Ctrlk
BlogSupport
For the complete documentation index, see llms.txt. This page is also available as Markdown.

How can I help you today?

⚡ Cortex Tip of the Week — Week 42

Speed up threat hunting with XQL story presets

When writing XQL queries in Cortex XSIAM, use story presets like authentication_story and network_story for common investigation workflows. These presets provide a common schema over xdr_data, which can simplify queries and help you focus on the fields you need. For best performance, apply filters early and select only the required fields.

🔗 View the Cortex XSIAM XQL Data Model

Start with a task

Choose a workflow to begin.

Task

Cortex XDR

Investigate an issue

Trace related activity across alerts and events.

Start here
Causality view
Task

Cortex XSIAM

Connect data sources

Ingest endpoint, network, cloud, and third-party telemetry.

Start here
Connectors
Task

Cortex XSIAM

Automate a response

Build workflows for investigation and remediation.

Start here
Automations
Task

Cortex Cloud Posture Management

How to onboard GCP

Connect a Google Cloud Platform environment to Cortex Cloud.

Start here
How to onboard Google Cloud Platform

Learn

Explore XQL, daily tasks, using APIs, and more.

Category

XQL

Topic

Explore XQL

Review XQL syntax, stages, functions, and aggregates.

Guide
Get started with XQL
Category

XQL

Topic

Query investigation data

Query data associated with Cortex XDR cases and issues.

Guide
Query case and issue data
Category

Role

Topic

SOC analyst

Investigate issues, hunt for threats, and respond to incidents.

Guide
Investigation and response
Category

Role

Topic

Platform administrator

Configure protection, integrations, data collection, and user access.

Guide
Configure Cortex XSIAM
Category

Role

Topic

Developer and integrator

Build integrations and automate security operations.

Guide
Integrations and scripts
Category

Resource

Topic

API documentation

Integrate with Cortex APIs and automate security workflows.

Guide
https://cortex-docs.paloaltonetworks.com/cortex-api-overview
Category

Cortex Cloud

Topic

Software Supply Chain Security

Learn how software supply chain security workflows help protect your SDLC. Explore roles, responsibilities, and common workflows for AppSec, DevSecOps, and developers.

Guide
Software Supply Chain Security

Latest product updates

Product

Cortex XDR

Update

Translate queries to XQL

Translate queries from other security tools into XQL.

Release date

July 2026

Guide
Translate to XQL
Product

Cortex XSIAM

Update

Extended Threat Intelligence

Enrich investigations with threat intelligence.

Release date

July 2026

Guide
Extended Threat Intelligence
Product

Cortex Data Security

Update

AI Security Posture Management

Map AI pipelines and prioritize AI security risks by data sensitivity.

Release date

July 2026

Guide
AI Security Posture Management

Explore products

Product

Cortex XSIAM

Highlights

→ Unified security data and operations → AI-driven detection and investigation → Security orchestration and automated response

Guide
Cortex XSIAM Docs
Product

Cortex XDR

Highlights

→ Correlated detection data → Incident investigations → Unified response

Guide
Cortex XDR Docs
Product

Cortex XDR Agent

Highlights

→ Endpoint protection → Threat prevention → Endpoint telemetry

Guide
Cortex XDR Agent
Product

Cortex AgentiX

Highlights

→ AI security workflows → Analyst automation → Guided actions

Guide
Cortex AgentiX
Product

Cortex Cloud

Highlights

→ Runtime protection → Threat detection → Workload context → Configuration risk discovery → Exposure prioritization → Remediation tracking

Guide
Cortex Cloud
Product

Cortex Data Security

Highlights

→ Sensitive data discovery → Data classification → Risk prioritization

Guide
Data Security Documentation
Product

Cortex Cloud Application Security

Highlights

→ Code-to-cloud visibility → Exploitability prioritization → Delivery workflow security

Guide
Application Security
Product

Cortex XSOAR

Highlights

→ Response playbooks → Tool orchestration → Incident management

Guide
Cortex XSOAR
Product

Cortex Xpanse

Highlights

→ Asset discovery → Exposure identification → Attack-surface remediation

Guide
Learn about Cortex Xpanse

Last updated

Was this helpful?