---
title: "Integrate Palo Alto Networks Wildfire with Red Canary via email"
slug: "integrate-palo-alto-networks-wildfire-with-red-canary-via-email"
updated: 2026-10-22T15:15:10Z
published: 2026-10-22T15:15:10Z
canonical: "docs.redcanary.com/integrate-palo-alto-networks-wildfire-with-red-canary-via-email"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Palo Alto Networks Wildfire with Zscaler MDR via Email

Palo Alto Networks Wildfire provides critical insights into malicious file behavior. To integrate Palo Alto Networks Wildfire with Zscaler MDR via email, follow the procedure below from beginning to end.

Before connecting to Palo Alto Networks Wildfire to Zscaler MDR, make sure the following configuration requirement is met:

Create a [Palo Alto Networks Wildfire user account](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClNICA0#:~:text=On%20the%20left%20select%20Members,the%20Submit%20button%20to%20save) using the Zscaler MDR email provided in [Step 1.7](https://redcanary.document360.io/docs/integrate-palo-alto-networks-wildfire-with-red-canary-via-email#:~:text=Click%20Save%20Configuration.%20This%20will%20generate%20the%20email%20address%20you%20will%20use%20to%20send%20Palo%20Alto%20Wildfire%20alerts%20to.).

## Step 1: Zscaler MDR–Create a Zscaler MDR email for alerts

Create a Zscaler MDR provided-email to send Wildfire alerts for ingestion.

1. In the Zscaler MDR portal, click **Integrations**. If you do not see the required integration, click **See all integrations**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations(5).png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
2. In the search bar, type and then select Palo Alto Networks Wildfire.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/wildfire.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
3. Click **Configure**.
4. Select a display category.
5. Under the Ingest Format/Method dropdown, select **Palo Alto Networks Wildfire via Email**.

![2.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7385865017623.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
6. Click **Save Configuration**. This will generate the email address you will use to send Palo Alto Wildfire alerts to.

![3.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7385865118487.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
7. Click **Edit Configuration**.
8. With your alert source configured, click **Activate**.
9. With your Zscaler MDR email generated, log in to Palo Alto Networks Wildfire.

## Step 2: Palo Alto Customer Support Portal–Create a Wildfire User account

Create a Wildfire User account to enable Wildfire to send alerts to the Zscaler MDR alert collector.

1. Login into the [Palo Alto customer support portal](https://support.paloaltonetworks.com/) with your Wildfire admin account.
2. From the Members dropdown click **WildFire Users**.
3. Click **Add Wildfire Users**.
4. Enter the Zscaler MDR provided email address.
5. Click **Submit**.
6. Select the wildfire device you want to connect to Zscaler MDR.

**![1.1.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/10125061038103.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)**
7. Enter the required information.
8. **Click Submit**.

## Step 3: Zscaler MDR–Retrieve your Wildfire activation link

### To return to a pre existing integration:

1. In the Zscaler MDR portal, click **Integrations**.
2. Scroll down, and then select your third-party security source.
3. Click **Edit Configuration**.
4. **Click View Alerts**.

**![1.2.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/10125044802455.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)**
5. Click your **Alert ID**.

![1.3.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/10125060984343.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)
6. Click the **Show original alert** dropdown.

**![1.4.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/10125044661911.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)**
7. To activate the find command, press **Control+F** (or **Command+F** on a Mac).
8. Type and search for **sso.paloaltonetworks.com/welcome**.
9. From the HTML section, copy and save the URL.

> [!TIP]
> **Example**: https://sso.paloaltonetworks.com/welcome/testnumber://support.paloaltonetoworks.com/

**![1.5.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/10125457501975.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)**
10. To activate your new alert source, copy and paste the URL form [Step 3.9](https://redcanary.document360.io/docs/integrate-palo-alto-networks-wildfire-with-red-canary-via-email#:~:text=From%20the%20HTML%20section%2C%20copy%20and%20save%20the%20URL.) into a new browser window.
11. Create a new password for your Wildfire account.
12. Click **Create My Account**.

## Step 4: Palo Alto Networks Wildfire–Configure email alerts

Adjust your Palo Alto Networks Wildfire settings to send generated alerts to your Zscaler MDR-provided email.

1. Create a [Wildfire user account](https://knowledgebase.paloaltonetworks.com/KCSArticleDetail?id=kA10g000000ClNICA0#:~:text=On%20the%20left%20select%20Members,the%20Submit%20button%20to%20save) using the Zscaler MDR email provided in [Step 1.7](https://redcanary.document360.io/docs/integrate-palo-alto-networks-wildfire-with-red-canary-via-email#:~:text=Click%20Save%20Configuration.%20This%20will%20generate%20the%20email%20address%20you%20will%20use%20to%20send%20Palo%20Alto%20Wildfire%20alerts%20to.).
2. From your Wildfire dashboard, click **Settings**.
3. In the Configure Alerts section, select the types of alerts you want to send Zscaler MDR. We recommend selecting **Malware**, **Grayware**, and **Phishing** as these are the most useful alerts to Zscaler MDR. ![4.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/7385865144471.png?sv=2026-02-06&spr=https&st=2026-11-09T11%3A54%3A30Z&se=2026-11-09T12%3A54%3A30Z&sr=c&sp=r&sig=DTiFcJC%2BaEca3FouuLVTGI%2F3EbODcbgQjsBuG7p88KA%3D)

> **Note**: If you send **Benign** alerts, Zscaler MDR will automatically mark them as “not a threat”.
4. Click **Update Notification**.