> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam.md). # Onboard Cortex XSIAM - [How to onboard Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/onboard-cortex-xsiam.md): Learn about the deployment preparation and procedures for onboarding and configuring Cortex XSIAM. - [Plan and prepare](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/plan-and-prepare.md): Plan your Cortex XSIAM deployment, including storage, region, licensing, XDR agents, data sources, and user roles. - [Plan your agent deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/plan-and-prepare/plan-your-agent-deployment.md): Plan phased Cortex XDR agent deployment, from pilot testing to organization-wide Cortex XSIAM rollout. - [Deployment steps](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps.md): Review the plan and prepare considerations, and then follow the steps in the onboarding checklist to successfully deploy and onboard Cortex XSIAM. - [Cortex XSIAM onboarding checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/cortex-xsiam-onboarding-checklist.md): Cortex XSIAM onboarding checklist for activation, data source configuration, XDR agent deployment, and analytics setup. - [Activate Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam.md): Activate Cortex XSIAM tenants in Cortex Gateway, including prerequisites, encryption, and access configuration. - [Bring your own keys](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/bring-your-own-keys.md): Set up, import, rotate, and disable Cortex BYOK encryption keys for Cortex XSIAM tenant data. - [Cortex XSIAM supported regions and data residency](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/cortex-xsiam-supported-regions.md): View Cortex XSIAM supported hosting regions and data residency locations in Americas, EMEA, and JPAC. - [Enable access to required PANW resources](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/enable-access-to-required-panw-resources.md): Configure firewall access to Cortex XSIAM resources using required FQDNs, IP addresses, ports, and App-IDs. - [Cortex XSIAM regional egress resources](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/enable-access-to-required-panw-resources/regional-egress-resources.md): Configure Cortex XSIAM firewall egress access with regional FQDNs, IP addresses, ports, and App-IDs. - [Cortex XSIAM engine outbound IP addresses](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/enable-access-to-required-panw-resources/engine-ip-addresses-outbound.md): Configure firewall allowlists for Cortex XSIAM engine outbound IP addresses by deployment region. - [Cortex XSIAM inbound source IP addresses](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/enable-access-to-required-panw-resources/inbound-source-resources.md): Configure firewall allowlists for Cortex XSIAM inbound source IP addresses by deployment region. - [FedRAMP and US federal Cortex XSIAM required resources](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/activate-cortex-xsiam/enable-access-to-required-panw-resources/fedramp-and-the-us-federal-government-required-resources.md): Configure required Cortex XSIAM network resources for FedRAMP and US federal government deployments. - [Set up users, groups, and roles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-users-and-roles.md): Learn how to set up users and roles in Cortex XSIAM. - [Manage Cortex XSIAM user groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-users-and-roles/user-group-management.md): Manage Cortex XSIAM user groups for RBAC, SBAC scoping, SAML mapping, and Active Directory synchronization. - [Assign user roles and groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-users-and-roles/assign-user-roles-and-groups.md): Assign Cortex XSIAM roles and groups, configure RBAC permissions, and apply SBAC granular access. - [Set up authentication](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-authentication.md): Authenticate Cortex XSIAM users using SAML 2.0 or Customer Support Portal (CSP). - [Authenticate users through the Customer Support Portal](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-authentication/authenticate-users-through-the-customer-support-portal.md): Authenticate Cortex XSIAM users through Customer Support Portal and assign Gateway or tenant access roles. - [Authenticate users using SSO](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-authentication/authenticate-users-using-sso.md): Configure Cortex XSIAM SAML 2.0 single sign-on with identity providers, group mapping, and user provisioning. - [Set up Okta as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-authentication/set-up-okta-as-the-identity-provider-using-saml-2.0.md): Configure Okta SAML 2.0 single sign-on and group mapping for Cortex XSIAM users. - [Set up Microsoft Entra ID as the Identity Provider Using SAML 2.0](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-authentication/set-up-microsoft-entra-id-as-the-identity-provider-using-saml-2.0.md): Configure Microsoft Entra ID SAML 2.0 single sign-on, security group claims, and user group mapping for Cortex XSIAM. - [Configure content](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/configure-content.md): Configure Cortex XSIAM data sources with standard collectors, Broker VM applets, XDR Collectors, CSP onboarding, and content packs. - [Set up Cloud Identity Engine](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/set-up-cloud-identity-engine.md): Learn how to set up Cloud Identity Engine to use with Cortex XSIAM. - [Install Cortex XDR agents](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents.md): Install Cortex XDR agents with agent installation packages to monitor endpoints and collect Cortex XSIAM endpoint data. - [Create an agent installation package](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents/create-an-agent-installation-package.md): Create Cortex XDR agent installation packages for endpoints, Kubernetes, container, and serverless workloads in Cortex XSIAM. - [Deploy installation packages](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents/deploy-installation-packages.md): Deploy Cortex XDR agent installation packages to Windows, macOS, Linux, Kubernetes, and Android endpoints using manual or software distribution methods in Cortex XSIAM. - [Endpoint data collection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents/endpoint-data-collection.md): Review endpoint metadata, EDR events, Windows event logs, and performance metrics collected by Cortex XDR agents for Cortex XSIAM. - [Configure global agent settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents/configure-global-agent-settings.md): Configure global Cortex XDR agent settings for uninstall passwords, content bandwidth, upgrades, advanced analysis, and endpoint cleanup for Cortex XSIAM. - [Define endpoint groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents/define-endpoint-groups.md): Create and manage static or dynamic Cortex XDR Agent endpoint groups to target security policies and actions by endpoint attributes for Cortex XSIAM. - [Manage endpoint profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents/manage-endpoint-profiles.md): Manage Cortex XSIAM endpoint security profiles and policy mappings to apply reusable threat protection settings across endpoint groups. - [Guidelines for keeping Cortex XDR agents and content updated](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/install-cortex-xdr-agents/guidelines-for-keeping-cortex-xdr-agents-and-content-updated.md): Plan phased Cortex XDR agent upgrades and content updates with rollout schedules, staging content, and bandwidth controls in Cortex XSIAM. - [Cortex XSIAM - Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/cortex-xsiam-analytics.md): Learn how to enable Cortex XSIAM - Analytics, which allows Cortex XSIAM to analyze data from a variety of sensors and develop a baseline to raise analytics alerts. - [Configure Cortex XSIAM network parameters](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/cortex-xsiam-analytics/configure-cortex-xsiam-network-parameters.md): Configure Cortex XSIAM internal IP address ranges and domain suffixes for network asset identification, tracking, and analysis. - [Enable the Analytics Engine and Identity Analytics](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/cortex-xsiam-analytics/enable-the-analytics-engine-and-identity-analytics.md): Enable Cortex XSIAM Analytics Engine and Identity Analytics to baseline activity and detect anomalous endpoint and user behavior. - [FedRAMP overview](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/fedramp-overview.md): Learn how FedRAMP standardizes cloud security assessment, authorization, and continuous monitoring for U.S. government agencies. - [Cortex XSIAM FedRAMP compliance for federal agencies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/fedramp-overview/cortex-xsiam-federal-compliance.md): Learn how FedRAMP-authorized Cortex XSIAM supports U.S. federal agencies with isolated tenants, U.S. data residency, and government cloud infrastructure. - [Onboard and configure government cloud environments](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/fedramp-overview/onboarding-and-configuration.md): Onboard government cloud environments to Cortex XSIAM with the CSP wizard, Government tenant settings, and compliant scan modes. - [FedRAMP limitations and supported government cloud regions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/deployment-steps/fedramp-overview/limitations-and-supported-regions.md): Review Cortex XSIAM FedRAMP feature limitations and supported AWS GovCloud and Azure Government regions for federal deployments. - [Post-deployment](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment.md): Complete Cortex XSIAM post-deployment tasks, including health checks, automations, and reviews of security cases and issues. - [Cortex XSIAM post-deployment checklist](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/post-deployment-checklist.md): Use this Cortex XSIAM post-deployment checklist for health checks, automations, case triage, XDR agent rollout, and integrations. - [Perform health checks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/perform-health-checks.md): Perform Cortex XSIAM health checks for prevention policies, Cortex XDR agents, WildFire testing, alerts, cases, and log ingestion. - [Monitor agent operational status in Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/perform-health-checks/monitor-agent-operational-status-in-cortex-xsiam.md): Monitor Cortex XDR agent operational status in Cortex XSIAM, including protected, partially protected, unprotected, and resource-impact states. - [Cortex Marketplace](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/cortex-marketplace.md): Discover Cortex Marketplace content packs for integrations, playbooks, automations, correlation rules, dashboards, and security use cases. - [Content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/cortex-marketplace/content-packs.md): Explore pre-installed and recommended Cortex Marketplace content packs for integrations, playbooks, scripts, widgets, and security workflows. - [Install content packs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/cortex-marketplace/install-content-packs.md): Install Cortex Marketplace content packs, review dependencies, and configure integrations and data sources in Cortex XSIAM. - [Manage user roles and access management](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management.md): Learn how to manage access for users, user roles, user groups, and Single Sign-On (SSO) for users on a specific Cortex XSIAM tenant. - [Manage user roles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-user-roles.md): Create and manage Cortex XSIAM user roles with RBAC permissions, XQL dataset access controls, and scoped access settings. - [Manage user access](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-user-access.md): Manage Cortex XSIAM user access with roles, user groups, RBAC permissions, SBAC scopes, and XQL dataset row controls. - [User access reference information](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-user-access/user-access-reference-information.md): Reference Cortex XSIAM Users page fields for user types, direct roles, groups, group roles, and granular access scopes. - [Manage user scope](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-user-scope.md): Configure Cortex XSIAM Scope-Based Access Control (SBAC) for users, groups, and API keys across assets, cases, endpoints, and dataset rows. - [Manage access to objects](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-access-to-objects.md): Manage Cortex XSIAM per-object access for dashboards, reports, playbooks, scripts, and saved XQL queries using owner, editor, and viewer roles. - [Manage access to custom dashboards](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-custom-dashboards.md): Manage Cortex XSIAM custom dashboard access with role permissions, object sharing, owners, editors, viewers, and SBAC data scopes. - [Manage access to report templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-report-templates.md): Manage Cortex XSIAM report template access with role permissions, ownership, sharing, public visibility, and SBAC data scopes. - [Manage access to playbooks and scripts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-playbooks-and-scripts.md): Manage Cortex XSIAM playbook and script access with role permissions, ownership, sharing, public visibility, and automation controls. - [Manage access to saved queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/manage-user-roles-and-access-management/manage-access-to-objects/manage-access-to-saved-queries.md): Manage Cortex XSIAM saved XQL query access with role permissions, ownership, sharing, public visibility, and Query Library controls. - [Dashboards and reports](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/dashboards-and-reports.md): Use Cortex XSIAM dashboards, widgets, reports, and report templates to visualize security data and monitor system activity. - [Configure server settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/configure-server-settings.md): Configure Cortex XSIAM server settings for localization, branding, AI, access control, data ingestion, security, and support access. - [Configure security settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/configure-security-settings.md): Configure Cortex XSIAM security settings for session expiration, login domains, approved IP ranges, inactive users, cookies, and report emails. - [Data and log forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding.md): Configure Cortex XSIAM notifications and forward logs, alerts, cases, and issues to email, Slack, syslog, and third-party services. - [Forward logs and data from Cortex XSIAM to external services](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services.md): Forward Cortex XSIAM logs, cases, and issues to email, Slack, syslog, Splunk, Amazon SQS, Amazon S3, or webhooks. - [Configure external applications for forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-external-applications-for-forwarding.md): Configure external applications in Cortex XSIAM to forward cases, issues, and logs to email, Slack, syslog, Amazon S3, Amazon SQS, Splunk, and webhooks. - [Forward notifications to Amazon SQS](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-amazon-sqs.md): Configure Cortex XSIAM notification forwarding to Amazon SQS with Cortex Gateway egress, an AWS SQS queue, IAM role or access keys, and queue permissions. - [Forward notifications to Amazon S3](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-amazon-s3.md): Configure Cortex XSIAM notification forwarding to Amazon S3 with Cortex Gateway egress, AWS IAM roles, bucket permissions, and file rollup. - [Forward notifications to Splunk](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-splunk.md): Configure Cortex XSIAM notification forwarding to Splunk with firewall access, Cortex Gateway egress, HTTPS Event Collector, and authentication tokens. - [Forward notifications to webhook](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-external-applications-for-forwarding/forward-notifications-to-webhook.md): Configure Cortex XSIAM case and issue notifications to HTTPS webhooks with firewall access, Gateway egress, authentication, and JSON payload support. - [Integrate a syslog receiver](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-external-applications-for-forwarding/integrate-a-syslog-receiver.md): Integrate a syslog receiver for Cortex XSIAM notifications with regional firewall access, TCP or UDP transport, TLS certificates, and troubleshooting. - [Integrate Slack for outbound notifications](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-external-applications-for-forwarding/integrate-slack-for-outbound-notifications.md): Integrate Cortex XSIAM with Slack to forward issue and report notifications to dedicated workspace channels. - [Configure notification forwarding](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/configure-notification-forwarding.md): Configure Cortex XSIAM forwarding notifications for issues, cases, and audit logs with scoped filters, formats, grouping, and external destinations. - [Set up email notifications for tenant updates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/set-up-email-notifications-for-tenant-updates.md): Set up Cortex XSIAM email notifications for tenant upgrades, hotfixes, downtime warnings, and Management Audit Log events. - [Monitor administrative activity](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/forward-logs-and-data-from-cortex-xsiam-to-external-services/monitor-administrative-activity.md): Monitor Cortex XSIAM administrative and investigative activity with Management Audit Logs, filters, 365-day retention, and notification forwarding. - [Data and log notification formats](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/data-and-log-notification-formats.md): Understand Cortex XSIAM notification formats for forwarded cases, issues, and logs, including optional alert formatting for email, syslog, and Slack. - [Management audit log messages](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/data-and-log-notification-formats/management-audit-log-messages.md): Reference Cortex XSIAM Management Audit Log message types for administrative, authentication, automation, endpoint, policy, and integration activity. - [Cortex XSIAM issue notification format](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/data-and-log-notification-formats/issue-notification-format.md): Reference Cortex XSIAM issue notification formats and payloads for email, Slack, syslog, Splunk, Amazon S3, Amazon SQS, and webhooks. - [Agent Audit log notification format](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/data-and-log-notification-formats/agent-audit-log-notification-format.md): Reference Cortex XDR Agent Audit Log notification formats for email and syslog, including CEF field mappings and payload examples. - [Management Audit log notification format](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/data-and-log-notification-formats/management-audit-log-notification-format.md): Reference Cortex XSIAM Management Audit Log notification formats for email and syslog, including CEF field mappings and payload examples. - [Log format for IOC and BIOC issues](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/data-and-log-notification-formats/log-format-for-ioc-and-bioc-issues.md): Reference legacy Cortex XSIAM IOC and BIOC issue log formats for email and syslog, including fields, prefixes, and categories. - [Analytics log format](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam/post-deployment/data-and-log-forwarding/data-and-log-notification-formats/analytics-log-format.md): Reference legacy Cortex XSIAM Analytics issue log formats for email and syslog, including detection, network activity, user, device, and file fields. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/onboard-cortex-xsiam.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.