> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/configure-security-settings.md).

# Configure security settings

You can configure security settings such as how long users can be logged into Cortex XDR, and from which domains and IP ranges users can log in.

Go to Settings → Configurations → General → **Security Settings**.

| Settings                | Options                  | Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                     |
| ----------------------- | ------------------------ | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| Session Expiration      | User Login Expiration    | The number of hours (between 1 and 24) after which the user login session expires. You can also choose to automatically log users out after a specified period of inactivity.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                   |
|                         | Dashboard Expiration     | <p></p><p>Whether the <strong>Dashboard</strong> page expires at the same time as the user login session or after seven days. This is useful when you view a dashboard on a separate screen.</p><p>For example, if you select seven days for dashboards and eight hours for login expiration and you are currently viewing the <strong>Dashboard</strong> page, the dashboard expiration takes priority (seven days). This ensures that the <strong>Dashboard</strong> page continues to display the widgets for an extended period.</p><div data-gb-custom-block data-tag="hint" data-style="info" class="hint hint-info"><p><strong>Note</strong></p><p>Sessions are saved by browser. If you have both dashboard tabs and non-dashboard tabs open in the same browser, the session applies to all tabs. Consequently, if a non-dashboard tab expires based on the User Login Expiration setting, the Dashboard Expiration setting is overridden and the dashboard session ends. To ensure the dashboard remains open for the configured duration, open the dashboard in a separate browser or an incognito window.</p></div> |
| Allowed Sessions        | Approved Domains         | The domains from which you want to allow user access (login) to Cortex XDR. You can add or remove domains as necessary.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                         |
|                         | Approved IP Ranges       | The IP ranges from which you want to allow user access (login) to Cortex XDR. You can also choose to limit API access from specific IP addresses.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| User Expiration         | Deactivate Inactive User | Deactivate an inactive user, and also set the user deactivation trigger period. By default, user expiration is disabled. When enabled, enter the number of days after which inactive users should be deactivated.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                               |
| Same-Site Cookie Policy | <p>Strict <br>Lax</p>    | <p>Configure your Cortex tenant's SameSite cookie security policy by selecting between two settings to control how users log in from external links:</p><ul><li><strong>Strict</strong> (Recommended): Requires users to reauthenticate when clicking a link from another site, even if they are already signed in.</li><li><strong>Lax</strong>: Offers a more seamless experience by allowing users to access the tenant directly from external links without needing to log in again. Yet, we advise against this setting for security reasons.</li></ul>                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                    |
| Allowed Domains         | Domain Name              | The domain names that can be used in your distribution lists for reports. For example, when generating a report, ensure the reports are not sent to email addresses outside your organization.                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                  |


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://cortex-docs.paloaltonetworks.com/cortex-xdr-3.x/cortex-xdr-3.x-documentation/onboard-and-configure-cortex-xdr/post-deployment-steps/set-up-your-environment/configure-security-settings.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.