> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs.md). # Reference and developer docs - [Cortex XSIAM XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql.md) - [Get started with XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql.md): XQL is the Palo Alto Networks Cortex Query Language used in Cortex XSIAM. - [XQL language features](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-features.md): Learn more about the Cortex Query Language features to query for raw network and endpoint data. - [XQL Language Structure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-structure.md): Learn more about the Cortex Query Language structure when creating a query. - [Supported operators](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/supported-operators.md): Cortex Query Language supports specific comparison, boolean, and set operators in Cortex XSIAM. - [Datasets and presets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/datasets-and-presets.md): The Cortex Query Language supports built-in datasets, custom datasets, and presets. - [About examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/about-examples.md): Learn more about the Cortex Query Language (XQL) examples provided. - [JSON functions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/json-functions.md): Learn more about how Cortex XSIAM treats JSON functions in the Cortex Query Language. - [How to filter for empty values in the results table](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/how-to-filter-for-empty-values-in-the-results-table.md): Learn how to filter for empty values in the results table in Cortex Query Language. - [Understanding string manipulation in XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/understanding-string-manipulation-in-xql.md): Learn more about string manipulation in Cortex Query Language (XQL) using double and triple quotes. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries.md): Learn more about how to build Cortex Query Language (XQL) queries using the Query Builder. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/about-the-query-builder.md): The Query Builder facilitates threat detection, case expansion, and data analytics for suspected threats. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries.md): Learn more about how to build XQL queries in the Query Builder. - [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md) - [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md) - [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md) - [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md) - [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/create-xql-query.md) - [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md) - [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md) - [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/graph-query-results.md) - [Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates.md): Use Query Builder templates to query your data sets without using the Cortex Query Language. - [Get started with Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/get-started-with-query-builder-templates.md) - [Considerations for using Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/considerations-for-using-query-builder-templates.md) - [Create a query from a template](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/create-a-query-from-a-template.md) - [Run a free text query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/run-a-free-text-query.md) - [Query Builder template examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/query-builder-template-examples.md) - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center.md): View information about the In Progress and Completed queries that that were run on the tenant. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center.md) - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center/query-center-reference-information.md) - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-scheduled-queries.md): Learn how to manage your scheduled and recurring queries. - [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md) - [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-your-personal-query-library.md): Cortex XSIAM provides as part of the Query Library a personal library for saving and managing your own queries. - [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/xql-macros.md) - [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-your-macros.md) - [Federated Search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/federated-search.md) - [Federated Search configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/federated-search/federated-search-configuration.md) - [Query using Federated Search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/federated-search/query-using-federated-search.md) - [Manage external datasets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/federated-search/manage-external-datasets.md) - [Legacy Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder.md): Learn more about the entities in the Legacy Query Builder. - [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-authentication-query.md) - [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-event-log-query.md) - [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-file-query.md) - [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-image-load-query.md) - [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-network-connections-query.md) - [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-network-query.md) - [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-process-query.md) - [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-registry-query.md) - [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/query-across-all-entities.md) - [Cortex XQL syntax, parameters, and examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/cortex-xql-syntax-parameters-and-examples.md): Comprehensive syntax rules and structural requirements for XQL queries - [Graph Search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search.md): Learn more about Graph Search in Cortex XSIAM. - [What is Graph Search?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/what-is-graph-search.md): Learn more about how to use Graph Search to search assets, findings, and their contextual data. - [Get started with Graph Search queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/get-started-with-graph-search-queries.md): Learn more about how to get started before building a Graph Search query. - [How to build Graph Search queries?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/how-to-build-graph-search-queries.md): Learn more about building Graph Search queries using the built-in query interface. - [Understand Graph Search query results](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/understand-graph-search-query-results.md): Learn more about the Graph Search query results. - [Create Graph Search query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/create-graph-search-query.md): Learn how to create Graph Search queries in Cortex XSIAM. - [Graph Search examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/graph-search-examples.md): Learn how to build Graph Search queries by working through a few examples. - [Manage the Graph Search Query Library](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/manage-the-graph-search-query-library.md): Learn more about the Cortex XSIAM Graph Search Query Library to manage your queries. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/edit-and-run-queries-in-query-center.md): Learn more about viewing the results of a query, modifying a query, and rerunning queries from Query Center. - [Supported assets and findings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/supported-assets-and-findings.md) - [FAQ on Graph Search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/faq-on-graph-search.md): Answer some frequently asked questions relating to Graph Search. - [Create detection rules based on graph search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/create-detection-rules-based-on-graph-search.md) - [About Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli.md): The Cortex CLI is a unified command-line tool integrating Cloud Workload Protection, API Security, and Code Security scans into a single executable. - [Connect Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli.md) - [Installation workflows](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/installation-workflows.md): Install Cortex CLI using a package manager, manual download, or the Cortex Cloud interface. - [Manage the CLI after installation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/manage-the-cli-after-installation.md): Upgrade, pin, uninstall, or update Cortex CLI through automated downloads. - [Authenticate credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/authenticate-credentials.md): Configure Cortex CLI credentials using a file, environment variables, or command-line flags. - [Self-service API keys for CLI scans](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/self-service-api-keys-for-cli-scans.md) - [Cortex CLI usage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-usage.md) - [Cortex CLI common command line reference guide](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-common-command-line-reference-guide.md) - [Cortex CLI for Code Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security.md) - [Cortex CLI usage for Cortex Cloud Application Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-usage-for-application-security.md) - [Cortex CLI Cortex Cloud Application Security command line reference](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference.md) - [Custom Cortex checks and signature verification](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference/custom-cortex-checks-and-signature-verification.md): Load custom Cortex checks and optionally verify their signatures. - [Cortex CLI pre-commit hooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-commit-hooks.md) - [Pre-commit hook usage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-commit-hooks/pre-commit-hook-usage.md) - [Cortex CLI pre-receive hooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-receive-hooks.md) - [Pre-receive hook usage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-receive-hooks/pre-receive-hook-usage.md) - [Cortex CLI for Cloud Workload Protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-cloud-workload-protection.md) - [Cloud Workload Protection command line reference](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-cloud-workload-protection/cloud-workload-protection-command-line-reference.md) - [Cortex CLI for API Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-api-security.md) - [Cortex CLI API Security command line reference guide](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-api-security/cortex-cli-api-security-command-line-reference-guide.md) - [API Security scan report schema](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-api-security/cortex-cli-api-security-command-line-reference-guide/api-security-scan-report-schema.md): Reference schema for API Security scan reports. - [API Security scan output example](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-api-security/cortex-cli-api-security-command-line-reference-guide/api-security-scan-output-example.md): Example API Security scan report output. - [Role-Based Access Control](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control.md): Learn how to limit role permissions in Cortex XSIAM. - [Role permissions by component](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/role-permissions-by-component.md): Learn how to manage role permissions in Cortex XSIAM. - [Core tenant and administrative permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/core-tenant-and-administrative-permissions.md) - [Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions.md): Learn about role permissions for Cortex XSIAM configuration components. - [Auditing permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/auditing-permissions.md): Manage access to Cortex XSIAM audit logs and administrative activity records. - [Alert Notifications permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/alert-notifications-permissions.md): Manage Cortex XSIAM alert notification rules, templates, and forwarding settings. - [General Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/general-configuration-permissions.md): Manage access to Cortex XSIAM general settings and system-wide configuration. - [Cortex XDR Analytics permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/cortex-xdr-analytics-permissions.md): Manage access to Cortex XSIAM analytics configuration and related settings. - [Access management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/access-management-permissions.md): Manage access to Cortex XSIAM users, roles, and access management settings. - [Data Broker permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-broker-permissions.md): Manage access to Cortex XSIAM Data Broker configuration and operations. - [Log Collection permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/log-collection-permissions.md): Manage access to Cortex XSIAM log collection configuration and data sources. - [Data Sources permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-sources-permissions.md): Manage access to Cortex XSIAM data source configuration and ingestion settings. - [External Issues Mapping permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/external-issues-mapping-permissions.md): Manage access to Cortex XSIAM mappings for external issue integrations. - [Integrations - instance permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/integrations-instance-permissions.md): Manage access to individual Cortex XSIAM integration instances and settings. - [Integrations Permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/integrations-permissions.md): Manage access to Cortex XSIAM integration configuration and available instances. - [Data Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-management-permissions.md): Manage access to Cortex XSIAM data management and retention settings. - [Public API](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/public-api.md): Manage access to Cortex XSIAM public API configuration and credentials. - [Threat Intelligence permission - API configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/threat-intelligence-permission-api-configuration.md): Manage access to Cortex XSIAM Threat Intelligence API configuration. - [Long-running HTTP Integrations configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/long-running-http-integrations-configuration.md): Manage access to Cortex XSIAM long-running HTTP integration configuration. - [Credentials permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/credentials-permissions.md): Manage access to Cortex XSIAM credentials and secure connection settings. - [Network Scanners permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/network-scanners-permissions.md): Manage access to Cortex XSIAM network scanner configuration and operations. - [Apps - Instance permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/apps-instance-permissions.md): Manage access to Cortex XSIAM app instances and their configuration. - [Object Setup permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions.md): Manage access to Cortex XSIAM object setup and related configuration. - [Case Properties permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/case-properties-permissions.md): Configure access to case domains, custom statuses, and resolution statuses in Cortex XSIAM. - [Exclusion List permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/exclusion-list-permissions.md): Control access to manage excluded threat indicators and their exclusion settings in Cortex XSIAM. - [Fields and Types permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/fields-and-types-permissions.md): Control access to custom fields, indicator types, and SLA rule configurations in Cortex XSIAM. - [Layout permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/layout-permissions.md): Control access to case and issue layouts, including their layout rules in Cortex XSIAM. - [Sync Profile permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/sync-profile-permissions.md): Control access to sync profiles for mirroring cases with external platforms in Cortex XSIAM. - [Marketplace permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/marketplace-permissions.md): Control access to discover, install, and manage Marketplace content packs in Cortex XSIAM. - [Help permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/help-permissions.md): Control access to create and manage in-product technical support cases in Cortex XSIAM. - [SOC Operations, Investigation & Response permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/soc-operations-investigation-and-response-permissions.md) - [Dashboards and Reports permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions.md): Set permissions for dashboards and reports in Cortex XSIAM. - [Dashboards permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/dashboards-permissions.md): Manage access to Cortex XSIAM dashboards, widgets, and dashboard sharing. - [Command Center Dashboard permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/command-center-dashboard-permissions.md): Manage access to Cortex XSIAM Command Center dashboards and their security metrics. - [Ingestion Monitoring dashboard permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/ingestion-monitoring-dashboard-permissions.md): Manage access to Cortex XSIAM data ingestion monitoring dashboards. - [Reports permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/reports-permissions.md): Manage access to Cortex XSIAM reports and custom report templates. - [Email Command Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/email-command-center-permissions.md): Manage access to the Cortex XSIAM Email Command Center and email threat metrics. - [Cloud Security Command Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/cloud-security-command-center-permissions.md): Manage access to the Cortex XSIAM Cloud Security Command Center. - [Cases and Issues permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cases-and-issues-permissions.md): Control access to investigate, manage, and respond to cases and issues in Cortex XSIAM. - [Investigation and Response permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions.md): Configure role permissions for search, response, and automation capabilities in Cortex XSIAM. - [Search permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions.md): Configure access to threat hunting, query, and forensic investigation tools in Cortex XSIAM. - [Query Library permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/query-library-permissions.md): Manage access to saved XQL queries in Cortex XSIAM's Query Library. - [Query Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/query-center-permissions.md): Manage access to write, run, schedule, and export XQL queries in Cortex XSIAM. - [Forensics permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/forensics-permissions.md): Manage access to Cortex XSIAM forensic investigations, collections, and threat hunts. - [Host Insights permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/host-insights-permissions.md): Manage access to Cortex XSIAM's endpoint inventory, host details, and hygiene data. - [Graph Search permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/graph-search-permissions.md): Manage access to Cortex XSIAM's Graph Search for cloud assets and security findings. - [Response permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions.md): Configure access to endpoint and network response actions and tools in Cortex XSIAM. - [Action Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/action-center-permissions.md): Manage access to Cortex XSIAM endpoint response actions and action history. - [EDL permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/edl-permissions.md): Manage Cortex XSIAM External Dynamic Lists for firewall-enforced threat blocking. - [Agent Scripts Library permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/agent-scripts-library-permissions.md): Manage Cortex XSIAM endpoint scripts for response, collection, and automation. - [Live Terminal permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/live-terminal-permissions.md): Manage Cortex XSIAM interactive endpoint shell access for investigation and remediation. - [Automation permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions.md): Configure permissions for playbooks, scripts, playground, and automated exclusions in Cortex XSIAM. - [Playbook permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/playbook-permissions.md): Manage access to Cortex XSIAM playbooks and automated response workflows. - [Script permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/script-permissions.md): Manage access to Cortex XSIAM scripts for automation and remediation. - [Jobs permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/jobs-permissions.md): Manage access to Cortex XSIAM scheduled automation jobs and their execution. - [Playground permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/playground-permissions.md): Manage access to the Cortex XSIAM playground for testing commands and scripts. - [Automation Exclusion Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/automation-exclusion-center-permissions.md): Manage Cortex XSIAM automation exclusions for commands, scripts, and remediation. - [Jupyter and Observability apps permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/jupyter-and-observability-apps-permissions.md): Configure permissions to use Jupyter and Observability applications. - [Threat Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/threat-management-permissions.md): Configure Detection Rules and Threat Intel permissions in Cortex XSIAM. - [Detection Rules permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/threat-management-permissions/detection-rules-permissions.md): Configure Detection Rules permissions in Cortex XSIAM. - [Threat Intelligence permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/threat-management-permissions/threat-intelligence-permissions.md): Configure Threat Intelligence permissions in Cortex XSIAM - [Exceptions Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions.md): Configure issue exclusion permissions in Cortex XSIAM. - [Issue Exclusions permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/issue-exclusions-permissions.md): Configure Issue Exclusions permissions in Cortex XSIAM. - [Exception Management Admin permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/exception-management-admin-permissions.md): Configure Exception Management Admin permissions in Cortex XSIAM. - [Exception Approver Admin permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/exception-approver-admin-permissions.md): Configure Exception Approver Admin permissions in Cortex XSIAM. - [Managed Services permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/managed-services-permissions.md): Configure access to Managed Services for Unit 42 Managed Threat Hunting and Managed Detection and Response. - [Cortex Agentic Assistant permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cortex-agentic-assistant-permissions.md): Configure the Cortex Agentic Assistant permissions, which includes AI Prompts and Agent permissions in Cortex XSIAM. - [AI Prompts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cortex-agentic-assistant-permissions/ai-prompts.md): Configure AI Prompts permissions in Cortex XSIAM. - [Cortex Agentic Assistant Agents](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cortex-agentic-assistant-permissions/cortex-agentic-assistant-agents.md): Configure Cortex Agentic Assistant Agents permissions in Cortex XSIAM. - [Agents and endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/agents-and-endpoint-protection.md): Configure permissions for XDR Agent infrastructure and endpoint data loss prevention in Cortex XSIAM. - [Inventory - Agent permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions.md): Configure permissions for Endpoints (XDR Agent) in Cortex XSIAM. - [Agent Administrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-administrations.md): Control access to endpoint inventory, agent health, and lifecycle operations in Cortex XSIAM. - [Agent Groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-groups.md): Manage endpoint groups and policy targeting in Cortex XSIAM. - [Agent Prevention Policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-prevention-policies.md): Configure endpoint prevention policies and protection settings in Cortex XSIAM. - [Global Exceptions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/global-exceptions.md): Manage global prevention exceptions and their endpoint scope in Cortex XSIAM. - [Agent Profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-profiles.md): Configure endpoint agent profiles and communication settings in Cortex XSIAM. - [Agent Extension Policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-extension-policies.md): Configure endpoint extension policies and capabilities in Cortex XSIAM. - [Agent Installations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-installations.md): Manage Cortex XSIAM agent installation packages and deployments. - [Host Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/host-firewall.md): Configure host firewall rules and review firewall events in Cortex XSIAM. - [Device Control](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/device-control.md): Manage device control policies, rules, and exceptions in Cortex XSIAM. - [Data Security - Endpoint DLP permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions.md): Configure Endpoint Data Loss Prevention permissions in Cortex XSIAM. - [Data-in-Motion Rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/data-in-motion-rules.md): Configure endpoint data-in-motion protection rules in Cortex XSIAM. - [Endpoint Applications](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/endpoint-applications.md): Manage endpoint applications monitored by Data Loss Prevention in Cortex XSIAM. - [Endpoint Applications Groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/endpoint-applications-groups.md): Manage endpoint application groups for Data Loss Prevention policies in Cortex XSIAM. - [Endpoint DLP Settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/endpoint-dlp-settings.md): Configure endpoint Data Loss Prevention settings in Cortex XSIAM. - [Inventory - Assets permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions.md): Configure inventory permissions for assets and endpoints in Cortex XSIAM. - [Network Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/network-configuration-permissions.md): Configure network topology, ranges, and trusted networks in Cortex XSIAM. - [Compliance (Legacy) permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/compliance-legacy-permissions.md): View legacy cloud compliance violations for assets in Cortex XSIAM. - [Asset Inventory permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-inventory-permissions.md): Control access to asset inventory data and metadata in Cortex XSIAM. - [Asset Roles configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-roles-configuration-permissions.md): Configure functional asset roles and endpoint assignments in Cortex XSIAM. - [Asset Groups permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-groups-permissions.md): Manage asset groups and scoped access controls in Cortex XSIAM. - [Exposure and Vulnerability Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exposure-and-vulnerability-management-permissions.md): Configure exposure, vulnerability, and attack surface management permissions in Cortex XSIAM. - [Attack Surface permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exposure-and-vulnerability-management-permissions/attack-surface-permissions.md): Configure Attack Surface Management permissions in Cortex XSIAM. - [Vulnerability Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exposure-and-vulnerability-management-permissions/vulnerability-management-permissions.md): Configure Vulnerability Management permissions in Cortex XSIAM. - [Exposure Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exposure-and-vulnerability-management-permissions/exposure-management-permissions.md): Configure Exposure Management permissions in Cortex XSIAM. - [Cloud Security and Posture Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions.md): Configure Cloud Security and Posture Management permissions in Cortex XSIAM. - [CLI Tool permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/cli-tool-permissions.md): Configure CLI Tool permissions in Cortex XSIAM. - [Application Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions.md): Configure Application Security permissions in Cortex XSIAM. - [Application Security - Generic Collector permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-generic-collector-permissions.md): Configure Generic Collector permissions for Application Security in Cortex XSIAM. - [Application Security - Issues permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-issues-permissions.md): Configure Application Security issue permissions in Cortex XSIAM. - [Application Security - Scans permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-scans-permissions.md): Configure Application Security scan permissions in Cortex XSIAM. - [Application Security - Policy Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-policy-management-permissions.md): Configure Application Security policy management permissions in Cortex XSIAM. - [Application Security - 3rd Party tools permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-3rd-party-tools-permissions.md): Configure third-party tool permissions for Application Security in Cortex XSIAM. - [Configurations - Application Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/configurations-application-security-permissions.md): Configure Application Security configuration permissions in Cortex XSIAM. - [Policies - Cloud Workload permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/policies-cloud-workload-permissions.md): Configure Cloud Workload policy permissions in Cortex XSIAM. - [Cloud Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/cloud-security-permissions.md): Configure Cloud Security permissions in Cortex XSIAM. - [Compliance - Cloud permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/compliance-cloud-permissions.md): Configure cloud compliance permissions in Cortex XSIAM. - [Data Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/data-security-permissions.md): Configure Data Security permissions in Cortex XSIAM. - [AI Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/ai-security-permissions.md): Configure AI Security permissions in Cortex XSIAM. - [Data Classification permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/data-classification-permissions.md): Configure Data Classification permissions in Cortex XSIAM. - [Identity Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/identity-security-permissions.md): Configure Identity Security permissions in Cortex XSIAM. - [API documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/api-documentation.md): Use the Cortex XSIAM APIs to integrate Cortex XSIAM with third-party apps or services to ingest alerts and to leverage alert stitching and investigation capabilities. - [Reference](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference.md) - [Cloud service provider permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/cloud-service-provider-permissions.md): Grant the correct cloud service provider permissions for Cortex XSIAM. - [Microsoft Windows security auditing setup](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup.md) - [Enable security auditing event IDs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids.md) - [Enable security auditing event IDs with GPO](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/enable-security-auditing-event-ids-with-gpo.md) - [Set up local machine security auditing without GPO](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/set-up-local-machine-security-auditing-with-gpo.md) - [Additional setup for Active Directory Certificate Services (ADCS) events](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/additional-setup-for-active-directory-certificate-services-adcs-events.md) - [Enable auditing access to AD domain objects - 4662](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/enable-auditing-access-to-ad-domain-objects-4662.md) - [Enable additional event logs using Event Viewer](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-additional-event-logs-using-event-viewer.md) - [Enable LDAP server events logging (1644)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644.md) - [Enable LDAP server events logging using RegEdit](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/enable-ldap-server-events-logging-using-regedit.md) - [Enable LDAP server events logging using GPO](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/enable-ldap-server-events-logging-using-gpo.md) - [Validate log collection for LDAP Server events](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/validate-log-collection-for-ldap-server-events.md) - [XDM fields for mapping authentication events](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/xdm-fields-for-mapping-authentication-events.md): Learn more about the Cortex Data Model (XDM) fields to map for authentication events. - [Cortex Network Scanner OSS](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/cortex-network-scanner-oss.md) - [Fair Usage policy for Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/fair-usage-policy-for-cortex-xsiam.md) --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.