> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/personas-workflow.md).
# Personas workflow
The workflow outlines the responsibilities of each persona to detect, assess, protect, and secure the API assets across the organization, focusing on the main API security elements:
* Visibility
* Posture Management & Risk Profiling
* Threat Detection & Response
SOC analyst
**Responsibility**: Real-time threat detection & response
The SOC analyst is the key to identifying and investigating API vulnerabilities and attacks within an organization.
**Steps**:
1. **Visibility**: Reviews the **Cases & Issues** module for new attacks.
2. **Investigate**: Select a case or an issue, analyze involved APIs and their context, analyze request/response details, and distinguish normal from malicious activity.
To conduct a deeper investigation to eliminate or contain the threat, investigate the security issue
3. **Decide and Act**: Determine if it's a true attack. If so, initiate an immediate response (often outside the UI) and flag for fixes. Close the case in the UI.
Security practitioner
**Responsibility**: Proactive posture management & risk reduction
The security practitioner uses the UI for continuous risk assessment and orchestration of remediation.
**Steps**:
1. **Overview of API landscape**: In the **API Security Management** dashboard, review emerging threats and understand the overall security of the API landscape.
2. **Analyze APIs and Risks**: Navigate to API endpoints to view all APIs, their risk factors (e.g., internet exposure, sensitive data, authentication/encryption status), and posture issues. Drill down for details.
3. **Manage OpenAPI Specifications**: Access the OpenAPI specification files. Review findings on the specification file itself (misconfigurations) and verify API traffic conformance to its specification.
4. **Assign Remediation**: Consolidate all findings, group them by application owner, and distribute tasks (via email/tickets with timelines) for fixes (code, gateway, specification updates).
Workload owner
**Responsibility**: Application security accountability
The workload owner acts on security tasks, primarily outside the UI.
**Steps**:
1. **Receive Tasks**: Get detailed security tasks and timelines from the security practitioner.
2. **Implement Fixes**: Apply necessary fixes to application code, API configurations, or OpenAPI specifications.
3. **Ensure Compliance**: Bring their APIs and assets into alignment with security standards.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/cloud-security/overview/personas-workflow.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.