Ownership sources reference

Cortex can pull owners from your Git provider, identity provider, HR system, ITSM tool, on-call tool, or cloud tags. This page compares every ownership source in one place so you can choose a source of truth and write x-cortex-owners blocks correctly. If you’re new to ownership in Cortex, start with How ownership works. For help choosing a source, see Ownership best practices.

Sources that use `x-cortex-owners`

For these sources, reference the provider’s team or group in the entity descriptor with type: group:

x-cortex-owners:
  - type: group
    name: <name in the format below>
    provider: <provider value below>

Source	`provider` value	`name` format	Sync time (UTC)	Identity mapping
Azure DevOps	`AZURE_DEVOPS`	Azure DevOps team name (case-sensitive)	Daily at 10 a.m.	Required to connect team members to Cortex users
BambooHR	`BAMBOO_HR`	Team value from BambooHR’s Employee ownership field	Daily at 6 a.m.	Not needed. Cortex uses each member’s email address from BambooHR.
Bitbucket	`BITBUCKET`	Bitbucket team name	Daily at 10 a.m.	Required to connect team members to Cortex users
Entra ID	`ACTIVE_DIRECTORY`	Entra ID group name (case-sensitive)	Daily at 6 a.m.	Optional. Cortex uses identity mappings when they exist, and falls back to the member’s email address from Entra ID.
GitHub	`GITHUB`	`<organization>/<team-name>`	Daily at 9 a.m.	Required to connect team members to Cortex users
GitLab	`GITLAB`	GitLab group name	Daily at 10 a.m.	Required to connect group members to Cortex users
Google	`GOOGLE`	Full Google Group email address	Daily at 9 a.m.	Optional. Cortex uses identity mappings when they exist, and falls back to the member’s email address from Google.
Okta	`OKTA`	Okta group name (case-sensitive)	Daily at 3 p.m.	Optional. Cortex uses identity mappings when they exist, and falls back to the member’s email address from Okta.
Opsgenie	`OPSGENIE`	Opsgenie team name (case-sensitive)	Teams daily at 9 a.m., identities daily at 10 a.m.	Required to connect team members to Cortex users
ServiceNow	`SERVICE_NOW`	ServiceNow team name (case-sensitive)	Daily at 9 a.m.	Not needed
Workday	`CORTEX`	Cortex tag of the team imported from Workday	Daily at 9 a.m.	Not needed. Cortex uses each member’s email address from Workday.

Workday teams are imported as Cortex teams, so you reference them by their Cortex tag with provider: CORTEX.

Sources that use cloud tags

AWS and Azure Resources don’t use x-cortex-owners. Instead, Cortex reads an ownership tag on each cloud resource and matches its value to a Cortex team’s x-cortex-tag. By default, the tag key is owner, and you can customize it in each integration’s settings. Because the tag points to a Cortex team, you don’t need identity mappings for this step.

Source	Tag value	Sync time (UTC)	How to enable
AWS	The owning team’s `x-cortex-tag`	Daily at 6 a.m.	Turn on ownership sync in the AWS integration settings
Azure Resources	The owning team’s `x-cortex-tag`	Daily at 6 a.m.	Turn on ownership sync in the Azure Resources settings

Cortex

Get Started

Connect data

Standardize

Improve

Streamline

Configure

Resources

Ownership sources reference

Sources that use `x-cortex-owners`

Sources that use cloud tags

​Sources that use x-cortex-owners

​Sources that use cloud tags

Sources that use `x-cortex-owners`

Sources that use cloud tags