Independent tools, projects and ideas for the Palo Alto Networks Cortex platform: Cortex XSIAM, Cortex XDR and Cortex XSOAR.

A GoCortexIO skill bundle. Somebody names a technology they run; the bundle returns what that technology, its product class or its vendor has historically been caught up in, and the detection logic that goes with each case.

A GoCortexIO skill bundle. Authors Palo Alto Networks Cortex XSIAM Data Model Rules in Cortex Query Language (XQL) from raw vendor log samples.

Go Cortex Git is a Rust-based CLI tool designed to serve as a lightweight abstraction layer between local Git operations and the Cortex XSIAM REST API. It enables security teams to version-control and deploy XSIAM configuration objects.

Spellbook is a development workbench for creating Cortex Platform content. It provides tools for pack creation, validation, and packaging while keeping your content in a separate repository that you control. The key design principle is separation of concerns: Spellbook is the tool, your content is yours. You create a content instance with Spellbook, then push that instance to your own Git repository.

An intentionally vulnerable application designed to support Palo Alto Networks Cortex Cloud and XSIAM/XDR training. Features a wide range of deliberately implemented security vulnerabilities for assessment and testing.

GremlinBox is a collection of packages published across multiple package ecosystems for supply chain security testing and policy compliance evaluation.

A Rust-based application for Linux that generates endpoint telemetry aligned with MITRE ATT&CK techniques for security analytics, research, and training environments. SignalBench allows security professionals to generate realistic endpoint telemetry patterns.

A high-performance Rust CLI monitoring tool for Cortex XSIAM, CLOUD and XDR, delivering real-time, interactive case tracking with advanced terminal-based visualisation and comprehensive filtering capabilities.

A robust Rust-based SNMP trap forwarder designed to reliably capture SNMP v1/v2c/v3 traps from multiple ports and hosts and securely forward them to Cortex XSIAM HTTP endpoints.

A comprehensive TAXII 2.x server designed for testing XSIAM and XSOAR Threat Intelligence Management (TIM). MockTAXII offers a complete STIX/TAXII 2.1 implementation, generating realistic indicators, campaigns and reports, all with rich, interlinked relationships.

A custom pySigma backend specifically designed to convert Sigma rules into functional and accurate Cortex XSIAM XQL queries. Bridges the gap left by the standard pysigma-backend-cortexxdr.

A web-based platform for running simulated cyber attacks in containerised environments. It automatically downloads and manages the Rust-based Snellen CLI, so no manual setup or terminal access is required.