Ingest Palo Alto Cortex XDR detection findings and audit logs
- Latest Dynatrace
- Extension
- Published Oct 05, 2026
Ingest detection findings and audit logs from Palo Alto Cortex XDR into Dynatrace. Dynatrace enriches the detections with the entities it monitors, so you can prioritize threats that affect your production systems.
Get started
Overview
The Dynatrace integration with Palo Alto Cortex XDR lets you unify and contextualize security detections across DevSecOps tools and products. It facilitates centralized prioritization, visualization, and automation of security findings.
Palo Alto Cortex XDR is an extended detection and response platform that integrates endpoint, network, cloud, and identity data to stop sophisticated cyberattacks.
Dynatrace observes and monitors the infrastructure and application layers to help keep your organizational services and applications performant and reliable.
By ingesting Palo Alto Cortex XDR detections and enriching them with the monitored entities, Dynatrace gives operations teams an additional level of security visibility and uncovers blind spots they previously had.
Use cases
With the ingested data, you can accomplish various use cases, such as:
Requirements
Palo Alto Cortex XDR requirements
-
An active Cortex XDR tenant with API access for the capabilities used by this integration, including:
- Alerts (Get Alerts Multi-Events)
- Endpoints (Get Endpoint), used to enrich detections
- Management audit logs Optional
-
Cortex XDR tenant FQDN (for example,
api-{fqdn}.xdr.{region}.paloaltonetworks.com) -
A Cortex XDR API key and API key ID
Dynatrace requirements
-
ActiveGate version 1.310+ that must
- Run the Extensions 2.0 framework
- Reach the Cortex XDR API endpoints for your tenant FQDN
-
For required permissions, open Hub, select
Extensions, then open the Technical information tab. -
Generate an access token with the
openpipeline.events_securityscope and save it for later. For details, see Dynatrace API - Tokens and authentication.
Activation and setup
-
In Dynatrace, open Hub.
-
Look for Palo Alto Cortex XDR and select Install.
-
Follow the instructions to configure the extension.
-
To verify the configuration, run the following queries in
Notebooks:-
For detection finding events:
fetch security.events| filter event.provider == "Palo Alto Cortex XDR"AND event.type == "DETECTION_FINDING" -
For audit logs:
fetch logs| filter log.source == "Palo Alto Cortex XDR"
-
-
After installation, you can access and manage the extension in
Extensions. For details, see About Extensions.
Details
How it works
The integration runs as an extension on Dynatrace ActiveGate. After you enable and configure the Cortex XDR extension:
- The extension periodically polls the Cortex XDR APIs for detection findings and, when enabled, management audit logs, based on the ingestion configuration.
- Dynatrace maps the fetched data to the appropriate Dynatrace Semantic Dictionary data models.
- Dynatrace stores the data in the
default_securityeventsbucket (for details, see Built-in Grail buckets).
Licensing and costs
For billing information, see Events powered by Grail.
FAQ
Which Cortex XDR products does this integration support?
This integration ingests security events from the following products:
Which data model is used for Cortex XDR events in Dynatrace?
- Detection finding events store the individual detection findings per affected endpoint, represented by a Cortex XDR alert.
- Audit logs represent Cortex XDR management audit activity.
How does Dynatrace collect Cortex XDR detection findings and audit logs?
The integration ingests alerts from Cortex XDR based on the configured ingestion options:
- On the first ingest, Dynatrace fetches alerts created in the last
mdays, wheremis set by the Security events initial fetch time window option in the monitoring configuration. - On subsequent runs, the extension checks for alerts created in the last
nminutes, wherenis set by the Security events ingest frequency option in the monitoring configuration. - When enabled, the extension collects management audit logs every
pminutes, wherepis set by the Audit logs ingest frequency option. The first run starts from the current time.
Which fields are added on top of the core Dynatrace security event fields?
The cortex_xdr namespace is added for Cortex XDR-specific attributes on top of the core security event schema. The full upstream payload is stored in event.original_content.
Example fields added to detections:
cortex_xdr.alert_source: Alert source (for example, XDR Agent).cortex_xdr.case_id: Related case identifier, when present.cortex_xdr.module: Cortex module (for example, Behavioral Threat Protection).cortex_xdr.agent.version: Agent version.cortex_xdr.event_type: Cortex event type.
How is risk score normalized for Cortex XDR detections?
Dynatrace normalizes severity and risk scores for all findings ingested through this integration. Normalization helps you prioritize findings consistently, regardless of their source. For details, see Severity and score normalization.
-
dt.security.risk.levelis mapped from the Cortex XDR severity returned by the Alerts APIs. -
dt.security.risk.scoreis derived from that Cortex XDR severity using the standard Dynatrace static severity-to-score mapping.
dt.security.risk.level (mapped from finding.severity) | dt.security.risk.score (mapped from dt.security.risk.level) |
|---|---|
critical -> CRITICAL | 10.0 |
high -> HIGH | 8.9 |
medium -> MEDIUM | 6.9 |
low -> LOW | 3.9 |
other -> NONE | 0.0 |