> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide.md). # Cortex XSIAM Development Guide - [Getting Started](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme.md): Get started developing content for Cortex XSIAM. - [Design](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/design.md): Cortex XSIAM design guidance for content and Marketplace packs. - [Use Case Design for Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/design/use-case-design-for-cortex-xsiam.md): Cortex XSIAM guidance for designing efficient incident investigation workflows. - [Development scope](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/design/development-scope.md): Cortex XSIAM guidance for defining your content development scope. - [Integration design](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/design/integration-design.md): Cortex XSIAM guidance for designing reliable, documented integrations. - [Design best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/design/design-best-practices.md): Cortex XSIAM best practices for designing integrations. - [Content development environments](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments.md): Cortex XSIAM development environments and tools for content authors. - [IDE for script development](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/ide-for-script-development.md): Use the Cortex XSIAM built-in IDE to create and edit automation scripts, access Script Helper functions, configure script settings, and use editor keyboard shortcuts. - [Set up a local development environment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/set-up-a-local-development-environment.md): Steps for setting up a local integration development environment in Cortex XSIAM. - [Set up a GitHub Codespace environment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/set-up-a-github-codespace-environment.md): Steps for setting up a GitHub Codespaces development environment in Cortex XSIAM. - [Set up a containerized development environment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/set-up-a-containerized-development-environment.md): Set up a Docker-based Cortex XSIAM content development environment with Visual Studio Code and Dev Containers. - [Demisto SDK](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/demisto-sdk.md): Use the Demisto SDK Python library to facilitate the Cortex XSIAM content development process. - [Visual Studio Code extension](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/content-development-environments/visual-studio-code-extension.md): Use Visual Studio Code extension to design and author scripts and integrations for Cortex XSIAM directly from VS Code. - [Frequently asked questions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/readme/frequently-asked-questions.md): Cortex XSIAM development FAQs covering IDEs, tools, languages, operating systems, licensing, and CLA troubleshooting. - [Integrations and scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts.md): Cortex XSIAM guidance for developing and testing integrations and scripts. - [Components](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/components.md): Cortex XSIAM integration and script components, metadata, and file requirements. - [Integration directory structure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/components/integration-directory-structure.md): Cortex XSIAM integration directory structure and required files. - [Integration metadata YAML file](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/components/integration-metadata-yaml-file.md): Cortex XSIAM integration and script metadata YAML file reference. - [Integration and script parameter types](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/components/integration-and-script-parameter-types.md): Cortex XSIAM parameter types for integration instances and scripts. - [Integration description file](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/components/integration-description-file.md): Cortex XSIAM integration description files and instance configuration. - [Integration Logo Requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/components/integration-logo-requirements.md): Cortex XSIAM integration logo requirements for size and background. - [Developing](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing.md): Code conventions for Cortex XSIAM. - [Python code conventions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/python-code-conventions.md): Python code conventions for Cortex XSIAM. - [PowerShell](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/powershell.md): Cortex XSIAM PowerShell development guidance. - [General naming conventions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/general-naming-conventions.md): Cortex XSIAM naming conventions for integrations, commands, and outputs. - [Integration Parameters](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/integration-parameters.md): Cortex XSIAM configurable integration parameter types. - [Context and outputs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/context-and-outputs.md): Cortex XSIAM context maps and outputs for integrations and playbooks. - [Context standards](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/context-standards.md): Cortex XSIAM standards for structuring incident context data. - [Generic commands](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/generic-commands.md): Cortex XSIAM generic commands for consistent integration workflows. - [Reputation and DBot score](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/reputation-and-dbot-score.md): Cortex XSIAM guidance for indicator reputation and DBot scores. - [Integration commands](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/integration-commands.md): Cortex XSIAM integration command design, arguments, and outputs. - [Using Docker](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/developing/using-docker.md): Cortex XSIAM guidance for running integrations and scripts with Docker. - [Advanced topics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics.md): Advanced information for content development in Cortex XSIAM. - [Fetching credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/fetching-credentials.md): Integrate with third-party credential vaults for Cortex XSIAM to authenticate with integrations. - [Event collector integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/event-collector-integrations.md): Develop event collector integrations to fetch events and logs from external products to Cortex XSIAM. - [Feed Integrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/feed-integrations.md): Cortex XSIAM guidance for developing feed integrations. - [Long Running Containers](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/long-running-containers.md): Cortex XSIAM guidance for long-running integration containers. - [Transform Language (DT)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/transform-language-dt.md): Use DT for various context related functions in Cortex XSIAM. DT is a query language for JSON objects, similar to JSONQuery. - [Integration cache](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/integration-cache.md): Cortex XSIAM integration cache storage between command runs. - [OpenAPI (Swagger) Codegen](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/openapi-swagger-codegen.md): Use the openapi-codegen command in the Demisto SDK to generate a Cortex XSIAM integration package (YAML and Python files). - [Postman code generator](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/postman-code-generator.md): Cortex XSIAM guidance for generating integrations from Postman collections. - [Generate Integration Python Code from JSON](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/generate-integration-python-code-from-json.md): use the demisto-sdk generate-integration  command to generate a Cortex XSIAM integration from an integration config JSON file. - [Generate YAML from Python](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/generate-yaml-from-python.md): Cortex XSIAM guidance for generating integration YAML from Python. - [Scheduled Commands](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/scheduled-commands.md): Cortex XSIAM guidance for scheduling commands in playbook tasks. - [Fetch missing incidents with generic lookback methods](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/advanced-topics/fetch-missing-incidents-with-generic-lookback-methods.md): Cortex XSIAM guidance for retrieving missing incidents with generic lookback. - [Create a sample integration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/create-a-sample-integration.md): Create a sample integration for Cortex XSIAM. - [Define sample integration settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/create-a-sample-integration/define-sample-integration-settings.md): Define integration settings for a sample integration in Cortex XSIAM. - [Write integration code](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/create-a-sample-integration/write-integration-code.md): Cortex XSIAM steps for writing sample integration code. - [Test the integration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/integrations-and-scripts/create-a-sample-integration/test-the-integration.md): Cortex XSIAM steps for testing a sample integration. - [Playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/playbooks.md): Create playbooks with the Playbook Editor to automate complex workflows in Cortex XSIAM without requiring complicated coding. Add the playbook to a content pack. - [Add a Playbook to a Content Pack](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/playbooks/add-a-playbook-to-a-content-pack.md): Cortex XSIAM steps for adding a playbook to a content pack. - [Playbook conventions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/playbooks/playbook-conventions.md): Cortex XSIAM conventions for playbook design, tasks, and naming. - [Generic playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/playbooks/generic-playbooks.md): Cortex XSIAM generic playbooks for common analyst workflows. - [Lists](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/lists.md): Cortex XSIAM steps for creating and packaging lists. - [Issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/alerts.md): Create a content pack for Cortex XSIAM with custom content for issues. - [Data modeling rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/data-modeling-rules.md): Map your Cortex XSIAM logs into a single, unified data model with a consolidated schema. - [Create data model rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/data-modeling-rules/create-data-model-rules.md): Once events are ingested in the data set, create data model rules in the repository and then map the ingested raw events to Cortex XSIAM system fields. - [Test Data Model Rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/data-modeling-rules/create-data-model-rules/test-data-model-rules.md): Cortex XSIAM steps for testing data model rules. - [Indicators](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/indicators.md): Cortex XSIAM guidance for indicators, relationships, and extraction. - [URL extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/indicators/url-extraction.md): Cortex XSIAM guidance for extracting URL indicators from text. - [Domain extraction](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/indicators/domain-extraction.md): Cortex XSIAM guidance for extracting domain indicators from text. - [Relationships](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/indicators/relationships.md): Cortex XSIAM guidance for creating indicator relationships during enrichment. - [Documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation.md): Cortex XSIAM documentation best practices for content packs and contributions. - [Documentation best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/documentation-best-practices.md): Cortex XSIAM documentation best practices for content authors. - [Content pack metadata file](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/content-pack-metadata-file.md): Cortex XSIAM content pack metadata file reference for Marketplace publishing. - [Content pack release notes](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/content-pack-release-notes.md): Cortex XSIAM best practices for content pack release notes. - [Content Pack README](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/content-pack-readme.md): Cortex XSIAM guidance for writing content pack README files. - [README files for content entities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/readme-files-for-content-entities.md): Cortex XSIAM guidance for README files for content entities. - [Images in documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/images-in-documentation.md): Cortex XSIAM guidance for adding images to documentation. - [Videos in documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/videos-in-documentation.md): Cortex XSIAM guidance for adding videos to documentation. - [Documentation Contributions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/documentation/documentation-contributions.md): Cortex XSIAM steps for contributing documentation or reporting issues. - [Testing](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/testing.md): Cortex XSIAM methods for linting, testing, and debugging content. - [Linting](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/testing/linting.md): Cortex XSIAM guidance for linting content and finding code issues. - [Unit testing](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/testing/unit-testing.md): Cortex XSIAM guidance for writing and running unit tests. - [Test playbooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/testing/test-playbooks.md): Cortex XSIAM steps for testing integration commands and scripts with playbooks. - [Debugging](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/testing/debugging.md): Cortex XSIAM debugging guidance for logs, War Room, and IDE tools. - [Contributing content](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content.md): How to contribute content for Cortex XSIAM. - [Contribution requirements](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content/contribution-requirements.md): Prerequisite tools and environments for developing content for contributions to Cortex XSIAM. - [File checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content/file-checklist.md): A checklist of all the files you need to contribute to the Cortex XSIAM content repository. - [Content pack structure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content/content-pack-structure.md): File structure for files included in the Cortex XSIAM content pack. - [Content pack dependencies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content/content-pack-dependencies.md): Cortex XSIAM steps for identifying and fixing content pack dependencies. - [Pull request conventions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content/pull-request-conventions.md): Cortex XSIAM pull request conventions and build process guidance. - [Contribution demo preparation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content/contribution-demo-preparation.md): Cortex XSIAM guidance for preparing a content contribution demo. - [Contribution SLA](https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide/contributing-content/contribution-sla.md): An SLA detailing the required services and the expected level of services when contributing content to the Cortex XSIAM Marketplace --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam-developer-guide/cortex-xsiam-development-guide.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.