---
title: "Integrate Cortex XDR with Red Canary"
slug: "integrate-cortex-xdr-with-red-canary"
updated: 2026-09-09T16:09:35Z
published: 2026-09-09T16:09:35Z
canonical: "docs.redcanary.com/integrate-cortex-xdr-with-red-canary"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://docs.redcanary.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integrate Palo Alto Cortex XDR with Zscaler MDR

Combining Palo Alto Networks Cortex XDR with Zscaler MDR’s advanced threat hunting and incident response capabilities creates a formidable defense against modern cyberattacks. This integration provides a unified view of threats across your environment, accelerates incident investigation, and improves overall security posture.

By leveraging the combined power of these platforms, organizations can gain deeper insights into malicious activities, prioritize critical alerts, and streamline response efforts.

To integrate Palo Alto Cortex XDR with Zscaler MDR, follow the procedure below from beginning to end.

## **Prerequisites**

- Cortex Tenant licensed with
  - Pro Per Endpoint (PAN-XDR-ADV-EP)
  - Event Forwarding EP (PAN-XDR-EP-FRWRD)
  - Extended Threat Hunting (PAN-XDR-XTH) - *required for Linux and MacOS deployments, optional for Windows*
- Cortex Version 3.3 or later

## **Step 1: Cortex Support Portal–****Provide Zscaler MDR your Account Registration Link**

Provide Zscaler MDR with your Account Registration Link so we can request that a new user be added to your account. Once the link is provided provided, we will use the link to request user creation. You will then need to approve the Zscaler MDR Request.

1. Login to your Cortex Customer Support Portal.
2. Click **Account Management** and then click **Account Details**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(228).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
3. Copy and then save the **Account Registration Link**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(229).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
4. Email this link to your Zscaler MDR contact who is supporting your integration experience.

> [!NOTE]
> **Note:** Zscaler MDR will use this link to request one to two users. If you have purchased Active Remediation, two user requests will be submitted.

## **Step 2: Cortex–Create a new Cortex profile**

Configure a Cortex Agent Settings profile to begin collecting endpoint data in the Cortex Data Lake.

1. Login to the Cortex tenant that you want to connect to Zscaler MDR.
2. From your address bar, copy the URL, and then save your Cortex Tenant Url. You’ll use this in a later step.
3. From your Cortex Homepage, click **Endpoints**, and then click **Policy Management**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(230).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
4. From the Prevention dropdown, click **Profiles**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(231).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
5. Scroll down, and then find the default Agent Settings profile (or select an existing Agent Settings prevention profile if applicable).

> [!NOTE]
> Note
> 
> If you’re using an existing Cortex instance, you do not need to create a new default Agent Settings profile. You can use an existing Agent Settings profile instead, minimizing the setup time and avoiding unnecessary duplication.
6. Right-click the default **Agent Settings profile**.
7. Click **Save As New**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(232).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
8. Enter a name for your Cortex Profile.
9. Scroll down to the XDR Pro Endpoints section, and then uncheck **Use Default**.
10. From the XDR Pro Endpoints Capabilities, select **Enabled**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(233).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
11. Click **Create**.
12. To apply this security profile to Endpoints, [follow these steps](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/apply-security-profiles-to-endpoints). For more information on Endpoint Data Collected by Cortex XDR, [click here](https://docs.paloaltonetworks.com/cortex/cortex-xdr/cortex-xdr-pro-admin/endpoint-security/customizable-agent-settings/endpoint-data-collected-by-cortex-xdr).

****Global Agent Settings****

One can configure a *global* Agent Settings profile that applies to all endpoints, r*egardless of operating system*. That is what is referred to above as the "Default Agent Setting profile". If the only default Agent Settings profile available is limited to a certain operating system, we recommend creating a Global Agent Settings profile that can be applied to all endpoints. Learn how to create a Global Agent Settings profile [here](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Configure-Global-Agent-Settings).

Once created, make sure that in addition to other desired settings, steps 1.9 and 1.10 are applied.

One can absolutely create other profiles that are specific to OS and apply them to their endpoints. However, those profiles and their application is not required for this integration. Check [this list](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Pro-Administrator-Guide/Endpoint-Security-Profiles) for the supported profile types by operating system.

## **Step 3: Cortex–Create API Key for your Service Account**

Create a service account API key to allow Zscaler MDR to pull Indicator of Compromise (IOC) and Behavioral Indicator of Compromise (BIOC) alert data, monitor endpoint health, and respond to threats with Cortex XSOAR capabilities.

1. From your Cortex Homepage, click **Settings**, and then click **Configurations**.
2. From the Integrations dropdown, click **API Keys**.

![5.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/10657704213783.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
3. Click **Copy URL**, and then save your Cortex API url. You’ll use this in a later step.

![6.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/10657667173783.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
4. Click **+New Key**.

![7.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/10657704375575.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
5. From the Security Level section, select **Advanced**.
6. From the Role dropdown, select **Instance Administrator**.
7. Click **Save**.
8. Click **Copy**, and then save the API Key for your Service Account. You’ll use this in a later step. ![8.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/10657667295383.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
9. From the list of API keys, search for the key you just created and copy the key ID number. Save the Cortex API Key ID. You’ll use this in a later step. ![9.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/10657667442967.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)

## **Step 4: Cortex–Download your Service Account JSON WEB Token**

Download a consolidated package of credentials and tokens which Zscaler MDR uses to authenticate and ingest telemetry data from the Cortex Data Lake hosted in Google Cloud Platform (GCP).

1. From your Cortex Homepage, click **Settings**, and then click **Configurations**.

![10.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/10657667590679.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
2. From the Data Management dropdown, click **Event Forwarding**.
3. From the Activation section, click **Enable Endpoints Event Forwarding**.
4. From the Destination section, click **Copy**, and then save your Cortex GCP Path. You’ll use this in a later step.
5. From the Destination section, click **Generate and download**. You’ll use this file in a later step.

## **Step 5: Zscaler MDR–Input your Cortex information**

Enter your Cortex information into Zscaler MDR to start sending Cortex telemetry to Zscaler MDR.

1. In the Zscaler MDR portal, click **Integrations**. If you do not see the required integration, click **See all integrations**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/integrations(2).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
2. In the search bar, type and then select P**alo Alto Networks Cortex XDR**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/palo(1).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
3. Click **Configure**.
4. Enter a Description.
5. Enter your Cortex Tenant URL from [Step 1.2](/docs/integrate-cortex-xdr-with-red-canary#step-1-cortex%E2%80%93create-a-new-cortex-profile:~:text=From%20your%20address%20bar%2C%20copy%20the%20URL%2C%20and%20then%20save%20your%20Cortex%20Tenant%20Url.%20You%E2%80%99ll%20use%20this%20in%20a%20later%20step.).
6. Enter your Cortex API URL from [Step 2.3](/docs/integrate-cortex-xdr-with-red-canary#step-1-cortex%E2%80%93create-a-new-cortex-profile:~:text=Click%20Copy%20URL%2C%20and%20then%20save%20your%20Cortex%20API%20url.%20You%E2%80%99ll%20use%20this%20in%20a%20later%20step.).
7. Enter your Cortex API Key - Service Account from [Step 2.8](/docs/integrate-cortex-xdr-with-red-canary#step-1-cortex%E2%80%93create-a-new-cortex-profile:~:text=Click%20Copy%2C%20and%20then%20save%20the%20API%20Key%20for%20your%20Service%20Account.%20You%E2%80%99ll%20use%20this%20in%20a%20later%20step.).
8. Enter your Cortex API Key ID.
9. Enter your Cortex GCP Path.
10. Click **Choose File**, and then upload your Cortex Service Account JSON Web Token from [Step 3.5](/docs/integrate-cortex-xdr-with-red-canary#:~:text=From%20the%20Security%20Level%20section%2C%20select%20Advanced.).
11. Click **Test**.
12. If you followed the steps correctly a success message will display. If there’s an error, you can follow the help text in the message and make your corrections.

![13.png](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/10658289648791.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
13. Click **Save**.

## **Step 6: Cortex Support Portal–Approve the new user notification(s)**

Zscaler MDR needs you to approve the new user notification(s).

> **Note**: You will receive two separate user approval notifications if you are an Active Remediation user. These users will default to the “Standard User” support portal role, which Zscaler MDR requires.

1. The Zscaler MDR contact who is supporting your integration experience will notify you that the user request(s) have been submitted for your approval.
2. Login to your Cortex Customer Support Portal.
3. Click the icon.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(234).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
4. Click **Approve** for the notification titled “New user RC Viewer has requested access to your account.”

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(235).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
5. If you have purchased Active Remediation, click **Approve** for the notification titled “New user RC Active Remediation has requested access to your account.”

## **Step 7: Cortex Gateway–Create a Zscaler MDR Security Operations role**

A custom role must be created in Cortex to enable the Zscaler MDR customer security operations team to support your security needs.

1. Navigate to your Cortex Gateway from the Customer Support Portal.
2. Click **Resources**.
3. Click **XDR Gateway**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/14288791388567.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
4. Click **Permission Management,** and then click **Roles**.
5. Click **New Role**.
6. In the ROLE NAME field, enter **Zscaler MDR Security Operations**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(236).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
7. Select the permissions shown in the following images:

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(237).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(238).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(239).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
8. Click **Save**.

## **Step 8: Cortex Gateway–Update the Zscaler MDR integration user permissions**

The Zscaler MDR integration user created in [Step 5](https://redcanary.document360.io/docs/integrate-cortex-xdr-with-red-canary#step-1-cortex%E2%80%93create-a-new-cortex-profile:~:text=Enter%20your%20Cortex%20information%20into%20Red%20Canary%20to%20start%20sending%20Cortex%20telemetry%20to%20Red%20Canary.) will automatically populate within your Cortex Gateway, however it is not given a role by default. You'll need to update the user’s role to the custom Zscaler MDR Security Operations role you created in [Step 6](https://redcanary.document360.io/docs/integrate-cortex-xdr-with-red-canary#step-1-cortex%E2%80%93create-a-new-cortex-profile:~:text=Step%206%3A%20Cortex%20Support%20Portal%E2%80%93Approve%20the%20new%20user%20notification(s)).

1. Navigate to your Cortex Gateway from the Customer Support Portal.
2. Click **Resources**.
3. Click **XDR Gateway**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/14288791388567.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
4. Click **Permission Management**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/14288796468887.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
5. Click **Permissions**.
6. Search for the new Zscaler MDR user and then click the to edit.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/14288796944407.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
7. From the Role section, select the role that was created in [Step 6](/docs/integrate-cortex-xdr-with-red-canary#step-1-cortex%E2%80%93create-a-new-cortex-profile:~:text=Step%206%3A%20Cortex%20Support%20Portal%E2%80%93Approve%20the%20new%20user%20notification(s)).

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(240).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
8. Click **Save**.
9. Click **Yes** on the validation window.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/14288793184663.png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)

## **Step 9: Cortex Gateway–Update the Zscaler MDR Active Remediation user permissions**

> **Note**: This step is only applicable for users who have purchased Active Remediation.

The Zscaler MDR Active Remediation user created in [Step 7](/docs/integrate-cortex-xdr-with-red-canary#step-1-cortex%E2%80%93create-a-new-cortex-profile:~:text=Step%207%3A%20Cortex%20Gateway%E2%80%93Create%20a%20Red%20Canary%20Security%20Operations%20role) will automatically populate within your Cortex Gateway, however it is not given a role by default. You'll need to update the user’s role to Privileged Responder.

1. Navigate to your Cortex Gateway from the Customer Support Portal.
2. Click **Resources**.
3. Click **XDR** **Gateway**

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(242).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)

.
4. Click **Permission Management**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(243).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
5. Click **Permissions**.
6. Search for the new Zscaler MDR user and then click the to edit.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(244).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)
7. From the Role section, select **Privileged Responder**.
8. Click **Save**.
9. Click **Yes**.

![](https://cdn.document360.io/75147bee-bf0d-444c-8afb-6e83b11ec0ef/Images/Documentation/image(245).png?sv=2026-02-06&spr=https&st=2026-11-04T15%3A00%3A04Z&se=2026-11-04T16%3A00%3A04Z&sr=c&sp=r&sig=8xyD8HWu121X6AOvoIHnIww6r6yLxyyQFrHVpXpemYg%3D)

## FAQ

---

### 

****What type of data is ingested via the Palo Alto Cortex XDR integration?****

Zscaler MDR prioritizes investigating native alerts from Cortex XDR that enable high fidelity threat detection and provide key contextual evidence. This includes alerts from the following categories:

- [XDR Agent](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Glossary#:~:text=for%20Cortex%20products.-,Alert,-When%20you%20identify)
- [XDR Analytics/BIOC](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Glossary#:~:text=as%20grayed%20out.-,Analytics%20behavioral%20indicators%20of%20compromise%20(ABIOCs),-In%20contrast%20to)
- [XDR IOC](https://docs-cortex.paloaltonetworks.com/r/Cortex-XDR/Cortex-XDR-Documentation/Fully-Qualified-Domain-Name-FQDN#:~:text=take%20remedial%20action.-,Indicators%20of%20compromise%20(IOCs),-IOCs%20provide%20the)

****Can I forward Cortex EDR data to multiple locations?****

Yes, the PAN-XDR-EP-FRWRD Cortex Event Forwarding license supports forwarding data to multiple destinations simultaneously. For example, if you’re already sending Cortex EDR data to a SIEM or another destination using this license, you can use the same license to also send EDR data to Zscaler MDR.

****Where can I find more information about Cortex XDR?****

The Cortex XDR Agent Administrator’s Guide is available in the [Cortex Help Center](https://docs-cortex.paloaltonetworks.com/).