> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/extended-threat-intelligence.md).
# Extended Threat Intelligence
## Extended Threat Intelligence overview
Extended Threat Intelligence (XTI) offers operationalized Threat Intelligence (TI) seamlessly integrated across the Cortex platform.
XTI offers the following core capabilities:
* **Threat Intel Library:** Powered by Unit 42 threat intel data, the Threat Intel Library provides a unified catalog of curated threat objects (threat actors, malware families, vulnerabilities, and reports), helping you understand the broader threat landscape.
* **XTI Indicators:** XTI indicators include first-party indicators, as well as observables extracted from detections and customer-managed indicators.
* **TI context in case and issue investigations:** Cases and issues are enriched with the XTI threat intelligence, providing SOC analysts with threat intel context during case and issue investigations.
* **AI-driven Behavioral Threat Analysis (BTA):** XTI correlates observed behaviors and evidence from security cases and issues with known threat actor Tactics, Techniques, and Procedures (TTPs).
* **TI investigations through XQL:** Build investigations and hunt queries, and correlate threat intel data with issues data through Cortex Query Language (XQL) using the full depth of XTI intelligence library.
* **Interactive TI dashboard:** Leverage the built-in XQL dashboard summarizing threat intel relevant to your organization, and clone and modify it as needed.
* **Indicator/IOC detections:** Continuously monitor your environment for known threat indicators with automated issue generation and dynamic targeting.
* **Threat-aware automation and response:** Utilize built-in commands in playbooks to automate TI triage, enrichment, and response.
* **Accessible TI with AgentiX:** Natural language assistance for TI search and explanations powered by AgentiX.
## What license do I need to use XTI?
To use XTI, you must have the Cortex XDR license with the Extended Threat Intelligence (XTI) add-on.
If you have the correct license, you can access Cortex XTI by navigating to **Threat Management → Threat Intelligence**.
## Permissions required for XTI
XTI requires **View** or **View/Edit** RBAC permissions for **Threat Intelligence** in the **Threat Management** component tab.
Using indicator rules requires **View** or **View/Edit** RBAC permissions for both **Threat Intelligence** and **Rules** in the **Threat Management** component tab.
Using XTI with platform features such as cases and issues or dashboards requires additional feature-specific permissions.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-cloud-runtime-security/threat-management/extended-threat-intelligence.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.