PPlatformAppStores

Cortex XSOAR Marketplace

Helpdesk

Palo Alto Networks · Service & helpdesk platforms

Best for: Security teams and technology contributors building, installing, or maintaining SOAR integrations, playbooks, automations, and related incident-response content for Cortex XSOAR/XSIAM.

Overview

Cortex XSOAR Marketplace is Palo Alto Networks' catalog for Cortex XSOAR content. Developers can publish and install content packs containing integrations, playbooks, automations, fields, layouts, and related security-operations components. The catalog supports filtering by price, author, use case, integrations, categories, tags, platform, and supported-by metadata. Contributors build or update packs through Cortex XSOAR, complete a contribution form, sign the Palo Alto Networks Contributor License Agreement, and participate in GitHub pull-request review.

How to build & ship

  1. 1Obtain a working Cortex XSOAR/XSIAM instance and Python development capability, then choose the Cortex XSOAR/XSIAM IDE or a standalone IDE.
  2. 2Use Bring Your Own Integration from the Integrations area and define the integration metadata, settings, parameters, and optional fetch, mirroring, or long-running configuration.
  3. 3Add commands, command arguments, and context outputs, then implement the integration with the documented Python, CommonServerPython, CommonServerUserPython, and BaseClient surfaces.
  4. 4Test the integration, create or update the content pack, contribute it from Cortex XSOAR, complete the contribution form, authenticate with GitHub, and sign the Palo Alto Networks Contributor License Agreement.
  5. 5Participate in the generated GitHub pull request by reviewing generated documentation, addressing reviewer changes, and updating or resubmitting the pack when needed.

Key APIs & SDKs

Cortex XSOAR/XSIAM IDE and Bring Your Own Integration
Integration YAML and metadata file
CommonServerPython
CommonServerUserPython
BaseClient

Integration types

Embedded app
Connector
Workflow action
Bot
Extension

Authentication & security

  • Primary auth: API key stored through Cortex XSOAR's built-in credential-management system when required by an integration.
  • Also supports: Username/password credentials where configured by an integration, OAuth or other target-service credentials where configured by an integration
  • Security review: Required
  • Contributed packs go through a GitHub pull request with reviewer assignment, generated-documentation review, contributor updates, and required Palo Alto Networks Contributor License Agreement signature.
  • The contributor submits from Cortex XSOAR, completes the contribution form, authenticates with GitHub, signs the Palo Alto Networks Contributor License Agreement, and submits. A branch and pull request are created in the xsoar-contrib content repository fork, a reviewer is assigned, generated documentation is checked against XSOAR standards, and the contributor addresses requested changes. Technology Partners use a GitHub pull request rather than the individual-contributor flow.
  • Not publicly specified for the Cortex XSOAR Marketplace.
Auth docs Store policies

Monetization

Free
Onboarding
Not publicly specified
Commission
Not publicly specified
Merchant of Record
Not publicly specified

Pros & cons for builders

Pros

  • Central catalog with broad content coverage and filtering by price, author, use case, integrations, categories, tags, platform, and supported-by metadata.
  • First-party IDE, Bring Your Own Integration, Script Helper, CommonServerPython, CommonServerUserPython, and BaseClient surfaces reduce repeated integration plumbing.
  • GitHub pull-request review, reviewer assignment, generated documentation, and a required Contributor License Agreement provide a defined contribution path.

Cons

  • Contributing requires a Cortex XSOAR/XSIAM instance, Python capability, GitHub participation, Contributor License Agreement signature, and pull-request review.
  • Commercial terms, fees, commissions, revenue share, and Marketplace API rate limits are not publicly specified.
  • The individual-contributor workflow is not intended for Technology Partners, and updating JavaScript integrations or scripts in an existing pack is documented as unsupported.

Frequently asked questions

How do I get my app approved on Cortex XSOAR Marketplace?

The contributor submits from Cortex XSOAR, completes the contribution form, authenticates with GitHub, signs the Palo Alto Networks Contributor License Agreement, and submits. A branch and pull request are created in the xsoar-contrib content repository fork, a reviewer is assigned, generated documentation is checked against XSOAR standards, and the contributor addresses requested changes. Technology Partners use a GitHub pull request rather than the individual-contributor flow.

What authentication does Cortex XSOAR Marketplace use?

Cortex XSOAR Marketplace apps primarily authenticate with API key stored through Cortex XSOAR's built-in credential-management system when required by an integration., also supporting Username/password credentials where configured by an integration, OAuth or other target-service credentials where configured by an integration.

How is Cortex XSOAR Marketplace monetized?

Cortex XSOAR Marketplace supports Free. Typical commission: Not publicly specified. Onboarding fee: Not publicly specified.

Is a security review required to list on Cortex XSOAR Marketplace?

Yes, Cortex XSOAR Marketplace requires a formal security or listing review before apps go live. Contributed packs go through a GitHub pull request with reviewer assignment, generated-documentation review, contributor updates, and required Palo Alto Networks Contributor License Agreement signature.