Overview

Integrating Palo Alto Cortex XSIAM with imper.ai enables the platform to securely deliver real-time security events - such as verification outcomes (for example, success, failure, or risk indicators), session context, and identity event details - to Cortex XSIAM. Events are sent as JSON over HTTPS through Cortex XSIAM's Custom HTTP Log Collector, where they become a searchable dataset available for correlation rules, alerts, and investigation.

NOTE

Only admin users can integrate Cortex XSIAM with imper.ai. A Cortex XSIAM administrator is required to create the HTTP Log Collector.

---

Setup

To connect imper.ai to Cortex XSIAM, first create an HTTP Log Collector in Cortex XSIAM, then provide its URL and API key to imper.ai.

Step 1 - Create an HTTP Log Collector in Cortex XSIAM

1. In Cortex XSIAM, navigate to Settings → Data Sources.

2. Click Add Data Source, search for and select HTTP, then click Connect.

3. Configure the collector:

   • Specify a descriptive Name for your HTTP log collection configuration.

   • Set Compression to uncompressed.

   • Set Log Format to JSON.

   • Specify Vendor and Product (for example, imper.ai for both).

4. Click Save & Generate Token.

5. Copy the API key immediately using the copy icon next to the key. It is not displayed again after this step.

6. From the Custom Collectors page, copy the HTTP Log Collector URL (format: https://api-{tenant external URL}/logs/v1/event).

For detailed setup instructions, refer to the Cortex XSIAM Custom HTTP Log Collector documentation.

Step 2 - Provide the details to imper.ai

Provide the HTTP Log Collector URL and the API key to imper.ai to enable the integration. Once configured, imper.ai begins streaming events to Cortex XSIAM in near real time.

---

Transport

Item	Value
Protocol	HTTPS
Method	POST
Payload	JSON (UTF-8)
Authentication	API key provided by Cortex XSIAM (in the Authorization header)
Delivery	Near real-time event streaming
Endpoint URL	https://api-{tenant external URL}/logs/v1/event

---

Event Format

imper.ai sends every finished verification as an OCSF 1.3.0 Detection Finding event. For sample events, the full list of fields and how the verification verdict maps to severity and risk, see SIEM Event Format (OCSF).

---

Testing the Integration

You can use the following Python script to send sample events directly to your Cortex XSIAM HTTP Log Collector and confirm that the connection and parsing work as expected.

Sample test script (Python)

import json
from datetime import datetime, timezone

import requests


def send_event_to_xsiam(cortex_token, cortex_api_url):
    """
    Send security events to Cortex XSIAM HTTP Log Collector.

    Args:
        cortex_token: API key from Cortex XSIAM HTTP Log Collector
        cortex_api_url: HTTP Log Collector URL (e.g., https://api-{tenant external URL}/logs/v1/event)
    """
    headers = {
        "Authorization": cortex_token,
        "Content-Type": "application/json"
    }

    # Trimmed OCSF Detection Finding event - see the SIEM Event Format (OCSF) page
    now_ms = int(datetime.now(timezone.utc).timestamp() * 1000)
    event = {
        "class_uid": 2004,
        "class_name": "Detection Finding",
        "category_uid": 2,
        "category_name": "Findings",
        "activity_id": 1,
        "activity_name": "Create",
        "type_uid": 200401,
        "type_name": "Detection Finding: Create",
        "time": now_ms,
        "severity_id": 1,
        "severity": "Informational",
        "message": "Identity verification: verified",
        "metadata": {
            "version": "1.3.0",
            "product": {"name": "imper.ai", "vendor_name": "imper.ai"}
        },
        "finding_info": {
            "uid": "test-verification",
            "title": "Identity verification: verified",
            "types": [],
            "created_time": now_ms
        }
    }
    body = json.dumps(event)
    res = requests.post(
        url=cortex_api_url,
        headers=headers,
        data=body
    )
    return res

# Usage:
# cortex_token = "your-api-key-here"
# cortex_api_url = "https://api-{tenant external URL}/logs/v1/event"
# response = send_event_to_xsiam(cortex_token, cortex_api_url)

---

Processing in Cortex XSIAM

The HTTP Log Collector receives JSON payloads and creates a dataset for search, correlation rules, alerts, and investigation. Fields are parsed directly from the JSON structure.

---

Schema Compatibility

• New fields may be added over time.

• Existing fields will not be renamed or removed without notice.

• Unknown fields are safely ignored by Cortex XSIAM.