What Cymph uses it for
Cymph connects to Cortex XSOAR as a deployment target — playbooks authored in Cymph are translated to the XSOAR playbook format and pushed to the instance. See Deploy playbooks.Requirements
To generate an API key, follow the instructions here.
The version you select changes both the API paths and the authentication headers. XSOAR 6 sends the key alone; XSOAR 8 additionally sends the key ID as an
x-xdr-auth-id header, which is why the extra field appears. Selecting the wrong version fails the connection test with “Target does not seem to be a valid Cortex XSOAR version instance”.Permissions
An API key is assigned a role, and the key inherits that role’s permissions. Rather than using an administrative key, create a custom role granting only what Cymph uses:
Everything else can be set to None — Cymph does not run playbooks, execute automations, manage integrations, or read the War Room.