---
title: "Fortanix DSM with Cortex XSOAR"
slug: "fortanix-dsm-with-cortex-xsoar"
updated: 2026-07-08T17:53:41Z
published: 2026-07-08T17:53:41Z
canonical: "support.fortanix.com/fortanix-dsm-with-cortex-xsoar"
---

> ## Documentation Index
> Fetch the complete documentation index at: https://support.fortanix.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Fortanix DSM with Cortex XSOAR

## 1.0 Introduction

This article describes how to integrate **Fortanix-Data-Security-Manager (DSM)** with **Cortex XSOAR,** a comprehensive security orchestration, automation, and response (SOAR) platform offered by Palo Alto Networks. This integration allows XSOAR users to fetch secrets from Fortanix DSM or perform other cryptographic operations in XSOAR using Fortanix DSM.

Cortex XSOAR unifies case management, automation, real-time collaboration and threat intel management to serve security teams across the incident lifecycle.

This article contains the information that an XSOAR administrator and/or user needs to:

- Configure a Fortanix DSM integration instance on Cortex XSOAR.
- Execute Fortanix DSM commands in the Cortex XSOAR Playground War Room.
- Reference: Cortex XSOAR Marketplace listing at [*https://cortex.marketplace.pan.dev/marketplace/details/FortanixDSM/*](https://cortex.marketplace.pan.dev/marketplace/details/FortanixDSM/)*.*

## 2.0 Why Use Fortanix DSM with Cortex XSOAR?

Cortex XSOAR helps organizations streamline their security operations. In this context, there is often a need to handle sensitive material such as, secrets in the form of credentials and encrypt or decrypt passwords. Fortanix DSM is a NIST-certified FIPS 140-2 Level 3 HSM and is designed for modern development, security, and operations (DevSecOps). XSOAR users can not only materials, such as secrets access within their favorite Playground War Room but also perform advanced cryptographic operations such as encryption and decryption using industry-standard AES-256 algorithms such as, GCM or tokenization using Format-Preserving Encryption (FPE). What sets Fortanix apart is its ability to perform complex operations inside the HSM secure enclave using the Fortanix DSM plugin.

## 3.0 Prerequisites

Ensure the following:

- Fortanix DSM version 4.12 and above tested and recommended.
- Cortex XSOAR version 6.6.0 and above tested and recommended.

## 4.0 Configure Fortanix DSM

A Fortanix DSM service must be configured, and the URL must be accessible. To create a Fortanix DSM account and group, refer to the following sections:

### 4.1 Signing Up

To get started with the Fortanix DSM cloud service, you must register an account at <Your_DSM_Service_URL>. For example, [https://amer.smartkey.io.](https://amer.smartkey.io.) On-premises customers use the KMS URL, and the SaaS customers can use the URLs as listed [*here*](https://support.fortanix.com/hc/en-us/articles/4406135346068-Fortanix-DSM-SaaS-Global-Availability-Map) based on the application region.

*For more information on how to set up the Fortanix DSM, refer to the* [*Sign Up for Fortanix Data Security Manager SaaS*](https://support.fortanix.com/docs/users-guide-sign-up-for-fortanix-data-security-manager-saas)*.*

### 4.2 Creating an Account

Access <Your_DSM_Service_URL> in a web browser and enter your credentials to log in to Fortanix DSM.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/DSM_SaaS_Login_page(15).png)

**Figure 1: Logging in**

*For more information on how to set up an account in Fortanix DSM, refer to the* [*Getting Started with Fortanix Data Security Manager - UI*](https://support.fortanix.com/docs/users-guide-getting-started-with-fortanix-data-security-manager-ui)*.*

### 4.3 Creating a Group

Perform the following steps to create a group in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Groups** menu item, and then click **ADD GROUP** to create a new group.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-Group(69).png)

**Figure 2: Add groups**
2. On the **Adding new group** page:
  1. **Title**: Enter a name for your group.
  2. **Description** (optional): Enter a short description of the group.
3. Click **SAVE** to create the new group.

*For more information about groups, refer to* [*Definitions*](/v1/docs/dsm-definitions#40-groups)*.*

> [!NOTE]
> TIP
> 
> It is recommended to configure a **Key undo policy** for groups for the cryptographic keys used by the application before creating or using the keys. Without a configured **Key undo policy**, key deletion is permanent and the deleted key cannot be recovered. Deleting an encryption key may result in permanent loss of access to the protected data and service disruption for applications that depend on the deleted key. *For detailed steps, refer to* [*Key Undo Policy*](/v1/docs/fortanix-dsm-key-undo-policy)*.*

### 4.4 Creating an Application

Perform the following steps to create an application (app) in the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click **ADD APP** to create a new app.

![](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/Add-App(68).png)

**Figure 3: Add application**
2. On the **Adding new app** page:
  1. **App name**: Enter the name for your application.
  2. **ADD DESCRIPTION** (optional): Enter a short description of the application.
  3. **Authentication method**: Select the default **API Key** as the authentication method from the drop down menu. *For more information on these authentication methods, refer to the* [*User's Guide: Authentication*](https://support.fortanix.com/docs/users-guide-authentication)*.*
  4. **Assigning the new app to groups**: Select the group created in [*Section 4.3: Creating a Group*](/v1/docs/using-fortanix-data-security-manager-with-cortex-xsoar#43-creating-a-group) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#43-creating-a-group)from the list.
3. Click **SAVE** to add the new application.

*For more information about applications, refer to* [*Definitions*](https://support.fortanix.com/docs/dsm-definitions#50-applications)*.*

### 4.5 Copying the App UUID

Perform the following steps to copy the app UUID from the Fortanix DSM:

1. In the DSM left navigation panel, click the **Apps** menu item, and then click the app created in [*Section 4.4: Creating an Application*](/v1/docs/using-fortanix-data-security-manager-with-cortex-xsoar#44-creating-an-application) [](/v1/docs/using-data-security-manager-with-idcentral-key-management#44-creating-an-application)to go to the detailed view of the app.
2. On the **INFO** tab, click **VIEW API KEY DETAILS**.
3. Click the **USERNAME/PASSWORD** tab.
4. From the **Credentials Details** dialog box, copy the **Username (app UUID)** and **Password** to use in [*Section 4.0: Configure DSM on Cortex XSOAR*](/v1/docs/using-fortanix-data-security-manager-with-cortex-xsoar#50-configure-dsm-on-cortex-xsoar).

## 5.0 Configure DSM on Cortex XSOAR

Perform the following steps to configure Fortanix DSM within the Cortex XSOAR portal:

1. Log in as an XSOAR administrator and navigate to **Marketplace**. Narrow the search for **Categories** → **Authentication and Identity Management** and select Fortanix DSM.

![Marketplace-Coretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13879991822484.png)

**Figure 4: XSOAR marketplace - Fortanix DSM**
2. Click **Install** on the top right corner of the screen.

![MarketplaceAdded-Coretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13880008780052.png)

**Figure 5: Install DSM**
3. To find the Fortanix DSM instance, go to **Settings** → **Integrations** → **Instances** and filter by name or category.

![MarketplaceAddInstance-Coretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13880027811476.png)

**Figure 6: Find Fortanix DSM instance**
4. Add a new instance, and then use the following parameters to set up the Fortanix DSM connection and credentials:

![ConfigureInstance-Coretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13880043553812.png)

**Figure 7: Configure new instance**
  - **Fortanix DSM server endpoint**: This is the on-premises or SaaS Fortanix DSM URL. For SaaS use https://amer.smartkey.io, where “amer” may be replaced by your region.
  - **Switch to credentials**: Click this for API key authentication instead of username/password or certificate authentication.
  - **Username/App UUID/Certificate**: The Fortanix DSM app username. This may also be the client certificate in PEM format without any line breaks. Please copy the entire certificate chain if using a private Certificate Authority (CA).
  - **Password/App Secret/Private Key**: The Fortanix DSM app password. For client certificate authentication, the value is a non-encrypted PEM format of the private key.
5. Click **Test** to verify the Fortanix DSM App credentials. You may click **Run advanced test and download a full report** if the test fails to download the debug log and verify any authentication errors from the log messages.

![ConfigureInstance1-Coretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13880044179092.png)

**Figure 8: Test instance**

![ConfigureInstance2-Coretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13880029737236.png)

**Figure 9: Authentication error**

After successfully configuring the integration instance, go ahead and click **Save & exit** or **Save**. You are now ready to use the Fortanix DSM integration within the Cortex XSOAR Playground War Room. Other optional settings are available for each integration instance as follows:
  - **Trust any certificate (not secure)**: This allows for a private CA certificate used and presented by the Fortanix DSM server to be trusted by Cortex XSOAR.
  - **Use system proxy settings**: This allows for the leveraging of any system or environment HTTP proxy settings within the Cortex XSOAR server so the integration instance can connect to the Fortanix DSM URL.
  - **Group UUID to list secrets from**: Limit the scope of the integration commands to a single Fortanix DSM group. This may be helpful if there are multiple DSM groups and a default needs to be specified for Cortex XSOAR command execution.
  - **Data protection key used for encryption and decryption**: The Fortanix DSM Security-object corresponding to an AES-256 or FPE tokenization key name. This is relevant for the **!fortanix-encrypt** and **!fortanix-decrypt**.
  - **Encryption and decryption mode**: This is cipher mode, where options are FPE, CBC, and GCM based on the use case at hand.

## 6.0 Usage Commands

The integration supports the following Cortex XSOAR commands for execution:

- `fortanix-new-secret` Import a new secret, along with its confidential value, into the Fortanix DSM app's default or a specified group, if any.

```bash
!fortanix-new-secret value="Top Secret !3$8" name=metasec metadata="key1=value1, key2=meta2,key3="whats that",key 4=nothin new" group_id=07f85883-adaf-4a6c-a040-ffed46dfd349
```

![PWR-importSecret-Coretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13880030983316.png)

**Figure 10: Import new secret**
- `fortanix-list-secrets` Lists all secrets from the Fortanix DSM App's member groups or a specified group, if specified.

```bash
!fortanix-list-secrets
!fortanix-list-secrets group_id=aedc4bd0-2880-4191-8f38-043fce5ee97
```

> [!NOTE]
> NOTE
> 
> use the optional command parameters such as, `state`, `group_id`, or `page` to filter and locate specific secrets.

![PWR-ListSecret-Coretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13880033371668.png)

**Figure 11: List secrets**

![PWR-ListSecret1-Coretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13880084509460.png)

**Figure 12: List secrets**

![PWR-ListSecret2-Coretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13880049814804.png)

**Figure 13: List secrets**
- `fortanix-fetch-secret` Retrieve secret's confidential value based on a UUID.

```bash
!fortanix-fetch-secret kid=4bd14880-522d-4c34-8560-617e0fb6485b
```

![PWR-RetrieveSecret-Coretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13880050711572.png)

**Figure 14: Retrieve secret value**
- `fortanix-get-secret-metadata` Get the metadata of a single secret based on its name or UUID, as specified.

```bash
!fortanix-get-secret-metadata name="Test Secret"
!fortanix-get-secret-metadata kid=09299af7-0d69-4091-9dc7-27d426667847
```
- `fortanix-rotate-secret` Update an existing secret's confidential value by rotating out of it and obtaining a new UUID.

```bash
!fortanix-rotate-secret value="Fib0nac!I !3$8" name=metasec metadata="key1=value01,key2=meta2a,key3="whats that",key 4=nothin new" group_id=07f85883-adaf-4a6c-a040-ffed46dfd349
```

![PWR-UpdateSecret-Coretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13880151927700.png)

**Figure 15: Update secret value**
- `fortanix-delete-secret` Delete an existing secret. This may be revocable if there is a Key Undo policy applied on the group.

```bash
!fortanix-delete-secret kid=30d7286a-ad4c-4cb3-8bb1-0f9265e0adfc
```

![PWR-DeleteSecret-Coretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13880152424980.png)

**Figure 16: Delete a secret**
- `fortanix-encrypt` Protect sensitive information or data using a Fortanix DSM key with default cryptographic parameters.

```bash
!fortanix-encrypt data="Hello World 123"
```

![PWR-Crypto-Coretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13880153189268.png)

**Figure 17: Encryption**

> [!NOTE]
> NOTE
> 
> - If the **key** and **mode** are specified in the integration instance configuration, then these parameters may be skipped during the command execution, otherwise they need to be specified.
> - Also note that the resulting cipher encapsulates the key reference (Fortanix DSM Security Object UUID or KID) along with the cipher mode and the Initialization Vector (IV) or Nonce.
- `fortanix-decrypt` Reveal sensitive information or data using a Fortanix DSM key with default cryptographic parameters.

```bash
!fortanix-decrypt cipher=eyJraWQiOiAiY2E5ZTJiMGYtNzFjNC00ZjNiLWJhYTYtNGM1YWY5YTM5N2YwIiwgImNpcGhlciI6ICJqcGxqVUk2S2tIb3drbHhhdG1MWXVBPT0iLCAiaXYiOiAidDFJczFWUTR3TlRFOThLZHR2aUlWZz09IiwgIm1vZGUiOiAiQ0JDIn0=
!fortanix-decrypt cipher=u2KMcAUF1jsifJfh99uWqw== iv=r7HeHduHSZ1IrCC6s7MG0w==
!fortanix-decrypt kid=ca9e2b0f-71c4-4f3b-baa6-4c5af9a397f0 cipher=u2KMcAUF1jsifJfh99uWqw== iv=r7HeHduHSZ1IrCC6s7MG0w== configuration:
```

![PWR-decryptCoretx.png](https://cdn.us.document360.io/c3bd85d2-4ad8-4d85-9f60-f1c168a3aad9/Images/Documentation/13880105290004.png)

**Figure 18: Decryption**
- `fortanix-invoke-plugin` Execute Lua code through a Fortanix plugin running on Fortanix DSM using Confidential Computing. This requires the plugin's UUID and an arbitrary user input based on the plugin's functionality.

```bash
!fortanix-invoke-plugin pid=3599796b-7b18-49c3-aad8-9758af24fbf9
!fortanix-invoke-plugin pid=3599796b-7b18-49c3-aad8-9758af24fbf9 input="Hello World Oct 29"
!fortanix-invoke-plugin pid=c6a5351e-d516-4099-b5c9-be00c6967a53 input=ewogICJjYV9rZXkiOiAiU1NIQ0EtUHJpdmF0ZS1LZXktRWQyNTUxOSIsCiAgInB1YmtleSI6ICJBQUFBRTJWalpITmhMWE5vWVRJdGJtbHpkSEF5TlRZQUFBQUlibWx6ZEhBeU5UWUFBQUJCQkt0R3dTeFhWdU4zbXFkaE9YNXozVjBNT243MkRJNWNQQThzSXBTemJSVjZnNTNRYW0yVzNNaW1JdlNaazkxL2x4aFNXRE82RmUxQXVqYy9VQ2VCc3lNPSIsCiAgImNlcnRfbGlmZXRpbWUiOiAzNjAwLAogICJ2YWxpZF9wcmluY2lwYWxzIjogInVidW50dSIsCiAgImNlcnRfdHlwZSI6ICJ1c2VyIiwKICAiY3JpdGljYWxfZXh0ZW5zaW9ucyI6IHt9LAogICJleHRlbnNpb25zIjogewogICAgInBlcm1pdC1wdHkiOiAiIgogIH0KfQo=
!fortanix-invoke-plugin pid=3599796b-7b18-49c3-aad8-9758af24fbf9 input="{"iv":"DaRIkBoCaAPqpGSczBeVGQ==","kid":"3451bf0b-1728-4b9a-9859-f1c6bd0d8652","op":"decrypt","cipher":"ZmHxqmbgYGAtauvCnco7EA=="}"
```

Fortanix Data Security Manager (DSM) is the world’s first cloud service secured with Intel® SGX. With Fortanix DSM, you can securely generate, store, and use cryptographic keys and certificates, as well as other secrets such as passwords, API keys, tokens, or any blob of data. Your business-critical applications and containers can integrate with Fortanix DSM using legacy cryptographic interfaces (PKCS#11, CNG, and JCE) or using the native Fortanix DSM RESTful interface.

A security object is any datum stored in DSM (for example a key, a certificate, a password, or other security objects). Each security object is assigned to exactly one group. users and applications assigned to the group have permission to see the security object and to perform operations on it.

## Related

- [Group Key Encryption Key](/fortanix-dsm-group-key-encryption-key.md)
- [Fortanix DSM with Microsoft SQL Server TDE - Introduction](/fortanix-dsm-with-microsoft-sql-server-tde-integration-introduction.md)