Post-deployment checklist
Complete your Cortex AgentiX post-deployment checklist for automations, integrations, users, dashboards, engines, and security settings.
Use this Cortex AgentiX post-deployment checklist to complete your security operations setup. Start with essential configuration tasks, then configure integrations, dashboards, engines, and security settings.
Initial post-deployment setup
Complete these initial Cortex AgentiX configuration tasks to begin security operations.
Configure automations
Review the different types of automations (playbooks and scripts) and apply automation rules to your use case.
Review cases and issues
Review cases and issues to validate your security operations workflow.
Start with WildFire testing to confirm that security controls and sandbox integrations work as expected.
Advanced post-deployment configuration
Complete these advanced tasks to extend your Cortex AgentiX deployment.
Set up relevant integrations
Install essential content packs (for example, common security use cases or SOAR playbook) and configure relevant integrations, either from the Data Sources catalog or from Marketplace.
If your use case is not in the Data Sources catalog, you can install content from Marketplace. For example, if you require content packs such as Phishing and Malware, you need to download the pack from Marketplace and configure the integration. The Data Sources catalog includes the most used data sources to help you onboard.
Update users and roles
Review and configure users, roles, and user groups as required. Each role extends specific privileges to users. The way you configure administrative access depends on your organization's security requirements. Use roles to assign specific access privileges to administrative user accounts.
Dashboards
Review and configure dashboards and ensure you can visualize activity from your active integrations.
Server and security settings
Customize and configure Cortex AgentiX for a more personalized user experience:
Server settings, such as the timezone, the timestamp format, password protection, and custom logos for communication task emails.
Security settings, such as allowed domains, allowed sessions, and user expiration.
Set up and deploy an engine
Deploy an engine if you have specific automation and feed integrations, scripts, or playbooks that execute actions or fetch data directly from resources within your internal network (for example, querying an on-prem Active Directory, isolating a machine via a local tool).
An engine is a proxy server application that is installed on a remote machine, enabling communication between the remote machine and the Cortex XSIAM tenant. You can run playbooks, scripts, commands, and integrations on the remote machine, and the results are returned to the tenant.
Log forwarding
Set up sending logs to an external service, such as a Slack channel or an email distribution list.
Last updated
Was this helpful?