Palo Alto Networks App for Splunk leverages the data visibility provided by Palo Alto Networks next-generation firewalls and endpoint security with Splunk's extensive investigation and visualization capabilities to deliver an advanced security reporting and analysis tool.

A python-based API client for Cortex XDR API.

Automated threat intelligence collector built with Python and GitHub Actions — fetches recent IOCs from open sources, normalizes and enriches them (IP, URL, hash, CVE), and publishes ready-to-use feeds in CSV, JSON, and STIX formats.

Script to remove the Cortex XDR agent through a common way and using the agent cleaner tool.

XQL query generator, for generating quick Hunting queries. Cortex XDR focussed. A github pages project.

Multi-EDR & SIEM mock server. SentinelOne, CrowdStrike, Defender, Elastic, Cortex XDR, Splunk, M365 and Sentinel — 8 platforms in one process. Real API paths, real auth, deterministic seed data, fault injection, scenario engine, SPL parser. GitHub Action + one-click Render deploy. BSL-1.1

A CLI client and elm package for Palo Alto Networks Cortex API

Rapid7 InsightVM Postgres Reporting built in Python and PostgreSQL Rapid7 InsightVM API tools using Python PaloAlto Cortex XDR API

Wazuh SIEM wodle that ingests alerts and incidents from Palo Alto's Cortex XDR via the Cortex XDR REST API.

Information Security Analyst

CLI tool for Cortex XDR (Palo Alto Networks)

Cloud incident response playbook using Wiz CNAPP and Palo Alto Cortex XDR — Toxic Combination detection on AWS