You can use the Cortex XDR API to manage Cortex XDR incidents
from external apps such as ServiceNow®.
You can leverage the Cortex XDR API to leverage Cortex
XDR investigation capabilities and log stitching from external incident
management applications, such as ServiceNow®. After you generate
your API key and set up the API to query Cortex XDR, third-party
apps can receive incident updates, request additional data about
incidents, and make changes such as to set the status and change
the severity, or assign an owner. Changes occur bidirectionally
so that a change from one app is reflected in the other. For more information,
Cortex XDR API Reference
For more information on how to integrate Cortex XDR with Demisto
response playbooks, see Integrate Demisto.