Skip to main content

XSIAM Sink Node

Quick Reference​

XSIAM Credential The API key sent as the Authorization header on every request.

Endpoint URL The Cortex XSIAM HTTP Collector endpoint to POST events to. ex: https://api.xdr.paloaltonetworks.com/public_api/v1/xsiam

Overview​

The XSIAM Sink node sends events from your workflow to a Palo Alto Networks Cortex XSIAM HTTP Collector endpoint. Each record is serialized to JSON and POSTed directly to the collector — no forwarder or agent sits in between.

Records are sent exactly as they arrive at the node. Any normalization XSIAM expects — field renaming, OCSF mapping, timestamp formatting — should be done by upstream processing nodes, which makes this a natural terminal node for a security data pipeline.

Configuration​

FieldDescriptionRequiredDefault
XSIAM CredentialSelect or create an API key credential. Its value is sent verbatim as the Authorization header.Yes—
Endpoint URLThe XSIAM HTTP Collector URL to POST events to (e.g. https://api.xdr.paloaltonetworks.com/public_api/v1/xsiam).Yes—

Notes​

The credential is sent as-is. The stored API key becomes the Authorization header value with nothing added to it. If your XSIAM collector expects a scheme prefix, include it in the credential value itself. Requests are sent with Content-Type: application/json.

Events are sent one request per record. The node does not combine records into a single request, so a workflow processing a high event rate produces a proportional number of HTTP requests to the collector.

A failed send affects only its own record. When a POST fails — network error or a non-success status — that record is recorded as an error and the remaining records still go out. Because delivery is per record, a retry can re-send records that already succeeded, so treat XSIAM ingestion as at-least-once and expect the occasional duplicate.

When the node is managed by a data asset, the credential and endpoint are supplied by the asset and shown read-only in the node.