# Hydden identity data in Cortex XSIAM

Source: https://www.hydden.ai/features/cortex-xsiam
Last updated: 2026-10-22

> Updates to the Hydden MCP deliver identity data into Palo Alto Cortex XSIAM on demand. Analysts and agents pull it from inside the Cortex UI.

Hydden · Cortex XSIAM

Updates to the Hydden MCP. Analysts and agents in Cortex XSIAM pull identity data on demand from inside the Cortex UI.

## Why it's important

Cortex XSIAM uses the Hydden MCP from inside its own UI. The MCP exposes accounts, entitlements, privilege and anomaly findings, activity, and reviews to MCP clients over HTTPS with OAuth 2.0 client credentials.

## The problems this feature solves

- Identity lookups during an incident usually happen in a second console. An analyst leaves Cortex XSIAM to find the account, its entitlements, and what it can reach.
- Questions from an agent usually leave the Cortex interface. The answer about an identity then comes back from somewhere else.
- A client that can read the identity record may also be allowed to change it. Disable, deprovision, group and role changes, notify, open a ticket, and vault need their own permission, separate from a lookup.

## What the feature does

Hydden events for human accounts, non-human identity accounts, and AI agent accounts land in Cortex dashboards for event volume, top privileged identities, and new accounts.

The blast radius and deprovisioning playbooks can disable or deprovision an account, change a group or role, notify, open a ticket, or vault.

The identity data Cortex pulls includes human accounts, non-human identity accounts, and AI agent accounts.

- An agent in Cortex asks Hydden questions through the Hydden MCP and stays in the Cortex interface.
- Cortex XSIAM connects through the Generic MCP content pack. Each credential sees only the tools its roles allow, and the blast radius playbook includes a blast radius command.

## Questions

How does Cortex XSIAM connect to Hydden?

Through the Generic MCP content pack. The Hydden MCP serves identity data over HTTPS with OAuth 2.0 client credentials.

What identity data can Cortex pull?

Accounts, entitlements, privilege and anomaly findings, activity, and reviews. That includes human accounts, non-human identity accounts, and AI agent accounts.

What can a credential do?

The tools a client sees are scoped by the credential’s roles. The actions are account disable or deprovision, group and role changes, notify, open a ticket, and vault.

What shows up in Cortex?

Two Hydden playbooks, blast radius and deprovisioning, including a blast radius command. Hydden events also land in Cortex dashboards for event volume, top privileged identities, and new accounts.

## Keep reading

- **Hydden MCP updates** Your AI agents can query the identity record and act on it, within the roles you grant. Read more
- **Events** Identity events Hydden can deliver into Cortex dashboards. Read more
- **Product updates** Every release in Hydden, newest first. Read more

## See Hydden identity data in Cortex XSIAM

Request a trial and connect Cortex through the Generic MCP content pack.

[Request a trial](https://www.hydden.ai/try-free) [Book a demo](https://www.hydden.ai/book-a-demo)