Welcome to the Cortex XSOAR Developer Hub and thank you for your interest! Here you will find a lot of information on how to develop content in Cortex XSOAR. If you see something missing or errors, please let us know by using the Report an issue button at the bottom of each page. We value your contribution and we strive to give you a great developer experience.

About Cortex XSOAR

Cortex XSOAR's security orchestration and automation enables standardized, automated, and coordinated response across your security product stack. Playbooks powered by thousands of security actions make scalable, accelerated incident response a reality. On this site you will learn the ins and out of Cortex XSOAR's development platform so you can begin create content and integrations.

Developer Documentation

The Cortex XSOAR Developer Hub includes several documentation sections, that cover different use cases, from


Learn the core fundamentals to get started developing with Cortex XSOAR. This section includes documents that cover many relevant concepts that are useful to understand how Cortex XSOAR works, what components are used for which tasks and how the contribution process works.

Getting Started

Do you want to build a Cortex XSOAR Integration?



Incidents, Fields & Layouts

Incident Lifecycle



Detailed instructions to learn step-by-step.


In the Reference section you will find detailed reference documentation about all the Cortex XSOAR components: Integration, Scripts, Playbooks, etc. As we add more content, new information will be published here.


If you are a Palo Alto Networks Technology Partner, you will find Partners section of the site.

Last updated on