> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix.md). # Onboard Cortex AgentiX - [How to onboard Cortex AgentiX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/onboard-cortex-agentix.md): Follow the steps to successfully onboard and configure Cortex AgentiX. - [Plan and prepare your deployment](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/plan-and-prepare-your-deployment.md): Plan your Cortex AgentiX deployment by selecting a region, data sources, agents, licensing, and access controls. - [Deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/deployment-steps.md): Review the plan and prepare considerations, and then follow the steps in the onboarding checklist to successfully deploy and onboard Cortex AgentiX. - [Onboarding checklist](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/deployment-steps/onboarding-checklist.md): Activate, provision, grant access, and configure Cortex AgentiX. - [Activate Cortex AgentiX](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/deployment-steps/activate-cortex-agentix.md): Activate a Cortex AgentiX tenant through Cortex Gateway and configure its name, region, and subdomain. - [Cortex AgentiX supported regions](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/deployment-steps/activate-cortex-agentix/cortex-agentix-supported-regions.md): Supported regions in which you want to host Cortex AgentiX and any associated services. - [Enable access to Palo Alto Networks resources](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/deployment-steps/activate-cortex-agentix/enable-access-to-palo-alto-networks-resources.md): Depending on your network environment settings, you may need to enable network access to the Cortex AgentiX resources. - [Install and configure content](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/deployment-steps/install-and-configure-content.md): Learn how content works in Cortex AgentiX. - [Post-deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps.md): Complete post-deployment configuration for automation, integrations, users, roles, and access in Cortex AgentiX. - [Post-deployment checklist](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/post-deployment-checklist.md): Complete your Cortex AgentiX post-deployment checklist for automations, integrations, users, dashboards, engines, and security settings. - [Set up users, groups, and roles](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/set-up-users-and-roles.md): Set up Cortex AgentiX and Cortex Gateway users, user groups, roles, role-based access control (RBAC), and SAML SSO authentication. - [Configure server settings](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/configure-server-settings.md): Configure Cortex AgentiX server settings for user preferences, security controls, AI features, access, and tenant operations. - [Configure security settings](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/configure-security-settings.md): Configure Cortex AgentiX login sessions, approved domains and IP ranges, user expiration, and cookie security policies. - [Set up an engine](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/set-up-an-engine.md): Set up a Cortex AgentiX engine on a remote machine. - [Log forwarding](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding.md): Configure Cortex AgentiX log forwarding and notifications for email, Slack, and syslog receivers. - [Forward Cortex AgentiX logs and data to external services](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services.md): Forward Cortex AgentiX logs, cases, and issues to Slack, syslog, email, Splunk, Amazon SQS, Amazon S3, and webhooks. - [Configure external applications for forwarding](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-external-applications-for-forwarding.md): Configure Cortex AgentiX external applications and Cortex Gateway egress for forwarding cases, issues, and logs to third-party services. - [Forward notifications to Amazon SQS](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-amazon-sqs.md): Configure Cortex XSIAM notification forwarding to Amazon SQS with Cortex Gateway egress, an AWS SQS queue, IAM role or access keys, and queue permissions. - [Forward notifications to Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-amazon-s3.md): Configure Cortex XSIAM notification forwarding to Amazon S3 with Cortex Gateway egress, AWS IAM roles, bucket permissions, and file rollup. - [Forward notifications to Splunk](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-splunk.md): Configure Cortex XSIAM notification forwarding to Splunk with firewall access, Cortex Gateway egress, HTTPS Event Collector, and authentication tokens. - [Forward notifications to webhook](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-webhook.md): Configure Cortex XSIAM case and issue notifications to HTTPS webhooks with firewall access, Gateway egress, authentication, and JSON payload support. - [Integrate a syslog receiver](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-external-applications-for-forwarding/integrate-a-syslog-receiver.md): Configure a Cortex AgentiX syslog receiver to forward logs and issues, allow regional IP addresses, and set TCP, UDP, or TLS connection settings. - [Integrate Slack for outbound notifications](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-external-applications-for-forwarding/integrate-slack-for-outbound-notifications.md): Integrate Cortex AgentiX with a Slack workspace to forward issue and report notifications to dedicated Slack channels. - [Configure notification forwarding](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/configure-notification-forwarding.md): Configure Cortex AgentiX notification forwarding for issues, cases, and audit logs to email, Slack, syslog, Splunk, Amazon S3, Amazon SQS, and webhooks. - [Set up email notifications for tenant updates](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/set-up-email-notifications-for-tenant-updates.md): Set up Cortex AgentiX email notifications for tenant upgrades, hotfixes, downtime warnings, and Management Audit Log events. - [Monitor administrative activity](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/forward-logs-and-data-from-cortex-agentix-to-external-services/monitor-administrative-activity.md): Monitor Cortex AgentiX management audit logs for administrative and investigative activity, filter log entries, and forward audit notifications to email, syslog, or Slack. - [Data and log notification formats](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/data-and-log-notification-formats.md): Learn about Cortex AgentiX notification formats for forwarded cases, issues, and logs, including alert-format issue notifications for email, syslog, and Slack. - [Issue notification format](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/data-and-log-notification-formats/issue-notification-format.md): Review Cortex AgentiX issue notification formats for email, Slack, Splunk, Amazon S3, Amazon SQS, webhooks, and CEF-formatted syslog messages. - [Management Audit log notification format](https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix/post-deployment-steps/log-forwarding/data-and-log-notification-formats/management-audit-log-notification-format.md): Review Cortex AgentiX Management Audit log notification formats for email and CEF-formatted syslog forwarding, including field mappings. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-agentix/onboard-cortex-agentix.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.