SpecterOps · jeff-matthews · Dec 19, 2025 · Dec 18, 2025 · Dec 18, 2025 · Dec 18, 2025
diff --git a/docs/docs.json b/docs/docs.json
@@ -200,6 +200,13 @@
                   "integrations/bloodhound-api/json-formats"
                 ]
               },
+              {
+                "group": "Cortex XSOAR",
+                "pages": [
+                  "integrations/cortex-xsoar/configure",
+                  "integrations/cortex-xsoar/use"
+                ]
+              },
               {
                 "group": "Splunk",
                 "pages": [

diff --git a/docs/images/integrations/cortex-soar/add-bhe-instance.png b/docs/images/integrations/cortex-soar/add-bhe-instance.png
diff --git a/docs/images/integrations/cortex-soar/dbot-panel.png b/docs/images/integrations/cortex-soar/dbot-panel.png
diff --git a/docs/images/integrations/cortex-soar/incident-details.png b/docs/images/integrations/cortex-soar/incident-details.png
diff --git a/docs/images/integrations/cortex-soar/manage-or-disable.png b/docs/images/integrations/cortex-soar/manage-or-disable.png
diff --git a/docs/images/integrations/cortex-soar/monitor-logs.png b/docs/images/integrations/cortex-soar/monitor-logs.png
diff --git a/docs/images/integrations/cortex-soar/open-instances.png b/docs/images/integrations/cortex-soar/open-instances.png
diff --git a/docs/images/integrations/cortex-soar/schedule.png b/docs/images/integrations/cortex-soar/schedule.png
diff --git a/docs/images/integrations/cortex-soar/test-connection.png b/docs/images/integrations/cortex-soar/test-connection.png
diff --git a/docs/images/integrations/cortex-soar/view-incidents.png b/docs/images/integrations/cortex-soar/view-incidents.png
diff --git a/docs/images/integrations/cortex-soar/workplan-playbook.png b/docs/images/integrations/cortex-soar/workplan-playbook.png
diff --git a/docs/integrations/cortex-xsoar/configure.mdx b/docs/integrations/cortex-xsoar/configure.mdx
@@ -0,0 +1,120 @@
+---
+title: Integrate BloodHound Enterprise with Cortex XSOAR
+description: Learn how to integrate BloodHound Enterprise with Cortex XSOAR by Palo Alto Networks.
+sidebarTitle: Configure integration
+---
+
+<img noZoom src="/assets/enterprise-edition-pill-tag.svg" alt="Applies to BloodHound Enterprise only"/>
+
+The BloodHound Enterprise integration for [Cortex XSOAR](https://www.paloaltonetworks.com/resources/datasheets/cortex-xsoar-for-mssps#:~:text=Cortex%20XSOAR%C2%AE%EF%B8%8F%20is%20a,of%20services%20for%20their%20clients.) lets you ingest and manage BloodHound Enterprise attack path findings in Cortex XSOAR as incidents.
+
+Use this integration to:
+
+- Automatically convert BloodHound Enterprise attack path findings into Cortex XSOAR incidents
+- Attach remediation guidance and posture context to incidents
+- Run playbooks and custom commands to analyze, triage, and remediate findings
+
+Key capabilities include:
+
+- Automated incident creation with titles, descriptions, remediation guidance, impact/exposure metrics, severity, and domain/environment context
+- Playbook linking per incident to run custom analysis commands
+- Custom commands:
+    - Object ID lookup by name
+    - Asset information by object ID
+    - Path analysis between two nodes in the BloodHound graph
+
+## Prerequisites
+
+Before installing and configuring the Cortex XSOAR integration, ensure that you have the following:
+
+- Cortex XSOAR instance with an admin account
+- BloodHound Enterprise tenant
+- BloodHound Enterprise API key/ID pair
+
+<Note>We recommend a [non-personal API key/ID pair](/integrations/bloodhound-api/working-with-api#create-a-non-personal-api-key%2Fid-pair).</Note>
+
+## Configure Cortex XSOAR
+
+Set up the SpecterOps BloodHound Enterprise integration instance in Cortex XSOAR.
+
+<Steps>
+    <Step title="Open integration instances">
+        1. Log in to your Cortex XSOAR instance.
+        1. Go to **Settings & Info** > **Settings** > **Integrations** > **Instances**.
+
+            <Frame>
+                <img
+                    src="/images/integrations/cortex-soar/open-instances.png"
+                    alt="Cortex XSOAR Integrations & Instances page with SpecterOps integration visible."
+                />
+            </Frame>
+    </Step>
+
+    <Step title="Add SpecterOpsBHE instance">
+        1. Search for the SpecterOps integration.
+        1. Click **Add Instance** for the SpecterOpsBHE integration.
+        1. Configure settings.
+
+            | Field | Description | Required? |
+            |-------|-------------|:----------:|
+            | **Name** | Instance display name (default can be modified) | Yes |
+            | **BloodHound Enterprise Domain** | Your tenant domain, e.g., `https://example.bloodhoundenterprise.io` | Yes |
+            | **Token ID** | API token ID from BloodHound Enterprise | Yes |
+            | **Token Key** | API token key from BloodHound Enterprise | Yes |
+            | **Proxy URL** | Proxy URL to reach BloodHound Enterprise | No |
+            | **Proxy URL Username** | Username for proxy authentication | No |
+            | **Proxy URL Password** | Password for proxy authentication | No |
+            | **Finding Environment** | Scope findings to one environment | No |
+            | **Finding Category** | Scope findings to one category | No |
+
+            <Note>By default, **Finding Environment** and **Finding Category** are set to **All**.</Note>
+
+            <Frame>
+                <img
+                    src="/images/integrations/cortex-soar/add-bhe-instance.png"
+                    alt="Cortex XSOAR instance configuration showing fetch settings."
+                />
+            </Frame>
+    </Step>
+
+    <Step title="Enable fetching and schedule interval">
+        1. Check the **Fetches incidents** option (required).
+        1. Set **Incident Type** to "SpecterOpsBHE Attack Path" (optional).
+        1. Set the **Incidents Fetch Interval** to your preferred schedule (required).
+
+            <Note>The default fetch interval is 10 minutes.</Note>
+
+            <Frame>
+                <img
+                    src="/images/integrations/cortex-soar/schedule.png"
+                    alt="Cortex XSOAR instance configuration detail view."
+                />
+            </Frame>
+    </Step>
+
+    <Step title="Test and save the configuration">
+        1. Click **Test** to verify connectivity and credentials.
+        1. Close the modal, then **Save** the instance.
+
+            <Tip>"Success" indicates working parameters and connectivity. "Error" indicates invalid parameters or connection failure.</Tip>
+
+            <Frame>
+                <img
+                    src="/images/integrations/cortex-soar/test-connection.png"
+                    alt="Cortex XSOAR instance save confirmation."
+                />
+            </Frame>
+    </Step>
+
+    <Step title="Manage multiple domains or disable instances">
+        - To add additional BloodHound Enterprise domains, create more instances with **Add Instance**.
+        - To stop fetching, uncheck **Enable** to disable the instance.
+
+            <Frame>
+                <img
+                    src="/images/integrations/cortex-soar/manage-or-disable.png"
+                    alt="List of multiple SpecterOpsBHE instances in Cortex XSOAR."
+                />
+            </Frame>
+    </Step>
+</Steps>
diff --git a/docs/integrations/cortex-xsoar/use.mdx b/docs/integrations/cortex-xsoar/use.mdx
@@ -0,0 +1,72 @@
+---
+title: Use Cortex XSOAR with BloodHound Enterprise
+description: Learn how to use Cortex XSOAR with BloodHound Enterprise to monitor and manage attack path findings.
+sidebarTitle: Analyze attack path incidents
+---
+
+<img noZoom src="/assets/enterprise-edition-pill-tag.svg" alt="Applies to BloodHound Enterprise only"/>
+
+After you configure the integration, Cortex XSOAR begins fetching BloodHound Enterprise attack path findings as incidents. Use the sections below to monitor ingestion, view incidents, and inspect details.
+
+<Tip>See [install and configure](/integrations/cortex-xsoar/configure) for setup steps and fetch interval settings.</Tip>
+
+## Monitor ingestion and logs
+
+You can view instance logs to confirm incidents are being fetched.
+
+<Frame>
+    <img
+        src="/images/integrations/cortex-soar/monitor-logs.png"
+        alt="Cortex XSOAR instance logs showing incident fetch activity for SpecterOpsBHE integration."
+    />
+</Frame>
+
+## View incidents
+
+Open the **Incidents** view to see all fetched attack path incidents.
+
+<Tip>Click any incident to open its details.</Tip>
+
+<Frame>
+    <img
+        src="/images/integrations/cortex-soar/view-incidents.png"
+        alt="Cortex XSOAR Incidents list showing SpecterOpsBHE attack path incidents."
+    />
+</Frame>
+
+## Incident details
+
+The incident details page includes key information about the attack path and related context:
+
+- Incident name and ID
+- Case details
+- Quick View side panel with labels containing attack path data
+
+<Frame>
+    <img
+        src="/images/integrations/cortex-soar/incident-details.png"
+        alt="Incident details view showing case details and Quick View labels for attack path data."
+    />
+</Frame>
+
+## Work Plan and playbook
+
+Click the **Work Plan** tab to view the playbook. The SpecterOpsBHE playbook runs custom commands to retrieve object-related information and analyze attack paths. You can click each task or script to view its results.
+
+<Frame>
+    <img
+      src="/images/integrations/cortex-soar/workplan-playbook.png"
+      alt="Work Plan view showing the playbook tasks and scripts executed for the incident."
+    />
+</Frame>
+
+## DBot panel
+
+Use the DBot panel to review execution context and results. Locate the **root** section and expand it to see underlying data and command outputs related to the incident.
+
+<Frame>
+    <img
+        src="/images/integrations/cortex-soar/dbot-panel.png"
+        alt="DBot panel expanded to show root context and command outputs for the incident."
+    />
+</Frame>
diff --git a/docs/integrations/overview.mdx b/docs/integrations/overview.mdx
@@ -32,6 +32,10 @@ The following integrations are officially supported by SpecterOps.
   <Card title="SplunkSOAR" icon={<SO_Icon />} href="https://splunkbase.splunk.com/app/7772" horizontal>
     See all attack path findings as Splunk SOAR events
   </Card>
+
+  <Card title="Cortex XSOAR" icon={<SO_Icon />} href="/integrations/cortex-xsoar/configure" horizontal>
+    Manage and remediate BloodHound attack paths within Cortex XSOAR
+  </Card>
 </CardGroup>
 
 ### Third-party integrations

diff --git a/docs/integrations/splunk/install.mdx b/docs/integrations/splunk/install.mdx
@@ -18,7 +18,7 @@ Before installing and configuring the BloodHound Enterprise Splunk app, ensure t
 
 - Splunk instance (version 9.0.1 or later) and an admin account
 - BloodHound Enterprise tenant
-- BloodHound Enterprise [non-personal API key/ID pair](/integrations/bloodhound-api/working-with-api#create-a-personal-api-key-and-id-pair) with the **Auditor** role
+- BloodHound Enterprise [non-personal API key/ID pair](/integrations/bloodhound-api/working-with-api#create-a-non-personal-api-key%2Fid-pair) with the **Auditor** role
 
 ## Install the Splunk app
 
@@ -92,7 +92,7 @@ This section describes the minimum required configuration steps to get the Blood
   <Step title="Configure Splunk app API credentials">
     Configure the BloodHound Enterprise Splunk app with your BloodHound Enterprise API credentials.
 
-    <Note>We recommend a [non-personal API key/ID pair](/integrations/bloodhound-api/working-with-api#create-a-personal-api-key-and-id-pair) with the **Auditor** role for the Splunk integration.</Note>
+    <Note>We recommend a [non-personal API key/ID pair](/integrations/bloodhound-api/working-with-api#create-a-non-personal-api-key%2Fid-pair) with the **Auditor** role for the Splunk integration.</Note>
 
     1. Click **Apps** > **Manage Apps**.
     1. Filter for the BloodHound Enterprise Splunk app and click on it.

diff --git a/docs/style.css b/docs/style.css
@@ -70,4 +70,9 @@ h4 {
 .dark {
   --brand-green: #02b36c;
   --brand-light: #fdfeff;
+}
+
+/* Hide previous and next links at the bottom of all pages */
+#pagination {
+  display: none;
 }