Complete data source catalog - Learn more about the complete data source catalog available in Cortex Cloud. - Administrator Guide

Complete data source catalog - Learn more about the complete data source catalog available in Cortex Cloud. - Administrator Guide - Cortex CLOUD

Cortex Cloud Runtime Security Documentation

Product

Cortex Cloud Application Security > Cortex CLOUD

License

Cloud Runtime Security

Creation date

2024-12-24

Last date published

2026-06-10

Category

Administrator Guide

Abstract

Learn more about the complete data source catalog available in Cortex Cloud.

The complete data source catalog is a conceptual grouping that is comprised of all configuration points available for data ingestion across Cortex Cloud. It represents the aggregate of every integration method from vendor-specific connectors, cloud onboarding wizards, cloud onboarding wizards, and generic on-premise collectors to Palo Alto Networks integrations and specialized Marketplace integrations.

The catalog is best understood by categorizing data sources into the following core groups, which are managed across various pages in the Cortex Cloud user interface (UI):

Vendor-specific data sources: Integrations for specific third-party security and IT products, such as Okta and Box. These include standard data collectors configured on the Data Sources & Integrations page.
Cloud Service Provider (CSP) onboarding: Streamlined wizards designed for full integration with cloud environments, including AWS, Azure, GCP, and OCI, to collect assets, posture data, and logs. Configured on the Data Sources & Integrations page.
Generic on-premise data collectors: Flexible collectors for logs and data from local environments not tied to a specific vendor, including:
- Broker VM applets, such as Syslog Collector and Database Collector, configured using the Broker VMs page.
- XDR Collectors (XDRC) for on-host log collection, configured on the XDR Collectors page.
Palo Alto Networks integrations: Integrations with other Palo Alto Networks products, such as Next-Generation Firewall and Prisma Access, configured on the Data Sources & Integrations page.
Marketplace content packs: Packages that offer rich security content, often including a collection integration for data ingestion alongside automation components. These are installed from Settings → Configurations → Marketplace and configured using the Data Source Onboarder on the Data Sources & Integrations page.
Cloud Posture and Runtime Security data sources: These data sources provide agentless visibility and real-time control over cloud risks by using cloud-native APIs to monitor misconfigurations, scan container registries, and secure serverless functions or sensitive data across multi-cloud environments. These data sources are configured:
- Using Broker VM applets, such as Syslog Collector and Database Collector, configured using the Broker VMs page.
- On the Data Sources & Integrations page.

By consulting the specific documentation sections dedicated to each category as detailed below, you gain a complete overview of all available ingestion options that collectively form the data source catalog.