Navigate the Cortex XSIAM docs

Start here for a visual overview of the main Cortex XSIAM documentation areas.

Cortex XSIAM unifies detection, investigation, response, endpoint security, and cloud security in one platform.

Use this page to jump into the right docs area fast.

Use the table of contents when you know the exact page.

Use this page when you need a quick overview of the main Cortex XSIAM areas.

Learn the product

Product overview

Learn about the basics and architecture.

Get started with Cortex XSIAM

Agentic AI

Explore AI-powered investigation, response, and workflows.

Agentic AI in Cortex XSIAM

Licensing

Review plans, add-ons, and retention.

Cortex XSIAM license tiers and product licenses

Interface

Navigate pages, filters, views, and exports.

Use the Cortex XSIAM interface

Onboard Cortex XSIAM

Plan and prepare

Consider storage, region, XDR agent, and data sources requirements.

Plan and prepare

Deployment checklist

Follow the key steps to deploy and onboard.

Cortex XSIAM onboarding checklist

Post-deployment

Validate your deployment and complete initial tasks.

Post-deployment

Cortex XSIAM Data Sources

Connect data sources, including CSP, and Cloud Posture and Runtime Security data sources.

Cortex XSIAM Data Sources and Connectors

Analytics

Set up analytics and enable the analytics engine.

Cortex XSIAM - Analytics

Configure Cortex XSIAM

Data management

Manage ingestion, retention, and data access.

Data management

Configure the Cortex Agentic Assistant

Set up assistant access and capabilities.

Configure the Cortex Agentic Assistant

Cortex MCP server

Connect external AI clients through the MCP server.

Cortex MCP server

Automations

Automate recurring security tasks and responses.

Automations

Customize cases and issues

Tailor case and issue workflows to your needs.

Customize cases and issues

Multi-Tenant

Manage tenants and their security operations.

Multi-Tenant

Managed Services configuration in Cortex

Configure services for managed security operations.

Managed Services configuration in Cortex

Protect your environment

Endpoint security

Prevent, detect, and respond to endpoint threats.

Endpoint security

Endpoint DLP

Protect sensitive data on managed endpoints.

Endpoint DLP

Detect, investigate, and respond

Monitor dashboards and reports

Track security operations, trends, and outcomes.

Monitor dashboards and reports

Investigation and response

Investigate cases/issues and respond to threats.

Investigation and response

Agentic Assistant chat

Use natural language to investigate security data.

Agentic Assistant chat

Asset management

Inventory and monitor assets across your environment.

Asset management

Threats

Prioritize and manage threats affecting your organization.

Threat management

Attack Surface Management

Discover and assess internet-facing attack surface risks.

Attack surface management

Vulnerability management

Identify, prioritize, and remediate vulnerabilities.

Vulnerability management

Exposure management

Understand and reduce your overall cyber exposure.

Exposure management

Cloud Security

Data Security

Discover and protect sensitive cloud data.

Cortex Data Security

Monitor and track compliance adherence

Measure cloud compliance against supported standards.

Monitor and track compliance adherence

Cloud Security Rules and Policies

Configure policies and rules for cloud protection.

Cloud security rules and policies

Cloud Data Classification

Classify cloud data using sensitive data profiles.

Cloud Data Classification

Cloud Identity Security

Secure cloud identities and their permissions.

Cloud Identity Security

Network exposure detection

Identify cloud network paths that create exposure.

Network exposure detection

Cloud AI Security

Secure AI services and workloads in the cloud.

Cortex Cloud AI Security

Serverless function posture security

Assess configuration risks in serverless functions.

Serverless function posture security

Cloud Application Security

Protect cloud-native applications across their lifecycle.

Cortex Cloud Application Security

Cloud workload policies and rules

Define controls for cloud workloads and resources.

Cloud workload policies and rules

Web and API Security (WAAS)

Protect web applications and APIs from attacks.

Web and API Security (WAAS)

Serverless function runtime security

Detect runtime threats in serverless functions.

Serverless function runtime security

Cortex Advanced Email Security

Protect users from email-based threats.

Cortex Advanced Email Security

Reference and developer docs

XQL

Query and analyze security data with XQL.

Cortex XSIAM XQL

Graph Search

Explore relationships between entities and events.

Graph Search

Cortex CLI

Manage Cortex XSIAM from the command line.

About Cortex CLI

Role-Based Access Control

Control access with roles and permissions.

Role-Based Access Control

API documentation

Integrate Cortex XSIAM with its public APIs.

API documentation