Generic Intel Feed ↗

Important

This connector is only available for tenants that onboarded after July 26, 2026. For tenants that onboarded before this date, use Marketplace to access the standalone integration. For more information, see Marketplace.

This connector is available with any active Cortex XSIAM or Cortex AgentiX license.

Fetch threat intelligence indicators from generic CSV, JSON, plain text, RSS, and public DNS feeds, with extensive configuration options to support a wide variety of feed formats. Also provides the Generic Export Indicators Service to expose a list of indicators from the system as an outbound feed (EDL) for consumption by external products.

This connector includes the following sub-capabilities (Marketplace integrations link to PAN DEV for more information):

• CSVFeed
• EDL: Use the Generic Export Indicators Service integration to provide an endpoint with a list of indicators as a service for the system indicators.
• JSON Feed
• Plain Text Feed
• Public DNS Feed
• RSS Feed

To configure this connector, follow the steps outlined in the configuration wizard.