LogoLogo
⌘Ctrlk
BlogSupport
  • Home
AI Assistant

I'm here to help you with the docs.

⌘Ctrli
AI Based on your context
LogoLogo
    • Navigate the Cortex XSIAM docs
    • Get started with Cortex XSIAM
    • Agentic AI in Cortex XSIAM
    • Cortex XSIAM license tiers and product licenses
    • In-product support ticket creation
    • Supported web browsers
    • Use the Cortex XSIAM interface
    • Manage API keys
    • How to onboard Cortex XSIAM
    • Plan and prepare
    • Deployment steps
    • Post-deployment
    • Learn how to configure Cortex XSIAM
    • Data management
    • Cortex XSIAM Data Sources and Connectors
    • Marketplace
    • Configure the Cortex Agentic Assistant
    • Cortex MCP server
    • Automations
    • Engines
    • Remote repository management
    • Customize cases and issues
    • XQL query management
    • Multi-Tenant
    • Managed Services configuration in Cortex
    • Endpoint security
    • Endpoint DLP
    • Monitor dashboards and reports
    • Investigation and response
      • Overview of cases
      • Case concepts
      • Analyze and resolve cases
      • Investigate issues
      • Review findings
      • Investigate artifacts and assets
      • Investigate endpoints
      • Investigate files
      • Cortex Assistant
      • Response actions
      • Forensics
      • Notebooks
      • Build XQL queries
      • Research a known threat
    • Agentic Assistant chat
    • Asset management
    • Threat management
    • Attack surface management
    • Vulnerability management
    • Exposure management
    • Cortex Advanced Email Security
    • Identity Threat Detection and Response (ITDR)
    • Monitor and track compliance adherence
    • Cloud security rules and policies
    • Cloud Data Classification
    • Cloud Identity Security
    • Network exposure detection
    • Cortex Cloud SaaS Security
    • Cortex Cloud AI Security
    • Serverless function posture security
    • Cortex Cloud Application Security
    • Cloud workload policies and rules
    • Base image rules
    • Web and API Security (WAAS)
    • Serverless function runtime security
    • Cortex Data Security
    • Cortex XSIAM XQL
    • Graph Search
    • About Cortex CLI
    • Role-Based Access Control
    • API documentation
    • Reference
    • Learn more about migrating to the latest broker VM image
    • Standalone Broker VM
    • Broker VM high availability cluster node
For the complete documentation index, see llms.txt. This page is also available as Markdown.
  1. Guides
  2. Cortex XSIAM
  3. Cortex XSIAM Documentation
  4. Detect, Investigate, and respond to threats
Cortex XSIAM

Investigation and response

Overview of casesCase conceptsAnalyze and resolve casesInvestigate issuesReview findingsInvestigate artifacts and assetsInvestigate endpointsInvestigate filesCortex AssistantResponse actionsForensicsNotebooksBuild XQL queriesResearch a known threat
PreviousData Ingestion
NextOverview of cases

Last updated 1 month ago

Was this helpful?

LogoLogo

‍

  • Trust Center

‍

  • Privacy

‍

  • Terms of Use

‍

  • Legal

© 2026 Palo Alto Networks, Inc. All rights reserved.

Was this helpful?