready

www.paloaltonetworks.com

Palo Alto Networks API Catalog

2 APIs across 1 product group.

Security2

Prisma Cloud CSPM APIQuery cloud security alerts, check compliance posture, manage security policies, and inventory multi-cloud assets across AWS, Azure, and GCP through Palo Alto Networks' Prisma Cloud CSPM platform.~91 endpoints Cortex XSOAR APIManage Cortex XSOAR incidents, indicators, playbooks, war rooms, evidence, users, and automation scripts for security orchestration and response workflows.~27 endpoints

Which Palo Alto Networks API should I use?

I want to...	Use	Why
Detect cloud misconfigurations and compliance drift	Prisma Cloud CSPM API	Prisma Cloud CSPM queries alerts, compliance posture, and asset inventory across AWS, Azure, and GCP.
Orchestrate incident response and playbooks	Cortex XSOAR API	Cortex XSOAR manages incidents, indicators, war rooms, and playbook execution for SOAR workflows.
Track security work in incidents and war rooms	Cortex XSOAR API	Cortex XSOAR owns incident records, evidence, and analyst collaboration; Prisma Cloud only produces the findings.

Install Jentic One Beta

Connect the Palo Alto Networks APIs to your agent

Jentic One is a self-hosted execution layer for AI agents. It lets your agent call the Palo Alto Networks APIs, or any other public or private API you need. You set the rules, the agent never sees your credentials, and every call is logged.

Two steps, two machines. Install the instance in a safe environment, then register your agent from wherever it runs.

Step 1: Jentic One Host machine

# On the machine that will host your Jentic One instance:
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fpaloaltonetworks.com" | sh

Step 2: Agent machine

# On the machine where your agent runs (keep this separate from the instance):
curl -fsSL "https://jentic.com/install.sh?src=apis&api=%2Fapis%2Fpaloaltonetworks.com" | sh
jentic register       # connects your agent to your Jentic One instance

Jentic One is in public beta. The setup above keeps your agent separate from the instance, which is what you want before using real credentials: an agent running as the same OS user as Jentic One can read its stored keys directly. Just evaluating? A single local install is fine to start. See the secure deployment guide for the tiers.

Once connected, ask your agent something like: .

Why Jentic?

What agents get from Jentic-routed access to this vendor.

Setup

Wiring these APIs by hand means handling two different auth models, Prisma Cloud's bearer token with regional host selection and Cortex XSOAR's Authorization-header key against your own host, plus your own retry and error handling. With Jentic you install once, add each Palo Alto Networks API from the Jentic directory, store each credential once, and your agent calls both.

Permission scoping

Your own rules decide which operations each API exposes to the agent. You can let it read Prisma Cloud alerts and compliance posture while withholding cloud-account onboarding, and let it create Cortex XSOAR incidents while withholding playbook execution, so higher-impact actions are added only when you choose.

Credential isolation

FAQs

Specific to using Palo Alto Networks APIs through Jentic.

What can an agent do across the Palo Alto Networks APIs on Jentic?

An agent can detect cloud security issues with Prisma Cloud CSPM, covering alerts, compliance posture, and multi-cloud asset inventory, and then orchestrate the response with Cortex XSOAR, covering incidents, indicators, war rooms, and playbooks. The two APIs let one agent go from finding a cloud risk to running an automated response.

Do the two APIs share one set of credentials?

No. Prisma Cloud CSPM authenticates with a bearer token derived from an access key and secret, while Cortex XSOAR uses an API key in the Authorization header pointed at your own XSOAR host. Each API is added and credentialed separately in your Jentic One instance.

When should I use Prisma Cloud CSPM versus Cortex XSOAR?

Use Prisma Cloud CSPM to find and assess cloud misconfigurations, compliance drift, and asset risk across AWS, Azure, and GCP. Use Cortex XSOAR when you need to open incidents, enrich indicators, collaborate in war rooms, or run playbooks in response to those findings.

Can I connect a cloud finding to an automated response?

Yes. An agent can read a high-severity alert or compliance failure from Prisma Cloud, then create a Cortex XSOAR incident and execute a playbook to remediate it. This is the main cross-API pattern for the Palo Alto Networks portfolio on Jentic.

BOOK A DEMO

Start Connecting APIs to Your AI Agents

Browse thousands of APIs and connect them all to your agent with Jentic One. One layer, one credential — every API your agent needs.

Book a Demo

For Agents

APIs2 in catalogue

Endpoints118 indexed

AuthBearer token / API key

ProvenanceMixed provenance

An agent can query cloud security alerts, check compliance posture against frameworks like CIS and PCI-DSS, and inventory multi-cloud assets through Prisma Cloud, then create incidents, enrich indicators, and execute response playbooks through Cortex XSOAR. This lets one agent move from detecting a cloud risk to orchestrating its remediation.

Palo Alto Networks pairs cloud security posture management with a full security orchestration and response platform, so detection and remediation live under one vendor. Prisma Cloud finds misconfigurations and compliance drift across three clouds, and Cortex XSOAR turns those findings into automated, auditable response workflows.

Use for: Monitoring multi-cloud security posture and compliance with Prisma Cloud and orchestrating incident response and playbooks with Cortex XSOAR

Not supported: endpoint detection, network firewall management, vulnerability scanning, threat intelligence generation, application-layer security

Credentials: No. Prisma Cloud CSPM uses bearer token authentication from an access key and secret, while Cortex XSOAR uses an API key in the Authorization header against your own XSOAR host, so each API needs its own credential.

What AI Agents Can Do with Palo Alto Networks

Each workflow spans multiple Palo Alto Networks APIs. Jentic routes each operation to the right API automatically.

Cloud finding to orchestrated response

An agent pulls a high-severity misconfiguration or compliance failure from Prisma Cloud, then opens a Cortex XSOAR incident and runs a remediation playbook. This connects cloud detection to an auditable response workflow without an analyst copying alert details by hand.

Example prompt:

List open high-severity alerts via Prisma Cloud GET /alert, then create a Cortex XSOAR incident with POST /incident and trigger a playbook with POST /playbook/execute.

APIs used

Prisma Cloud CSPM API + Cortex XSOAR API

Compliance drift into SOC tracking

An agent checks compliance posture against a framework like CIS or PCI-DSS in Prisma Cloud, and for each failing standard creates a tracked Cortex XSOAR incident with the failing resources attached as evidence. This gives compliance findings a documented owner and timeline.

Example prompt:

Retrieve posture via Prisma Cloud GET /compliance/posture, then for failing standards create incidents with POST /incident and attach findings via POST /entry.

APIs used

Prisma Cloud CSPM API + Cortex XSOAR API

Enrich cloud alerts with indicators

An agent triages Prisma Cloud alerts tied to anomalous activity, then records the associated IPs, domains, and hashes as indicators of compromise in Cortex XSOAR for playbook-driven enrichment. This links cloud posture data to the threat intel used across investigations.

Example prompt:

Fetch alert detail via Prisma Cloud GET /alert/{id}, then create matching indicators in Cortex XSOAR with POST /indicators/create.

APIs used

Prisma Cloud CSPM API + Cortex XSOAR API

Palo Alto Networks APIs for AI Agents

Palo Alto Networks API Catalog

Security2

Which Palo Alto Networks API should I use?

Connect the Palo Alto Networks APIs to your agent

Why Jentic?

FAQs

Start Connecting APIs to Your AI Agents

What AI Agents Can Do with Palo Alto Networks

If you need a different Security vendor