> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme.md). # Getting Started This guide helps you create Cortex XSIAM content. You can create content for your own use, or contribute content to Marketplace that either you support or that is community supported. Playbooks, alert fields/layouts/rules, indicator fields/types/layouts, classifiers, mappers, widgets, and dashboards should be developed within the Cortex XSIAM UI. For integrations and scripts, when creating content to use within your instance of Cortex XSIAM or for contribution as a community supported content pack, the UI may be sufficient. For more complex development needs, or if you plan on contributing content as a partner supported content pack or a modification to partner supported content, we recommend using Visual Studio Code, with the [Visual Studio Code extension](/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/visual-studio-code-extension.md). If you work locally, we recommend installing [Demisto SDK](/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/demisto-sdk.md) to upload, download, and run code on Cortex XSIAM directly from your operating system shell. To develop content for contribution as a partner-supported content pack, or to submit modifications to partner-supported content packs, you must set up a [full development environment](/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments.md). If you have questions or need support, contact us on the `#demisto-developers` channel on our [DFIR Slack community](https://start.paloaltonetworks.com/join-our-slack-community). ### Prerequisites and resources Cortex XSIAM is a powerful platform with a rich set of features and customizations. We recommend following these steps before creating custom content: 1. Read and understand Cortex XSIAM [Concepts](/cortex-xsiam/learn-about-cortex-xsiam/readme.md). 2. Read the [FAQs](/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/frequently-asked-questions.md). 3. Review relevant sections of the Cortex XSIAM product [documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-docs/). 4. Understand your use case. What are you trying to achieve? What is the user story? What is the expected workflow? Are you creating a content pack or creating content for internal use? 5. Development scope What content items do you need to develop? Content can include integrations, scripts, playbooks, dashboards, fields, layouts, classifiers, mappers, lists, and data modeling and parsing rules. In some cases, you may just need a playbook to achieve your goals. In other cases, you may need multiple content items. 6. Verify you have an [active tenant](/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam.md). 7. If you plan to publish your content to Marketplace for other customers to use, read about the [contribution process](/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content.md) and the different tiers and support levels (for example, partner vs community support). Learn about best practices and requirements for content pack contributions. 8. Register to the [Learning Center](https://beacon.paloaltonetworks.com/student/catalog) and go through the Product Training. 9. Access the Palo Alto Networks [DFIR Slack community](https://start.paloaltonetworks.com/join-our-slack-community) and join the **`#demisto-developers`** channel. 10. If you are integrating with an external API, verify you have API or SDK access to the product or solution you want to integrate with. 11. (Optional) Install the [Demisto SDK](/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/demisto-sdk.md). The Demisto SDK is a command line tool that can be used to upload, download, validate and run code on Cortex XSIAM directly from your command line. The Demisto SDK offers a Python library and CLI designed to aid the development process, to validate entities and to assist in the interaction between your development setup and Cortex XSIAM. You can use the Demisto SDK with the built-in IDE or with a full development environment. 12. (Optional) Install the Video Studio Code extension to develop integrations and scripts. ### Development, documentation, and contributions * Development * Integrations and scripts Review the structure for integrations and code conventions, as well as features such as data centralization, intelligent stitching, analytics-based detection, alert and incident management, script, generic commands, and reputation score. Write and test your code. * Playbooks - learn about playbook design, conventions, and the use of generic playbooks. For more information on playbook design and development, see [Playbooks](/cortex-xsiam/learn-about-cortex-xsiam/readme.md). * Lists - learn how to download a list from Cortex XSIAM and include it in your content pack. * Alerts - learn how to create alert fields, layouts, rules, classifiers, and mappers. * Data modeling, parsing, and correlation - learn how to create parsing, data modeling, and correlation rules. Enable mapping of events and logs into a single, unified data model. This data model provides a consolidated schema, and a simpler way to interact with your data, regardless of its source or dataset. To familiarize yourself with the data model schema, see [Cortex XSIAM Data Model Schema](/xsiam-data-model-schema/readme.md). * **Indicators** - learn how to create indicator fields and layouts. Learn how domains and URLs are extracted, how to create and use relationships, and more. * Documentation - learn about documentation best practices, as well as documentation requirements for Marketplace contributions. * Contributions - learn the requirements for contributing content to Marketplace. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.