> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence.md).
# Extended Threat Intelligence
## Extended Threat Intelligence overview
Extended Threat Intelligence (XTI) offers operationalized Threat Intelligence (TI) seamlessly integrated across the Cortex platform.
XTI offers the following core capabilities:
* **Threat Intel Library:** Powered by Unit 42 threat intel data, the Threat Intel Library provides a unified catalog of curated threat objects (threat actors, malware families, and reports), helping you understand the broader threat landscape.
* **XTI Indicators:** XTI indicators include first-party indicators, as well as observables extracted from detections and customer-managed indicators.
* **TI context in case and issue investigations:** Cases and issues are enriched with the XTI threat intelligence, providing SOC analysts with threat intel context during case and issue investigations.
* **AI-driven Behavioral Threat Analysis (BTA):** XTI correlates observed behaviors and evidence from security cases and issues with known threat actor Tactics, Techniques, and Procedures (TTPs).
* **TI investigations through XQL:** Build investigations and hunt queries, and correlate threat intel data with issues data through Cortex Query Language (XQL) using the full depth of XTI intelligence library.
* **Interactive TI dashboard:** Leverage the built-in XQL dashboard summarizing threat intel relevant to your organization, and clone and modify it as needed.
* **Threat-aware automation and response:** Utilize built-in commands in playbooks to automate TI triage, enrichment, and response.
* **Accessible TI with AgentiX:** Natural language assistance for TI search and explanations powered by AgentiX.
## What license do I need to use XTI?
To use XTI, you must have the Cortex Agentix Enterprise license.
If you have the correct license, you can access Cortex XTI by navigating to **Threat Management → Threat Intelligence**.
## Permissions required for XTI
XTI requires **View** or **View/Edit** RBAC permissions for **Threat Intelligence** in the **Threat Management** component tab.
Using XTI with platform features such as cases and issues or dashboards requires additional feature-specific permissions.
## Accessing XTI when using TIM and XTI
If you are currently using Threat Intel Management (TIM), you can access Extended Threat Intelligence (XTI) and TIM side by side:
* Four options are available from the Threat **Management → Threat Intelligence** menu: **Threat Intel Library, Indicators, Indicators (TIM)**, and **Dashboard**.
* **Threat Intel Library, Indicators**, and **Dashboard** are part of the XTI module.
* I**ndicators (TIM)** is part of the TIM module.
* From the **Threat Management → Detection Rules** you can access **Indicator Rules** and **Indicator Rules (TIM)**:
* **Indicator Rules** are compatible with the XTI module.
* **Indicator Rules (TIM)** are compatible with the TIM module.
{% hint style="info" %}
XTI and TIM run in parallel, and switching between the XTI and TIM interfaces does not disrupt your existing workflows and pipelines.
{% endhint %}
### Disable access to XTI from the UI
If you are using Threat Intel Management (TIM), an instance or account administrator can disable access to Extended Threat Intelligence (XTI) from the UI.
1. Go to **Configurations → Threat Intelligence → Experience**.
2. Under **Choose your Threat Intelligence experience**, you see two options:
1. **XTI + TIM**: Show TIM and XTI side-by-side in the navigation pane.
2. **TIM only**: Only show TIM in the left navigation pane.
3. Select **TIM only**.
After you have made the choice, the UI options available from the navigation pane are updated for all users of the tenant:
* One option is now available from the **Threat Management → Threat Intelligence** menu: **Indicators**.
* From the **Threat Management → Detection Rules**, you can access **Indicator Rules** that work with TIM.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/detect-investigate-and-respond-to-threats/extended-threat-intelligence.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.