> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam.md). # Learn about Cortex XSIAM - [Navigate the Cortex XSIAM docs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/readme.md): Start here for a visual overview of the main Cortex XSIAM documentation areas. - [Get started with Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/get-started-cortex-xsiam.md): Learn about Cortex XSIAM and the key integrated capabilities. - [Cortex XSIAM architecture](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/get-started-cortex-xsiam/cortex-xsiam-architecture.md): Explore the Cortex XSIAM architecture, including SIEM, XDR, SOAR, cloud security, XDL data ingestion, and Broker VM. - [Agentic AI in Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/agentic-ai-in-cortex-xsiam.md): Use the Cortex Agentic Assistant in Cortex XSIAM to investigate cases, perform threat hunting, and create scripts. Embed and run LLM prompts in playbooks. View AI case summaries. - [Agentic Assistant use cases](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/agentic-ai-in-cortex-xsiam/agentic-assistant-use-cases.md): Recommended prompts to automate your SOC using the Cortex Agentic Assistant in Cortex XSIAM. - [Compare Agentic Assistant with Cortex Assistant](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/agentic-ai-in-cortex-xsiam/compare-agentic-assistant-with-cortex-assistant.md): Feature comparison between Cortex Agentic Assistant and Cortex Assistant in Cortex XSIAM. - [Agentic Assistant security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/agentic-ai-in-cortex-xsiam/agentic-assistant-security.md): Learn about how the Agentic Assistant is built using responsible AI principles in Cortex XSIAM. - [Best practices for using Agentic AI in Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/agentic-ai-in-cortex-xsiam/best-practices-for-using-agentic-ai-in-cortex-xsiam.md) - [Cortex XSIAM license tiers and product licenses](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses.md): Compare Cortex XSIAM license tiers and product licenses: NG-SIEM, Enterprise, Premium, included capabilities, and add-ons. - [Data retention](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses/data-retention.md): Learn more about the default retention periods for all Cortex XSIAM licenses and the available retention add-ons. - [Data storage lifecycle](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses/data-storage-lifecycle.md): Understand the Cortex XSIAM data storage lifecycle, including hot and cold storage, retention extensions, and Event Forwarding exports. - [License allocation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses/license-allocation.md): Learn more about how Cortex XSIAM regulates licenses. - [License expiration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses/license-expiration.md): Learn more about the Cortex XSIAM license expiration and validation period. - [Upgrade your tenant](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/cortex-xsiam-product-licenses/upgrade-your-tenant.md): If you have purchased new entitlements, Cortex XSIAM automatically upgrades your tenant to provide product upgrades and new license entitlements. - [In-product support ticket creation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/in-product-support-case-creation.md): Open a support ticket directly in Cortex XSIAM and record your console to capture your issues and have the ticket handled efficiently. - [Supported web browsers](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/supported-web-browsers.md): View the web browsers and minimum browser versions supported for Cortex XSIAM. - [Use the Cortex XSIAM interface](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/use-the-interface.md): Learn Cortex XSIAM interface navigation, filtering, saved views, result exports, system tools, and product areas. - [Manage API keys](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam/manage-api-keys.md): Learn to create and manage Cortex XSIAM API keys, roles, expiration, scopes, and credential permissions. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/learn-about-cortex-xsiam.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.