> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/readme.md).

# Home

Welcome to your team’s developer platform

<h2 align="center">How can I help you today?</h2>

<p align="center"><button type="button" class="button secondary" data-action="ask" data-icon="gitbook-assistant">Search our docs the easy way...</button></p>

\ <br>

{% columns %}
{% column width="33.33333333333333%" %} <picture><source srcset="/files/MNHe8bb50cqg1zMxzdbc" media="(prefers-color-scheme: dark)"><img src="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2FG9uaDM2vecTpcEx79elZ%2Ftow-nb.png?alt=media&amp;token=9107503e-2ce5-49c5-a693-204b755adf3e" alt=""></picture>
{% endcolumn %}

{% column width="66.66666666666667%" %}
⚡ **Cortex Tip of the Week — Week 42**

**Speed up threat hunting with XQL story presets**

When writing XQL queries in Cortex XSIAM, use story presets like `authentication_story` and `network_story` for common investigation workflows. These presets provide a common schema over `xdr_data`, which can simplify queries and help you focus on the fields you need. For best performance, apply filters early and select only the required fields.

🔗 [View the Cortex XSIAM XQL Data Model](/xsiam-data-model-schema/readme.md)
{% endcolumn %}
{% endcolumns %}

\ <br>

***

{% columns %}
{% column width="10%" %} <picture><source srcset="/files/DbzteZTPXx7WRejFq7dE" media="(prefers-color-scheme: dark)"><img src="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2FpfOTb5xVDN680UGzGNrU%2Ftasks.png?alt=media&amp;token=7fcbf98b-46bf-491c-a1ea-99649d2b107e" alt=""></picture>
{% endcolumn %}

{% column width="90%" %}

### Start with a task

Choose a workflow to begin.
{% endcolumn %}
{% endcolumns %}

<table data-view="cards"><thead><tr><th>Task</th><th data-card-target data-type="content-ref">Start here</th></tr></thead><tbody><tr><td><p><strong>Cortex XDR</strong></p><h4>Investigate an issue</h4><p>Trace related activity across alerts and events.</p></td><td><a href="/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view.md">Causality view</a></td></tr><tr><td><p><strong>Cortex XSIAM</strong></p><h4>Connect data sources</h4><p>Ingest endpoint, network, cloud, and third-party telemetry.</p></td><td><a href="/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/connectors.md">Connectors</a></td></tr><tr><td><p><strong>Cortex XSIAM</strong></p><h4>Automate a response</h4><p>Build workflows for investigation and remediation.</p></td><td><a href="/cortex-xsiam/configure-cortex-xsiam/automations.md">Automations</a></td></tr><tr><td><p><strong>Cortex Cloud Posture Management</strong></p><h4>How to onboard GCP</h4><p>Connect a Google Cloud Platform environment to Cortex Cloud.</p></td><td><a href="/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/how-to-onboard-google-cloud-platform.md">How to onboard Google Cloud Platform</a></td></tr><tr><td><p><strong>Cortex XSIAM</strong></p><h4>Map authentication for identity stories</h4><p>Map authentication for identity stories<br>Normalize SSO and SaaS application logs to the XDM schema to enable automated authentication stories and prevent baseline distortion.</p></td><td><a href="/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/how-to-map-authentication-story-events.md">How to map authentication events for analytics</a></td></tr><tr><td><p><strong>Cortex XSIAM</strong></p><h4>Map network events for analytics</h4><p>Map traffic logs to mandatory XDM fields to trigger automated network stories and surface third-party firewall detection logic.</p></td><td><a href="/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/how-to-map-network-events-for-analytics.md">How to map network events for analytics</a></td></tr></tbody></table>

\ <br>

***

{% columns %}
{% column width="12.5%" %} <picture><source srcset="/files/TptQBANuci5tUKYQfbVQ" media="(prefers-color-scheme: dark)"><img src="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2F1OL8FXs90vpqCNTsf4bn%2FlearnNB.png?alt=media&amp;token=caf86e5a-6307-4e58-b47e-33708067c421" alt=""></picture>
{% endcolumn %}

{% column width="87.5%" %}

### Learn

Explore XQL, daily tasks, using APIs, and more.
{% endcolumn %}
{% endcolumns %}

<table data-view="cards"><thead><tr><th>Category</th><th>Topic</th><th data-card-target data-type="content-ref">Guide</th></tr></thead><tbody><tr><td><strong>XQL</strong></td><td><h4>Explore XQL</h4><p>Review XQL syntax, stages, functions, and aggregates.</p></td><td><a href="/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/get-started-with-xql.md">Get started with XQL</a></td></tr><tr><td><strong>XQL</strong></td><td><h4>Query investigation data</h4><p>Query data associated with Cortex XDR cases and issues.</p></td><td><a href="/cortex-xdr-5.x/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/query-case-and-issue-data.md">Query case and issue data</a></td></tr><tr><td><strong>Role</strong></td><td><h4>SOC analyst</h4><p>Investigate issues, hunt for threats, and respond to incidents.</p></td><td><a href="/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response.md">Investigation and response</a></td></tr><tr><td><strong>Role</strong></td><td><h4>Platform administrator</h4><p>Configure protection, integrations, data collection, and user access.</p></td><td><a href="/cortex-xsiam/configure-cortex-xsiam/configure-cortex-xsiam.md">Configure Cortex XSIAM</a></td></tr><tr><td><strong>Role</strong></td><td><h4>Developer and integrator</h4><p>Build integrations and automate security operations.</p></td><td><a href="/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts.md">Integrations and scripts</a></td></tr><tr><td><strong>Resource</strong></td><td><h4>API documentation</h4><p>Integrate with Cortex APIs and automate security workflows.</p></td><td><a href="https://cortex-docs.paloaltonetworks.com/cortex-api-overview">https://cortex-docs.paloaltonetworks.com/cortex-api-overview</a></td></tr><tr><td><strong>Cortex Cloud</strong></td><td><h4>Software Supply Chain Security</h4><p>Learn how software supply chain security workflows help protect your SDLC. Explore roles, responsibilities, and common workflows for AppSec, DevSecOps, and developers.</p></td><td><a href="/application-security/software-supply-chain-security/software-supply-chain-security.md">Software Supply Chain Security</a></td></tr></tbody></table>

\ <br>

***

{% columns %}
{% column width="12.5%" %} <picture><source srcset="/files/WPqlKm2uI0tnSzXg9LOr" media="(prefers-color-scheme: dark)"><img src="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2F9zLJdDttEbR3GRt5n0kg%2Fannounce.png?alt=media&amp;token=bb606a4a-37ec-412a-b13a-f4514322bcc7" alt=""></picture>
{% endcolumn %}

{% column width="87.5%" %}

### Latest product updates

{% endcolumn %}
{% endcolumns %}

<table data-view="cards"><thead><tr><th>Product</th><th>Update</th><th>Release date</th><th data-card-target data-type="content-ref">Guide</th></tr></thead><tbody><tr><td><strong>Cortex XDR</strong></td><td><h4>Translate queries to XQL</h4><p>Translate queries from other security tools into XQL.</p></td><td>July 2026</td><td><a href="/cortex-xdr-5.x/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md">Translate to XQL</a></td></tr><tr><td><strong>Cortex XSIAM</strong></td><td><h4>Extended Threat Intelligence</h4><p>Enrich investigations with threat intelligence.</p></td><td>July 2026</td><td><a href="/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence.md">Extended Threat Intelligence</a></td></tr><tr><td><strong>Cortex Data Security</strong></td><td><h4>AI Security Posture Management</h4><p>Map AI pipelines and prioritize AI security risks by data sensitivity.</p></td><td>July 2026</td><td><a href="/data-security-documentation/data-security/ai-security-posture-management.md">AI Security Posture Management</a></td></tr></tbody></table>

\ <br>

***

{% columns %}
{% column width="12.5%" %} <picture><source srcset="/files/RwOMJ3FFZMHiCtqVcEze" media="(prefers-color-scheme: dark)"><img src="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2FvnOCFbnGUw909KthyrmL%2Fexplore-nb.png?alt=media&amp;token=04956aaf-d389-4ca1-882e-cd85bc615d23" alt=""></picture>
{% endcolumn %}

{% column width="87.5%" %}

### Explore products

{% endcolumn %}
{% endcolumns %}

<table data-view="cards"><thead><tr><th>Product</th><th>Highlights</th><th data-card-target data-type="content-ref">Guide</th></tr></thead><tbody><tr><td><h4><i class="fa-shield">:shield:</i> Cortex XSIAM</h4></td><td>→ Unified security data and operations<br>→ AI-driven detection and investigation<br>→ Security orchestration and automated response</td><td><a href="https://cortex-docs.paloaltonetworks.com/cortex-xsiam-docs/">Cortex XSIAM Docs</a></td></tr><tr><td><h4><i class="fa-shield-halved">:shield-halved:</i> Cortex XDR</h4></td><td>→ Correlated detection data<br>→ Incident investigations<br>→ Unified response</td><td><a href="https://cortex-docs.paloaltonetworks.com/cortex-xdr-docs/">Cortex XDR Docs</a></td></tr><tr><td><h4><i class="fa-laptop">:laptop:</i> Cortex XDR Agent</h4></td><td>→ Endpoint protection<br>→ Threat prevention<br>→ Endpoint telemetry</td><td><a href="https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-docs/">Cortex XDR Agent</a></td></tr><tr><td><h4><i class="fa-robot">:robot:</i> Cortex AgentiX</h4></td><td>→ AI security workflows<br>→ Analyst automation<br>→ Guided actions</td><td><a href="https://cortex-docs.paloaltonetworks.com/cortex-agentix-docs/">Cortex AgentiX</a></td></tr><tr><td><h4><i class="fa-cloud">:cloud:</i> Cortex Cloud</h4></td><td>→ Runtime protection<br>→ Threat detection<br>→ Workload context<br>→ Configuration risk discovery<br>→ Exposure prioritization<br>→ Remediation tracking</td><td><a href="https://cortex-docs.paloaltonetworks.com/cortex-cloud-docs/">Cortex Cloud</a></td></tr><tr><td><h4><i class="fa-database">:database:</i> Cortex Data Security</h4></td><td>→ Sensitive data discovery<br>→ Data classification<br>→ Risk prioritization</td><td><a href="https://cortex-docs.paloaltonetworks.com/data-security-documentation/">Data Security Documentation</a></td></tr><tr><td><h4><i class="fa-code">:code:</i> Cortex Cloud Application Security</h4></td><td>→ Code-to-cloud visibility<br>→ Exploitability prioritization<br>→ Delivery workflow security</td><td><a href="https://cortex-docs.paloaltonetworks.com/application-security/">Application Security</a></td></tr><tr><td><h4><i class="fa-gears">:gears:</i> Cortex XSOAR</h4></td><td>→ Response playbooks<br>→ Tool orchestration<br>→ Incident management</td><td><a href="https://cortex-docs.paloaltonetworks.com/cortex-xsoar-docs/">Cortex XSOAR</a></td></tr><tr><td><h4><i class="fa-globe">:globe:</i> Cortex Xpanse</h4></td><td>→ Asset discovery<br>→ Exposure identification<br>→ Attack-surface remediation</td><td><a href="/cortex-xpanse/learn-about-cortex-xpanse.md">Learn about Cortex Xpanse</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/readme.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.