> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cymph.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Cortex XSOAR

> Deploy playbooks to a Palo Alto Cortex XSOAR instance.

## What Cymph uses it for

Cymph connects to Cortex XSOAR as a deployment target — playbooks authored in Cymph are translated to the XSOAR playbook format and pushed to the instance. See [Deploy playbooks](/how-tos/deploy-playbooks).

## Requirements

| Field            | Description                                               |
| ---------------- | --------------------------------------------------------- |
| **Instance URL** | The URL of your Cortex XSOAR instance                     |
| **Version**      | Whether the instance is XSOAR **6** or **8**              |
| **API key**      | An API key from your instance                             |
| **API key ID**   | **XSOAR 8 only** — the numeric ID shown alongside the key |

To generate an API key, follow the instructions [here](https://docs-cortex.paloaltonetworks.com/r/Cortex-XSOAR-6-API/Cortex-XSOAR-6-overview).

<Note>
  The version you select changes both the API paths and the authentication headers. XSOAR 6 sends the key alone; XSOAR 8 additionally sends the key ID as an `x-xdr-auth-id` header, which is why the extra field appears. Selecting the wrong version fails the connection test with "Target does not seem to be a valid Cortex XSOAR *version* instance".
</Note>

## Permissions

An API key is assigned a role, and the key inherits that role's permissions. Rather than using an administrative key, create a custom role granting only what Cymph uses:

| Component     | Level      | Why                                                     |
| ------------- | ---------- | ------------------------------------------------------- |
| **Playbooks** | Read-Write | Search and read playbooks, and save a deployed playbook |
| **Incidents** | Read-Only  | Search incidents when resolving deployment targets      |

Everything else can be set to **None** — Cymph does not run playbooks, execute automations, manage integrations, or read the War Room.

<Tip>
  Cortex XSOAR's built-in roles are broader than this. **Instance Admin** in particular grants far more than Cymph needs; a custom role with the two components above is the least-privilege option.
</Tip>

## What Cymph reads and writes

## Testing the connection