Cato Networks

​

What this integration is

• Cato API docs: https://api.catonetworks.com/documentation/

​

Data path (how it flows)

1. Cato Networks → events API feed
2. CoPilot collector → SIEM ingestion (indexing/search)
3. Optional: alerting and incident workflows

​

Prerequisites

• Cato Management Application access
• API key created with appropriate permissions
• Event feed enabled (Administration → Event Integrations)

​

Credentials you’ll need

• Account ID (from the URL)
• API key

• Choose View permissions for read-only ingestion.
• Copy the key immediately when generated (can’t be retrieved later).

​

CoPilot setup (recommended workflow)

1. Provision the customer.
2. Add Cato Networks integration under the customer.
3. Provide account ID + API key.
4. Validate that events begin flowing.

​

Success criteria

• Events show up for the expected customer
• You can correlate an event in Cato with an event in the SIEM

​

Troubleshooting

• Confirm “Event Feed Enabled” is toggled on.
• Confirm the API key is not expired/revoked.
• Validate the account ID is correct and in-scope.