--- title: "DataBee XSOAR Integration" slug: "databee-xsoar-integration" updated: 2025-12-01T08:09:49Z published: 2025-12-01T08:09:49Z canonical: "docs.databee.buzz/databee-xsoar-integration" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.databee.buzz/llms.txt > Use this file to discover all available pages before exploring further. # DataBee XSOAR Integration The Palo Alto Cortex XSOAR content pack for DataBee enables organizations to operationalize the insights from DataBee. The XSOAR content pack enables two critical use cases for security operations teams: 1. **Create Incidents**: Create incidents in XSOAR for investigation and remediation from the findings generated by DataBee. These findings include results from both Sigma detections and Detection Chains. 2. **Enrich Incident**: Add the DataBee commands to existing incident playbooks or use them on demand to add business context to your investigation. Add what DataBee knows about users and devices to reduce pivoting between tools to complete an investigation. The Palo Alto Cortex XSOAR content pack enriches your security incidents by performing cross-correlation with entity data within DataBee, enhancing the accuracy of security investigations by providing additional business context. The XSOAR content pack also amplifies the efficiency of DataBee security detections by allowing you to set up playbooks to open incidents and begin remediating these events. ## Obtaining DataBee’s XSOAR Content Pack You can obtain the DataBee XSOAR content pack from the [Cortex XSOAR Marketplace](https://www.paloaltonetworks.com/cortex/cortex-xsoar/marketplace) or contacting [DataBee Support](/user-manual/docs/help#contacting-databee-technical-support). ## Configuring DataBee on Cortex XSOAR 1. Once installed, log in to the XSOAR platform. 2. Navigate to **Settings** > **Integrations** > **Servers & Services**. 3. Search for DataBee. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/XSOAR_1.png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A56%3A28Z&se=2026-10-30T12%3A56%3A28Z&sr=c&sp=r&sig=qCir32ut1L64Q562if%2FRbmxEAG1gmbLdAmpqHKZ0eMU%3D) 4. Click **Add instance** to create and configure a new integration instance. 5. Fill in the data in the following fields: 1. Name: provide a suitable name for your DataBee instance 2. Fetches incidents/do not fetch: enable the checkbox depending on your preference to fetch or not fetch incidents/detection findings from DataBee. 3. You can view classifier, incident type, and mapper as desired. 4. Authentication Base URL: enter the DataBee base URL To authenticate, either use the DataBee username and password or a valid DataBee API token. Please go through the quick guide under Help, on the right side of the page, for detailed steps of the authentication methods. ![](https://cdn.document360.io/04e48772-4346-44a4-aa69-043eca42257c/Images/Documentation/XSOAR_configure_1(2).png?sv=2026-02-06&spr=https&st=2026-10-30T11%3A56%3A28Z&se=2026-10-30T12%3A56%3A28Z&sr=c&sp=r&sig=qCir32ut1L64Q562if%2FRbmxEAG1gmbLdAmpqHKZ0eMU%3D) 5. You can select Trust any certificate (not secure) or choose System proxy settings. 6. Additional findings context outputs: choose additional context data you wish to retrieve from the API. Note that requesting extensive data may impact your Cortex server's performance 7. Maximum incidents per fetch: enter a numerical value of the number of incidents to be pulled per fetch 8. First fetch timestamp: timestamp in ISO format or