Palo Alto Networks · Schema

Cortex XSOAR Integration Manifest

Schema for the integration YAML manifest file used by Cortex XSOAR (formerly Demisto) and Cortex XSIAM content packs. The manifest defines the integration identity, configuration parameters, commands, arguments, outputs, and execution runtime settings. Integration packs are published to the Cortex Marketplace and can be developed using the demisto-sdk CLI toolchain. Each integration enables XSOAR playbooks and automation scripts to interact with third-party security products and services.

Cloud SecurityCybersecurityFirewallNetwork SecuritySASESOARThreat IntelligenceXDR

Properties

Name	Type	Description
name	string	Internal name of the integration used as a unique identifier within the content pack. Must match the filename of the integration Python or JavaScript file and be consistent across all related pack fil
display	string	Human-readable display name shown in the XSOAR UI integration list, War Room context, and Cortex Marketplace listing. Should clearly identify the product or service the integration connects to.
category	string	Integration category used for Cortex Marketplace classification, filtering, and discovery. Determines which Marketplace category page the integration appears under.
description	string	Short description of the integration's purpose and primary capabilities. Displayed in the integration list and Marketplace search results. Should summarize what the integration does and which product
detaileddescription	string	Detailed markdown-formatted description displayed on the Cortex Marketplace product page. Should include prerequisites, authentication setup instructions, API version compatibility, and notable limita
image	string	Base64-encoded PNG image used as the integration icon in the XSOAR UI and Marketplace. Should be a square image, typically 120x120 pixels, representing the integrated product or vendor logo.
type	string	Execution runtime type for the integration script. 'python2' uses Python 2.7 (deprecated). 'python3' uses Python 3.x in a Docker container. 'javascript' runs natively in the XSOAR engine without Docke
configuration	array	List of instance configuration parameters displayed in the XSOAR integration settings UI. Each parameter corresponds to a field the user must fill in when configuring an integration instance, such as
script	object	Script execution settings, runtime configuration, and command definitions exposed by this integration. Defines the integration's behavioral capabilities and available actions.
fromversion	string	Minimum XSOAR or XSIAM platform version required to use this integration (e.g., '6.0.0', '8.4.0'). The integration will not be available on older platform versions.
toversion	string	Maximum XSOAR or XSIAM platform version this integration is compatible with. Used to deprecate integrations that are superseded by newer versions targeting later platforms.

View JSON Schema on GitHub