> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/readme.md).

# Home

Welcome to your team’s developer platform

<h2 align="center">How can I help you today?</h2>

<p align="center"><button type="button" class="button secondary" data-action="ask" data-icon="gitbook-assistant">Search our docs the easy way...</button></p>

\ <br>

{% columns %}
{% column width="33.33333333333333%" %} <picture><source srcset="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2F5pN9jqq3vXu4Zw6E858d%2Ftow2.png?alt=media&amp;token=a7f4c26a-7cb6-45ab-b5dd-239d1a7f45ec" media="(prefers-color-scheme: dark)"><img src="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2FG9uaDM2vecTpcEx79elZ%2Ftow-nb.png?alt=media&amp;token=9107503e-2ce5-49c5-a693-204b755adf3e" alt=""></picture>
{% endcolumn %}

{% column width="66.66666666666667%" %}
⚡ **Cortex Tip of the Week — Week 46**

<i class="fa-rocket">:rocket:</i> **CORTEX XSIAM**: Introducing Agents with Enterprise Knowledge in the Nov 2026 Release\
Turn AI agents into experts on your environment by connecting sources like Google Drive, Confluence, SharePoint, and custom SOPs. Grounded in your internal knowledge, agents deliver hyper-tailored investigations and responses aligned with your team's security practices. Learn more [here](/cortex-xsiam/configure-cortex-xsiam/configure-the-cortex-agentic-assistant-1/agents-hub/manage-knowledge-sources-preview.md).

<i class="fa-rocket">:rocket:</i> **Cortex XDR 6**: AgentiX-Driven YARA Rule Management\
AI-Powered YARA Rule Management uses AgentiX to automatically create, test, and run custom detection across Windows endpoints. Teams can hunt for threats on demand and instantly convert findings into enterprise containment. Learn more [here](/cortex-xdr/detect-investigate-and-respond-to-threats/threat-management/yara-rule-management.md).

<i class="fa-rocket">:rocket:</i> **Cortex Cloud Runtime Security**: Support for IBM Cloud\
Extend continuous posture management, automated compliance and risk detection across IBM Cloud for unified multi-cloud security. Learn more [here](/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/ibm-cloud-cloud-onboarding.md).

<i class="fa-rocket">:rocket:</i> **Introducing Object Access Control APIs in the Nov 2026 Release**\
Manage who can see and edit dashboards, report templates, scripts, playbooks, saved queries, and datasets in code. Get and update access entries, set general access, and transfer ownership through the public API. Learn more [here](https://cortex-docs.paloaltonetworks.com/xsiam-api/identity-and-access-management-iam/objects).

<i class="fa-box-archive">:box-archive:</i> [Weekly archive](/tips-weekly/tips-of-the-week-archive.md)
{% endcolumn %}
{% endcolumns %}

\ <br>

***

### November 2026 release notes

The November release adds autonomous security capabilities across Cortex. Cortex XDR 6.0 adds Agentic Endpoint Security, flexible Targeted Sensors, and on-endpoint SLMs. Cortex XSIAM 4.0 adds context-aware AI agent collaborators powered by Frontier AI. Cortex Cloud 2.3 adds SaaS Security for 100+ apps and lightweight eBPF agents for cloud workloads.

Release notes are available for:

* [Cortex XDR release notes](https://cortex-docs.paloaltonetworks.com/cortex-xdr-6.x-rn/release-information/features-introduced-in-2026/november-2026/release-highlights)
* [Cortex XSIAM release notes](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-rn/cortex-xsiam-release-information/features-introduced-in-2026-xsiam/november-2026/release-highlights)
* [Cortex AgentiX release notes](https://cortex-docs.paloaltonetworks.com/cortex-agentix-rn/features-introduced-in-this-release/november-2026/release-highlights)
* [Cortex Cloud Runtime Security release notes](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security-rn/cortex-cloud-runtime-security-release-information/features-introduced-in-2026-cloud/november-2026/release-highlights)
* [Cortex Cloud Posture Management release notes](https://cortex-docs.paloaltonetworks.com/cloud-posture-management-rn/cortex-cloud-posture-management-release-information/features-introduced-in-2026-cloud/november-2026/release-highlights)
* [Cortex Xpanse release notes](https://cortex-docs.paloaltonetworks.com/cortex-xpanse-expander-rn/)
* [Cortex XSOAR 8 SaaS release notes](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-saas-release-notes/features-introduced-in-this-release/november-2026)

\ <br>

***

{% columns %}
{% column width="10%" %} <picture><source srcset="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2FZv3OiNZy4PwKbTnNlEQV%2Ftb.png?alt=media&amp;token=fd78e8e3-0526-449a-bcde-5095a7c58775" media="(prefers-color-scheme: dark)"><img src="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2FpfOTb5xVDN680UGzGNrU%2Ftasks.png?alt=media&amp;token=7fcbf98b-46bf-491c-a1ea-99649d2b107e" alt=""></picture>
{% endcolumn %}

{% column width="90%" %}

### Start with a task

Choose a workflow to begin.
{% endcolumn %}
{% endcolumns %}

<table data-view="cards"><thead><tr><th>Task</th><th data-card-target data-type="content-ref">Start here</th></tr></thead><tbody><tr><td><p><strong>Cortex XDR</strong></p><h4>Investigate an issue</h4><p>Trace related activity across alerts and events.</p></td><td><a href="/cortex-xdr/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/causality-view.md">Causality view</a></td></tr><tr><td><p><strong>Cortex XSIAM</strong></p><h4>Connect data sources</h4><p>Ingest endpoint, network, cloud, and third-party telemetry.</p></td><td><a href="/cortex-xsiam/configure-cortex-xsiam/cortex-xsiam-data-sources/connectors.md">Connectors</a></td></tr><tr><td><p><strong>Cortex XSIAM</strong></p><h4>Automate a response</h4><p>Build workflows for investigation and remediation.</p></td><td><a href="/cortex-xsiam/configure-cortex-xsiam/automations.md">Automations</a></td></tr><tr><td><p><strong>Cortex Cloud Posture Management</strong></p><h4>How to onboard GCP</h4><p>Connect a Google Cloud Platform environment to Cortex Cloud.</p></td><td><a href="/cortex-cloud-posture-management/onboard-and-configure/deployment-steps-and-checklist/cloud-service-provider-csp-onboarding/google-cloud-platform-cloud-onboarding/how-to-onboard-google-cloud-platform.md">How to onboard Google Cloud Platform</a></td></tr><tr><td><p><strong>Cortex XSIAM</strong></p><h4>Map authentication for identity stories</h4><p>Map authentication for identity stories<br>Normalize SSO and SaaS application logs to the XDM schema to enable automated authentication stories and prevent baseline distortion.</p></td><td><a href="/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/how-to-map-authentication-story-events.md">How to map authentication events for analytics</a></td></tr><tr><td><p><strong>Cortex XSIAM</strong></p><h4>Map network events for analytics</h4><p>Map traffic logs to mandatory XDM fields to trigger automated network stories and surface third-party firewall detection logic.</p></td><td><a href="/cortex-xsiam/configure-cortex-xsiam/data-management/data-model-rules/how-to-map-network-events-for-analytics.md">How to map network events for analytics</a></td></tr></tbody></table>

\ <br>

***

{% columns %}
{% column width="12.5%" %} <picture><source srcset="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2FWwGDfCMZNVCM1oCaEfq8%2Flearn2b.png?alt=media&amp;token=7a94fa6e-1e16-4f7b-9ca1-b155f7389c6a" media="(prefers-color-scheme: dark)"><img src="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2F1OL8FXs90vpqCNTsf4bn%2FlearnNB.png?alt=media&amp;token=caf86e5a-6307-4e58-b47e-33708067c421" alt=""></picture>
{% endcolumn %}

{% column width="87.5%" %}

### Learn

Explore XQL, daily tasks, using APIs, and more.
{% endcolumn %}
{% endcolumns %}

<table data-view="cards"><thead><tr><th>Category</th><th>Topic</th><th data-card-target data-type="content-ref">Guide</th></tr></thead><tbody><tr><td><strong>XQL</strong></td><td><h4>Explore XQL</h4><p>Review XQL syntax, stages, functions, and aggregates.</p></td><td><a href="/cortex-xdr/reference-and-developer-docs/cortex-xdr-xql/get-started-with-xql.md">Get started with XQL</a></td></tr><tr><td><strong>XQL</strong></td><td><h4>Query investigation data</h4><p>Query data associated with Cortex XDR cases and issues.</p></td><td><a href="/cortex-xdr/detect-investigate-and-respond-to-threats/investigate-and-respond-to-cases/investigate-issues/issue-investigation-actions/query-case-and-issue-data.md">Query case and issue data</a></td></tr><tr><td><strong>Role</strong></td><td><h4>SOC analyst</h4><p>Investigate issues, hunt for threats, and respond to incidents.</p></td><td><a href="/cortex-xsiam/detect-investigate-and-respond-to-threats/investigation-and-response.md">Investigation and response</a></td></tr><tr><td><strong>Role</strong></td><td><h4>Platform administrator</h4><p>Configure protection, integrations, data collection, and user access.</p></td><td><a href="/cortex-xsiam/configure-cortex-xsiam/configure-cortex-xsiam.md">Configure Cortex XSIAM</a></td></tr><tr><td><strong>Role</strong></td><td><h4>Developer and integrator</h4><p>Build integrations and automate security operations.</p></td><td><a href="/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts.md">Integrations and scripts</a></td></tr><tr><td><strong>Resource</strong></td><td><h4>API documentation</h4><p>Integrate with Cortex APIs and automate security workflows.</p></td><td><a href="https://cortex-docs.paloaltonetworks.com/cortex-api-overview">https://cortex-docs.paloaltonetworks.com/cortex-api-overview</a></td></tr><tr><td><strong>Cortex Cloud</strong></td><td><h4>Software Supply Chain Security</h4><p>Learn how software supply chain security workflows help protect your SDLC. Explore roles, responsibilities, and common workflows for AppSec, DevSecOps, and developers.</p></td><td><a href="/application-security/software-supply-chain-security/software-supply-chain-security.md">Software Supply Chain Security</a></td></tr></tbody></table>

***

{% columns %}
{% column width="12.5%" %} <picture><source srcset="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2FuUJFhPZpnPWE6dRxsvhG%2Fannouc2.png?alt=media&amp;token=333c6698-c7a7-4796-b019-78088312f49a" media="(prefers-color-scheme: dark)"><img src="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2F9zLJdDttEbR3GRt5n0kg%2Fannounce.png?alt=media&amp;token=bb606a4a-37ec-412a-b13a-f4514322bcc7" alt=""></picture>
{% endcolumn %}

{% column width="87.5%" %}

### Latest product updates

{% endcolumn %}
{% endcolumns %}

<table data-view="cards"><thead><tr><th>Product</th><th>Update</th><th>Release date</th><th data-card-target data-type="content-ref">Guide</th></tr></thead><tbody><tr><td><strong>Cortex XDR</strong></td><td><h4>Translate queries to XQL</h4><p>Translate queries from other security tools into XQL.</p></td><td>July 2026</td><td><a href="/cortex-xdr/reference-and-developer-docs/cortex-xdr-xql/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md">Translate to XQL</a></td></tr><tr><td><strong>Cortex XSIAM</strong></td><td><h4>Extended Threat Intelligence</h4><p>Enrich investigations with threat intelligence.</p></td><td>July 2026</td><td><a href="/cortex-xsiam/detect-investigate-and-respond-to-threats/threat-management/extended-threat-intelligence.md">Extended Threat Intelligence</a></td></tr><tr><td><strong>Cortex Data Security</strong></td><td><h4>AI Security Posture Management</h4><p>Map AI pipelines and prioritize AI security risks by data sensitivity.</p></td><td>July 2026</td><td><a href="/data-security-documentation/data-security/ai-security-posture-management.md">AI Security Posture Management</a></td></tr></tbody></table>

\ <br>

***

{% columns %}
{% column width="12.5%" %} <picture><source srcset="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2FrIxGETwzPJceOglaLeol%2Fexplore2b.png?alt=media&amp;token=37ab9e6d-1d53-41bb-b6f0-edc353052671" media="(prefers-color-scheme: dark)"><img src="https://3791788563-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F3kYnB00zPPdLHH3ppvMH%2Fuploads%2FvnOCFbnGUw909KthyrmL%2Fexplore-nb.png?alt=media&amp;token=04956aaf-d389-4ca1-882e-cd85bc615d23" alt=""></picture>
{% endcolumn %}

{% column width="87.5%" %}

### Explore products

{% endcolumn %}
{% endcolumns %}

<table data-view="cards"><thead><tr><th>Product</th><th>Highlights</th><th data-card-target data-type="content-ref">Guide</th></tr></thead><tbody><tr><td><h4><i class="fa-shield">:shield:</i> Cortex XSIAM</h4></td><td>→ Unified security data and operations<br>→ AI-driven detection and investigation<br>→ Security orchestration and automated response</td><td><a href="https://cortex-docs.paloaltonetworks.com/cortex-xsiam-docs/">Cortex XSIAM Docs</a></td></tr><tr><td><h4><i class="fa-shield-halved">:shield-halved:</i> Cortex XDR</h4></td><td>→ Correlated detection data<br>→ Incident investigations<br>→ Unified response</td><td><a href="https://cortex-docs.paloaltonetworks.com/cortex-xdr-docs/">Cortex XDR Docs</a></td></tr><tr><td><h4><i class="fa-laptop">:laptop:</i> Cortex XDR Agent</h4></td><td>→ Endpoint protection<br>→ Threat prevention<br>→ Endpoint telemetry</td><td><a href="https://cortex-docs.paloaltonetworks.com/cortex-xdr-agent-docs/">Cortex XDR Agent</a></td></tr><tr><td><h4><i class="fa-robot">:robot:</i> Cortex AgentiX</h4></td><td>→ AI security workflows<br>→ Analyst automation<br>→ Guided actions</td><td><a href="https://cortex-docs.paloaltonetworks.com/cortex-agentix-docs/">Cortex AgentiX</a></td></tr><tr><td><h4><i class="fa-cloud">:cloud:</i> Cortex Cloud</h4></td><td>→ Runtime protection<br>→ Threat detection<br>→ Workload context<br>→ Configuration risk discovery<br>→ Exposure prioritization<br>→ Remediation tracking</td><td><a href="https://cortex-docs.paloaltonetworks.com/cortex-cloud-docs/">Cortex Cloud</a></td></tr><tr><td><h4><i class="fa-database">:database:</i> Cortex Data Security</h4></td><td>→ Sensitive data discovery<br>→ Data classification<br>→ Risk prioritization</td><td><a href="https://cortex-docs.paloaltonetworks.com/data-security-documentation/">Data Security Documentation</a></td></tr><tr><td><h4><i class="fa-code">:code:</i> Cortex Cloud Application Security</h4></td><td>→ Code-to-cloud visibility<br>→ Exploitability prioritization<br>→ Delivery workflow security</td><td><a href="https://cortex-docs.paloaltonetworks.com/application-security/">Application Security</a></td></tr><tr><td><h4><i class="fa-gears">:gears:</i> Cortex XSOAR</h4></td><td>→ Response playbooks<br>→ Tool orchestration<br>→ Incident management</td><td><a href="https://cortex-docs.paloaltonetworks.com/cortex-xsoar-docs/">Cortex XSOAR</a></td></tr><tr><td><h4><i class="fa-globe">:globe:</i> Cortex Xpanse</h4></td><td>→ Asset discovery<br>→ Exposure identification<br>→ Attack-surface remediation</td><td><a href="/cortex-xpanse/learn-about-cortex-xpanse.md">Learn about Cortex Xpanse</a></td></tr></tbody></table>


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://cortex-docs.paloaltonetworks.com/readme.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.