---
updatedAt: 2026-09-22T18:05:25.000Z
agentTools:
  projectIndex: https://docs.censys.com/llms.txt
---

# Palo Alto Cortex XSOAR/XSIAM Integration

The Censys for Palo Alto Cortex XSOAR/XSIAM integration adds commands to:

* Enrich IPs, web properties, and certificates in Cortex with Censys Platform data. 

* Initiate a Censys rescan of a host or web property. 

* Run a search across Censys data.

* Retrieve scan history for an IP address.

* Initiate a <Anchor target="_blank" href="https://docs.censys.com/docs/platform-threat-hunting-use-censeye-to-build-detections">CensEye</Anchor> automated pivoting job to find assets related to an IP, web property, or certificate.

Additionally, it includes a playbook for enriching IPs, domains, and certificates and a dashboard that shows all Censys actions executed using the app.

This guide walks through how to set up and use the Censys for Palo Alto Cortex XSOAR/XSIAM.

<Callout icon="📘" theme="info">
  ### Note

  Most of the Censys API calls used by this integration will deduct credits from your organization's balance. Reference the <Anchor target="_blank" href="https://docs.censys.com/reference/get-started">API documentation</Anchor> for more information on credit costs.
</Callout>

## Prerequisites

* Cortex version 6.0.0 or newer.

* A Cortex admin user with access to your instance.

* Your Censys Platform organization ID.
  * To obtain your organization ID:
    1. Open the Platform web console and ensure that your organization account is selected. Go to **Settings > Account Management > Personal Access Tokens**.
    2. The ID for your organization is shown in the "Current Organization" box. Click **Copy** to copy it to your clipboard.

       <Image src="https://files.readme.io/7987845077501dc8a00bc1730b50ce9c902522d0a164f7f9a62a3d90684a8685-Screenshot_2026-01-22_at_2.27.17_PM.png" align="center" border={true} />

* A Censys Platform Personal Access Token (PAT). <Anchor target="_blank" href="https://docs.censys.com/reference/get-started#step-2-create-a-personal-access-token">Instructions on how to create and manage PATs are available in the API documentation</Anchor>.

## Installation and configuration

1. Retrieve and install the integration <Anchor target="_blank" href="https://cortex.marketplace.pan.dev/marketplace/details/Censys/">from the Cortex Marketplace</Anchor>.
2. On the app configuration page:
   1. In the "API Token" field, enter your PAT.
   2. In the "Organization ID" field, enter your organization ID.
   3. (Optional) Check the box for **Use enrichment API for the ip command&#x20;**&#x74;o use the <Anchor target="_blank" href="https://docs.censys.com/docs/host-enrichment">get host enrichment API endpoint</Anchor> instead of the get host API endpoint when you use the `ip` command.
      * The host enrichment API is purpose-built to help security teams operationalize external internet data without the friction of traditional credit consumption. It provides a curated, fixed subset of host IPv4 or IPv6 data designed specifically for high-volume, automated lookups in SOC environments, such as SIEM and SOAR integrations.
      * If the get host enrichment API call fails, the command will automatically fall back to using the get host API endpoint.
3. Click **Save**.

## Censys for Palo Alto Cortex commands

The Censys for Cortex integration adds the following commands that can be executed via the automation browser or CLI.

### `cen-view`

`cen-view` returns Censys data for the target IP address or SHA256 certificate hash.

#### Input

| Argument name | Description                                                             | Required |
| :------------ | :---------------------------------------------------------------------- | :------- |
| `query`       | The target asset. Can be an IP address or SHA256 certificate hash.      | Yes      |
| `index`       | The index from which to retrieve data. Can be `ipv4` or `certificates`. | Yes      |

#### Example command

The following command will return all the Censys data available to your Censys account for the IP `8.8.8.8`.

```
!cen-view index=ipv4 query=8.8.8.8
```

### `cen-search`

`cen-search` runs a search query across Censys Platform datasets. Queries must use <Anchor target="_blank" href="https://docs.censys.com/docs/censys-query-language">Censys Query Language (CenQL)</Anchor> syntax. It returns previews of assets matching the query.

#### Input

| Argument name | Description                                                                                                                          | Required |
| :------------ | :----------------------------------------------------------------------------------------------------------------------------------- | :------- |
| `query`       | Query used to search for hosts with matching attributes. Uses CenQL.                                                                 | Yes      |
| `page_size`   | The maximum number of hits to return in each response (minimum of 0, maximum of 100). (Applies for the host search.). Default is 50. | No       |
| `limit`       | The number of results to return. Default is 50.                                                                                      | No       |
| `index`       | The index from which to retrieve data. Can be `ipv4` or `certificates`.                                                              | Yes      |
| `fields`      | Censys data fields to return.                                                                                                        | No       |

#### Example command

The following command will search for and return certificates with the issuer common name "Let's Encrypt".

```
!cen-search index=certificates query="cert.parsed.issuer.common_name: "Let's Encrypt""
```

### `cen-host-history-list`

`cen-host-history-list` retrieves the Censys host scan history for an IP address.

#### Input

<Table align={["left","left","left"]}>
  <thead>
    <tr>
      <th>
        Argument name
      </th>

      <th>
        Description
      </th>

      <th>
        Required
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `host_id`
      </td>

      <td>
        The IP address of a host.
      </td>

      <td>
        Yes
      </td>
    </tr>

    <tr>
      <td>
        `start_time`
      </td>

      <td>
        The starting point of the scan timeline that you want to return.

        Supported date formats are `yyyy-mm-dd` and `yyyy-mm-ddTHH:MM:SSZ`.

        Example values include `2026-01-01` and `2026-01-10T14:05:44Z`.
      </td>

      <td>
        Yes
      </td>
    </tr>

    <tr>
      <td>
        `end_time`
      </td>

      <td>
        The end point of the scan timeline that you want to return. Uses the same formats as shown above for `start_time`.
      </td>

      <td>
        Yes
      </td>
    </tr>
  </tbody>
</Table>

#### Example command

The following command will return the Censys host history for the IP `8.8.8.8` from January 1, 2026 through January 7, 2026.

```
!cen-host-history-list host_id=8.8.8.8 start_time=2026-01-01 end_time=2026-01-07
```

### `cen-related-infrastructure-list`

`cen-related-infrastructure-list` initiates a <Anchor target="_blank" href="https://docs.censys.com/docs/platform-threat-hunting-use-censeye-to-build-detections">CensEye pivot analysis job</Anchor> for a target host, web property, or certificate. It returns a table containing matched key-value pairs, the count of assets that share that pair, and a link to view all matching assets in Censys. To use this command, your Censys organization must have access to the <Anchor target="_blank" href="https://docs.censys.com/docs/platform-threat-hunting">Adversary Investigation</Anchor> module.

#### Input

| Argument name | Description                                                                           | Required |
| :------------ | :------------------------------------------------------------------------------------ | :------- |
| `ioc_type`    | The type of asset to run CensEye on. Can be `host`, `web property`, or `certificate`. | Yes      |
| `ioc_value`   | The IP address, hostname and port pair, or SHA-256 hash of the target.                | Yes      |

#### Example command

The following command will initiate a CensEye job for the IP address `8.8.8.8`.

```
!cen-related-infrastructure-list ioc_type=host ioc_value=8.8.8.8
```

### `cen-rescan`

`cen-rescan` initiates a <Anchor target="_blank" href="https://docs.censys.com/docs/platform-live-rescan">rescan</Anchor> for a known host service at a specific IP and port or hostname and port.

#### Input

<Table align={["left","left","left"]}>
  <thead>
    <tr>
      <th>
        Argument name
      </th>

      <th>
        Description
      </th>

      <th>
        Required
      </th>
    </tr>
  </thead>

  <tbody>
    <tr>
      <td>
        `ioc_type`
      </td>

      <td>
        The target of the rescan. Use `service` for a host IP and port or `web property` for a hostname and port.
      </td>

      <td>
        Yes
      </td>
    </tr>

    <tr>
      <td>
        `ioc_value`
      </td>

      <td>
        The IP (for `service`) or hostname (for `web property`).
      </td>

      <td>
        Yes
      </td>
    </tr>

    <tr>
      <td>
        `port`
      </td>

      <td>
        The target port number.
      </td>

      <td>
        Yes
      </td>
    </tr>

    <tr>
      <td>
        `protocol`
      </td>

      <td>
        The `service` protocol type.

        This argument is required only if the `ioc_type` is `service`.
      </td>

      <td>
        No
      </td>
    </tr>

    <tr>
      <td>
        `transport_protocol`
      </td>

      <td>
        The `service` transport protocol type.

        This argument is required only if the `ioc_type` is `service`. Possible values are `unknown`, `TCP`, `UDP`, `ICMP`, or `QUIC`.
      </td>

      <td>
        No
      </td>
    </tr>
  </tbody>
</Table>

#### Example command

The following command will initiate a rescan of the HTTP service on port 443 running on `8.8.8.8`.

```
!cen-rescan ioc_type=service ioc_value=8.8.8.8 port=443 protocol=HTTP transport_protocol=TCP
```

### `domain`

`domain` returns all related IPs as relationships.

#### Input

| Argument name | Description                                 | Required |
| :------------ | :------------------------------------------ | :------- |
| `domain`      | A comma-separated list of domains to check. | Yes      |

#### Example command

The following command will return all IPs related to `amazon.com` and `google.com`.

```
!domain domain=amazon.com,google.com
```

### `ip`

`ip` runs reputation on the target IP address.

#### Input

| Argument name             | Description                                                                                                                               | Required |
| :------------------------ | :---------------------------------------------------------------------------------------------------------------------------------------- | :------- |
| `ip`                      | IP address or a list of IP addresses to assess reputation.                                                                                | Yes      |
| `use_enrichment_endpoint` | Whether to use the get host enrichment API endpoint instead of the get host API endpoint. Overrides your configured integration settings. | No       |

#### Example command

The following command will return information on the IP addresses `8.8.8.8.` and `8.8.4.4`.

```
!ip ip=8.8.8.8,8.8.4.4
```

## Indicator enrichment playbook

The indicator enrichment playbook can be executed within an incident or manually outside of an incident.

### Run the playbook in an incident

1. Open the incident and go to **Work Plan**.
2. Select and run the **Indicator Enrichment - Censys** playbook.

### Run the playbook outside of an incident

1. Navigate to **Playbooks** and search for "censys".
2. Select the **Indicator Enrichment - Censys** playbook.
3. Click **Edit** then **Run**.

## Use the Censys SOAR dashboard

The dashboard displays the total number of times the Censys playbook and Censys commands have been executed, including breakdown by execution type.