imper.ai

Appearance

Integrating Palo Alto Cortex XSIAM with imper.ai

Overview ​

Integrating Palo Alto Cortex XSIAM with imper.ai enables the platform to securely deliver real-time security events - such as verification outcomes (for example, success, failure, or risk indicators), session context, and identity event details - to Cortex XSIAM. Events are sent as JSON over HTTPS through Cortex XSIAM's Custom HTTP Log Collector, where they become a searchable dataset available for correlation rules, alerts, and investigation.

NOTE

Only admin users can integrate Cortex XSIAM with imper.ai. A Cortex XSIAM administrator is required to create the HTTP Log Collector.

Setup ​

To connect imper.ai to Cortex XSIAM, first create an HTTP Log Collector in Cortex XSIAM, then provide its URL and API key to imper.ai.

Step 1 - Create an HTTP Log Collector in Cortex XSIAM ​

  1. In Cortex XSIAM, navigate to Settings → Data Sources.

  2. Click Add Data Source, search for and select HTTP, then click Connect.

  3. Configure the collector:

    • Specify a descriptive Name for your HTTP log collection configuration.

    • Set Compression to uncompressed.

    • Set Log Format to JSON.

    • Specify Vendor and Product (for example, imper.ai for both).

  4. Click Save & Generate Token.

  5. Copy the API key immediately using the copy icon next to the key. It is not displayed again after this step.

  6. From the Custom Collectors page, copy the HTTP Log Collector URL (format: https://api-{tenant external URL}/logs/v1/event).

For detailed setup instructions, refer to the Cortex XSIAM Custom HTTP Log Collector documentation.

Step 2 - Provide the details to imper.ai ​

Provide the HTTP Log Collector URL and the API key to imper.ai to enable the integration. Once configured, imper.ai begins streaming events to Cortex XSIAM in near real time.

Transport ​

ItemValue
ProtocolHTTPS
MethodPOST
PayloadJSON (UTF-8)
AuthenticationAPI key provided by Cortex XSIAM (in the Authorization header)
DeliveryNear real-time event streaming
Endpoint URLhttps://api-{tenant external URL}/logs/v1/event

Event Fields ​

Required Fields ​

FieldTypeDescription
@timestampstringEvent time in ISO-8601 UTC
vendorstringVendor name
productstringProduct name

Product-Specific Fields ​

FieldTypeDescription
user_namestringUsername of the user
user_emailstringEmail address of the user
referrer_emailstringEmail address of the referrer
verification_statusstringVerification status (for example, verified, risk_detected, timeout)
risk_scorenumberRisk score (0–10)
extra_dataobjectDictionary containing additional contextual information

Example Event Payload ​

json
{
  "@timestamp": "2026-01-04T12:34:56.789Z",
  "vendor": "imper.ai",
  "product": "imper.ai",
  "user_name": "alice",
  "user_email": "alice@example.com",
  "referrer_email": "bob@example.com",
  "verification_status": "verified",
  "risk_score": 2,
  "additional_info": {
    "device_type": "Android Mobile",
    "platform": "Chrome Browser",
    "timezone": "America/New_York",
    "ip_address": "1.1.1.1",
    "country_code": "US",
    "isp": "AT&T"
  }
}

Testing the Integration ​

You can use the following Python script to send sample events directly to your Cortex XSIAM HTTP Log Collector and confirm that the connection and parsing work as expected.

Sample test script (Python)
python
import json
from datetime import datetime, timezone

import requests


def send_event_to_xsiam(cortex_token, cortex_api_url):
    """
    Send security events to Cortex XSIAM HTTP Log Collector.

    Args:
        cortex_token: API key from Cortex XSIAM HTTP Log Collector
        cortex_api_url: HTTP Log Collector URL (e.g., https://api-{tenant external URL}/logs/v1/event)
    """
    headers = {
        "Authorization": cortex_token,
        "Content-Type": "application/json"
    }

    # Example event payload matching imper.ai event structure
    event1 = {
        "@timestamp": datetime.now(timezone.utc).isoformat() + "Z",
        "vendor": "imper.ai",
        "product": "imper.ai",
        "user_name": "alice",
        "user_email": "alice@example.com",
        "referrer_email": "bob@example.com",
        "verification_status": "verified",
        "risk_score": 2,
        "additional_info": {
            "device_type": "Android Mobile",
            "platform": "Chrome Browser",
            "timezone": "America/New_York",
            "ip_address": "1.1.1.1",
            "country_code": "US",
            "isp": "AT&T"
        },
        "message": "User verification completed successfully"
    }

    event2 = {
        "@timestamp": datetime.now(timezone.utc).isoformat() + "Z",
        "vendor": "imper.ai",
        "product": "imper.ai",
        "user_name": "charlie",
        "user_email": "charlie@example.com",
        "verification_status": "risk_detected",
        "risk_score": 8,
        "additional_info": {
            "device_type": "Desktop",
            "platform": "Firefox Browser",
            "ip_address": "2.2.2.2",
            "country_code": "CA"
        },
        "message": "High risk verification detected"
    }
    # Separate records with newline delimiter
    # Each record is a JSON object serialized to a string
    body = json.dumps(event1) + "\n" + json.dumps(event2)
    res = requests.post(
        url=cortex_api_url,
        headers=headers,
        data=body
    )
    return res

# Usage:
# cortex_token = "your-api-key-here"
# cortex_api_url = "https://api-{tenant external URL}/logs/v1/event"
# response = send_event_to_xsiam(cortex_token, cortex_api_url)

Processing in Cortex XSIAM ​

The HTTP Log Collector receives JSON payloads and creates a dataset for search, correlation rules, alerts, and investigation. Fields are parsed directly from the JSON structure.

Schema Compatibility ​

  • New fields may be added over time.

  • Existing fields will not be renamed or removed without notice.

  • Unknown fields are safely ignored by Cortex XSIAM.

Copyright © Imper AI