> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs.md). # Reference and developer docs - [Cortex XSIAM XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql.md): Learn how to use XQL to query and investigate data in Cortex XSIAM. - [Get started with XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql.md): XQL is the Palo Alto Networks Cortex Query Language used in Cortex XSIAM. - [XQL language features](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-features.md): Learn about XQL language features for querying network and endpoint data in Cortex XSIAM. - [XQL Language Structure](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/xql-language-structure.md): Learn about XQL language structure for creating queries in Cortex XSIAM. - [Supported operators](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/supported-operators.md): Learn about XQL comparison, boolean, and set operators in Cortex XSIAM. - [Datasets and presets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/datasets-and-presets.md): Learn about XQL built-in datasets, custom datasets, and presets in Cortex XSIAM. - [About examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/about-examples.md): Explore XQL query examples in Cortex XSIAM. - [JSON functions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/json-functions.md): Learn how to use JSON functions in XQL in Cortex XSIAM. - [How to filter for empty values in the results table](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/how-to-filter-for-empty-values-in-the-results-table.md): Learn how to filter empty values in XQL results in Cortex XSIAM. - [Understanding string manipulation in XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/get-started-with-xql/understanding-string-manipulation-in-xql.md): Learn how to manipulate strings in XQL using double and triple quotes in Cortex XSIAM. - [Build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries.md): Build XQL queries with Query Builder in Cortex XSIAM. - [About the Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/about-the-query-builder.md): Learn how Query Builder supports threat detection and data analysis in Cortex XSIAM. - [How to build XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries.md): Learn how to build XQL queries with Query Builder in Cortex XSIAM. - [Get started with XQL queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/get-started-with-xql-queries.md): Get started with building XQL queries in Cortex XSIAM. - [Useful XQL user interface features](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/useful-xql-user-interface-features.md): Explore Query Builder features for creating XQL queries in Cortex XSIAM. - [XQL Query best practices](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/xql-query-best-practices.md): Apply XQL query best practices for efficient results in Cortex XSIAM. - [Expected results when querying fields](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/expected-results-when-querying-fields.md): Understand expected XQL field query results in Cortex XSIAM. - [Create XQL query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/create-xql-query.md): Create and run XQL queries with Query Builder in Cortex XSIAM. - [Review XQL query results](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/review-xql-query-results.md): Review and analyze XQL query results in Cortex XSIAM. - [Translate to XQL](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/translate-to-xql.md): Translate search logic into XQL with Query Builder in Cortex XSIAM. - [Graph query results](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/how-to-build-xql-queries/graph-query-results.md): Visualize XQL query results as graphs in Cortex XSIAM. - [Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates.md): Use Query Builder templates to query data without writing XQL in Cortex XSIAM. - [Get started with Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/get-started-with-query-builder-templates.md): Get started with Query Builder templates for guided queries in Cortex XSIAM. - [Considerations for using Query Builder templates](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/considerations-for-using-query-builder-templates.md): Review Query Builder template considerations in Cortex XSIAM. - [Create a query from a template](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/create-a-query-from-a-template.md): Create an XQL query from a Query Builder template in Cortex XSIAM. - [Run a free text query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/run-a-free-text-query.md): Run free-text queries with Query Builder templates in Cortex XSIAM. - [Query Builder template examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/query-builder-templates/query-builder-template-examples.md): Explore Query Builder template examples for data queries in Cortex XSIAM. - [Overview of the Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center.md): View in-progress and completed queries in Query Center in Cortex XSIAM. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center/edit-and-run-queries-in-query-center.md): Edit and run XQL queries from Query Center in Cortex XSIAM. - [Query Center reference information](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/overview-of-the-query-center/query-center-reference-information.md): Reference Query Center details, fields, and statuses in Cortex XSIAM. - [Manage scheduled queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-scheduled-queries.md): Manage scheduled and recurring XQL queries in Cortex XSIAM. - [Scheduled Queries reference information](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-scheduled-queries/scheduled-queries-reference-information.md): Reference scheduled query settings and run details in Cortex XSIAM. - [Manage your personal query library](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-your-personal-query-library.md): Save and manage personal XQL queries in the Query Library in Cortex XSIAM. - [XQL macros](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/xql-macros.md): Use XQL macros to reuse query logic in Cortex XSIAM. - [Manage your macros](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/manage-your-macros.md): Create and manage XQL macros in Cortex XSIAM. - [Federated Search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/federated-search.md): Use Federated Search to query external data sources in Cortex XSIAM. - [Federated Search configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/federated-search/federated-search-configuration.md): Configure Federated Search connections for external data in Cortex XSIAM. - [Query using Federated Search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/federated-search/query-using-federated-search.md): Query external data sources with Federated Search in Cortex XSIAM. - [Manage external datasets](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/federated-search/manage-external-datasets.md): Manage external datasets used by Federated Search in Cortex XSIAM. - [Legacy Query Builder](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder.md): Use Legacy Query Builder to query security data entities in Cortex XSIAM. - [Create authentication query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-authentication-query.md): Create legacy authentication queries in Cortex XSIAM. - [Create event log query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-event-log-query.md): Create legacy event log queries in Cortex XSIAM. - [Create file query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-file-query.md): Create legacy file queries in Cortex XSIAM. - [Create image load query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-image-load-query.md): Create legacy image load queries in Cortex XSIAM. - [Create network connections query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-network-connections-query.md): Create legacy network connection queries in Cortex XSIAM. - [Create network query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-network-query.md): Create legacy network queries in Cortex XSIAM. - [Create process query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-process-query.md): Create legacy process queries in Cortex XSIAM. - [Create registry query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/create-registry-query.md): Create legacy registry queries in Cortex XSIAM. - [Query across all entities](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/build-xql-queries/legacy-query-builder/query-across-all-entities.md): Create legacy queries across security data entities in Cortex XSIAM. - [Cortex XQL syntax, parameters, and examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/cortex-agentix-xql/cortex-xql-syntax-parameters-and-examples.md): Comprehensive syntax rules and structural requirements for XQL queries in Cortex XSIAM. - [Graph Search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search.md): Explore Graph Search for cloud assets and findings in Cortex XSIAM. - [What is Graph Search?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/what-is-graph-search.md): Learn how Graph Search connects assets, findings, and context in Cortex XSIAM. - [Get started with Graph Search queries](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/get-started-with-graph-search-queries.md): Get started with building Graph Search queries in Cortex XSIAM. - [How to build Graph Search queries?](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/how-to-build-graph-search-queries.md): Build Graph Search queries with the query interface in Cortex XSIAM. - [Understand Graph Search query results](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/understand-graph-search-query-results.md): Understand and analyze Graph Search query results in Cortex XSIAM. - [Create Graph Search query](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/create-graph-search-query.md): Create Graph Search queries to investigate assets and findings in Cortex XSIAM. - [Graph Search examples](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/graph-search-examples.md): Explore Graph Search query examples for investigations in Cortex XSIAM. - [Manage the Graph Search Query Library](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/manage-the-graph-search-query-library.md): Manage saved Graph Search queries in the Query Library in Cortex XSIAM. - [Edit and run queries in Query Center](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/edit-and-run-queries-in-query-center.md): Edit, rerun, and review Graph Search queries in Query Center in Cortex XSIAM. - [Supported assets and findings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/supported-assets-and-findings.md): Review assets and findings supported by Graph Search in Cortex XSIAM. - [FAQ on Graph Search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/faq-on-graph-search.md): Find answers to common Graph Search questions in Cortex XSIAM. - [Create detection rules based on graph search](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/graph-search/create-detection-rules-based-on-graph-search.md): Create detection rules from Graph Search queries in Cortex XSIAM. - [About Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli.md): Use Cortex CLI to run Code, API, and Cloud Workload Protection scans in Cortex XSIAM. - [Connect Cortex CLI](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli.md): Connect Cortex CLI to configure scans and authentication in Cortex XSIAM. - [Installation workflows](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/installation-workflows.md): Install Cortex CLI for security scans in Cortex XSIAM. - [Manage the CLI after installation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/manage-the-cli-after-installation.md): Manage Cortex CLI installations and updates for security scans in Cortex XSIAM. - [Authenticate credentials](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/authenticate-credentials.md): Configure Cortex CLI credentials for secure scans in Cortex XSIAM. - [Self-service API keys for CLI scans](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/connect-cortex-cli/self-service-api-keys-for-cli-scans.md): Create self-service API keys for Cortex CLI scans in Cortex XSIAM. - [Cortex CLI usage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-usage.md): Run Cortex CLI commands for security scans in Cortex XSIAM. - [Exit codes and error handling](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/exit-codes-and-error-handling.md) - [Cortex CLI common command line reference guide](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-common-command-line-reference-guide.md): Reference common Cortex CLI commands for security scans in Cortex XSIAM. - [Cortex CLI for Code Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security.md): Use Cortex CLI to scan application code and repositories in Cortex XSIAM. - [Cortex CLI usage for Cortex Cloud Application Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-usage-for-application-security.md): Run Cortex CLI Code Security scans for applications in Cortex XSIAM. - [Cortex CLI Cortex Cloud Application Security command line reference](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference.md): Reference Cortex CLI commands for Application Security scans in Cortex XSIAM. - [Custom Cortex checks and signature verification](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-application-security-command-line-reference/custom-cortex-checks-and-signature-verification.md): Load and verify custom Cortex checks with Cortex CLI in Cortex XSIAM. - [Cortex CLI pre-commit hooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-commit-hooks.md): Use Cortex CLI pre-commit hooks to scan code before commits in Cortex XSIAM. - [Pre-commit hook usage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-commit-hooks/pre-commit-hook-usage.md): Run Cortex CLI pre-commit hooks for code security checks in Cortex XSIAM. - [Cortex CLI pre-receive hooks](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-receive-hooks.md): Use Cortex CLI pre-receive hooks to scan code before acceptance in Cortex XSIAM. - [Pre-receive hook usage](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-code-security/cortex-cli-pre-receive-hooks/pre-receive-hook-usage.md): Run Cortex CLI pre-receive hooks for code security checks in Cortex XSIAM. - [Cortex CLI for Cloud Workload Protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-cloud-workload-protection.md): Use Cortex CLI for Cloud Workload Protection scans in Cortex XSIAM. - [Cloud Workload Protection command line reference](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-cloud-workload-protection/cloud-workload-protection-command-line-reference.md): Reference Cortex CLI commands for Cloud Workload Protection scans in Cortex XSIAM. - [Cortex CLI for API Security](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-api-security.md): Use Cortex CLI for API Security scans in Cortex XSIAM. - [Cortex CLI API Security command line reference guide](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-api-security/cortex-cli-api-security-command-line-reference-guide.md): Reference Cortex CLI commands for API Security scans in Cortex XSIAM. - [API Security scan report schema](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-api-security/cortex-cli-api-security-command-line-reference-guide/api-security-scan-report-schema.md): Reference the API Security scan report schema for Cortex CLI in Cortex XSIAM. - [API Security scan output example](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/about-cortex-cli/cortex-cli-for-api-security/cortex-cli-api-security-command-line-reference-guide/api-security-scan-output-example.md): Review Cortex CLI API Security scan report output in Cortex XSIAM. - [Role-Based Access Control](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control.md): Learn how to limit role permissions in Cortex XSIAM. - [Role permissions by component](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/role-permissions-by-component.md): Learn how to manage role permissions in Cortex XSIAM. - [Core tenant and administrative permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/core-tenant-and-administrative-permissions.md) - [Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions.md): Learn about role permissions for Cortex XSIAM configuration components. - [Auditing permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/auditing-permissions.md): Manage access to Cortex XSIAM audit logs and administrative activity records. - [Alert Notifications permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/alert-notifications-permissions.md): Manage Cortex XSIAM alert notification rules, templates, and forwarding settings. - [General Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/general-configuration-permissions.md): Manage access to Cortex XSIAM general settings and system-wide configuration. - [Cortex XDR Analytics permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/cortex-xdr-analytics-permissions.md): Manage access to Cortex XSIAM analytics configuration and related settings. - [Access management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/access-management-permissions.md): Manage access to Cortex XSIAM users, roles, and access management settings. - [Data Broker permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-broker-permissions.md): Manage access to Cortex XSIAM Data Broker configuration and operations. - [Log Collection permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/log-collection-permissions.md): Manage access to Cortex XSIAM log collection configuration and data sources. - [Data Sources permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-sources-permissions.md): Manage access to Cortex XSIAM data source configuration and ingestion settings. - [External Issues Mapping permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/external-issues-mapping-permissions.md): Manage access to Cortex XSIAM mappings for external issue integrations. - [Integrations - instance permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/integrations-instance-permissions.md): Manage access to individual Cortex XSIAM integration instances and settings. - [Integrations Permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/integrations-permissions.md): Manage access to Cortex XSIAM integration configuration and available instances. - [Data Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/data-management-permissions.md): Manage access to Cortex XSIAM data management and retention settings. - [Public API](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/public-api.md): Manage access to Cortex XSIAM public API configuration and credentials. - [Threat Intelligence permission - API configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/threat-intelligence-permission-api-configuration.md): Manage access to Cortex XSIAM Threat Intelligence API configuration. - [Long-running HTTP Integrations configuration](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/long-running-http-integrations-configuration.md): Manage access to Cortex XSIAM long-running HTTP integration configuration. - [Credentials permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/credentials-permissions.md): Manage access to Cortex XSIAM credentials and secure connection settings. - [Network Scanners permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/network-scanners-permissions.md): Manage access to Cortex XSIAM network scanner configuration and operations. - [Apps - Instance permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/apps-instance-permissions.md): Manage access to Cortex XSIAM app instances and their configuration. - [Object Setup permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions.md): Manage access to Cortex XSIAM object setup and related configuration. - [Case Properties permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/case-properties-permissions.md): Configure access to case domains, custom statuses, and resolution statuses in Cortex XSIAM. - [Exclusion List permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/exclusion-list-permissions.md): Control access to manage excluded threat indicators and their exclusion settings in Cortex XSIAM. - [Fields and Types permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/fields-and-types-permissions.md): Control access to custom fields, indicator types, and SLA rule configurations in Cortex XSIAM. - [Layout permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/layout-permissions.md): Control access to case and issue layouts, including their layout rules in Cortex XSIAM. - [Sync Profile permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/configuration-permissions/object-setup-permissions/sync-profile-permissions.md): Control access to sync profiles for mirroring cases with external platforms in Cortex XSIAM. - [Marketplace permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/marketplace-permissions.md): Control access to discover, install, and manage Marketplace content packs in Cortex XSIAM. - [Help permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/help-permissions.md): Control access to create and manage in-product technical support cases in Cortex XSIAM. - [SOC Operations, Investigation & Response permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/soc-operations-investigation-and-response-permissions.md) - [Dashboards and Reports permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions.md): Set permissions for dashboards and reports in Cortex XSIAM. - [Dashboards permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/dashboards-permissions.md): Manage access to Cortex XSIAM dashboards, widgets, and dashboard sharing. - [Command Center Dashboard permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/command-center-dashboard-permissions.md): Manage access to Cortex XSIAM Command Center dashboards and their security metrics. - [Ingestion Monitoring dashboard permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/ingestion-monitoring-dashboard-permissions.md): Manage access to Cortex XSIAM data ingestion monitoring dashboards. - [Reports permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/reports-permissions.md): Manage access to Cortex XSIAM reports and custom report templates. - [Email Command Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/email-command-center-permissions.md): Manage access to the Cortex XSIAM Email Command Center and email threat metrics. - [Cloud Security Command Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/dashboards-and-reports-permissions/cloud-security-command-center-permissions.md): Manage access to the Cortex XSIAM Cloud Security Command Center. - [Cases and Issues permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cases-and-issues-permissions.md): Control access to investigate, manage, and respond to cases and issues in Cortex XSIAM. - [Investigation and Response permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions.md): Configure role permissions for search, response, and automation capabilities in Cortex XSIAM. - [Search permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions.md): Configure access to threat hunting, query, and forensic investigation tools in Cortex XSIAM. - [Query Library permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/query-library-permissions.md): Manage access to saved XQL queries in Cortex XSIAM's Query Library. - [Query Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/query-center-permissions.md): Manage access to write, run, schedule, and export XQL queries in Cortex XSIAM. - [Forensics permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/forensics-permissions.md): Manage access to Cortex XSIAM forensic investigations, collections, and threat hunts. - [Host Insights permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/host-insights-permissions.md): Manage access to Cortex XSIAM's endpoint inventory, host details, and hygiene data. - [Graph Search permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/search-permissions/graph-search-permissions.md): Manage access to Cortex XSIAM's Graph Search for cloud assets and security findings. - [Response permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions.md): Configure access to endpoint and network response actions and tools in Cortex XSIAM. - [Action Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/action-center-permissions.md): Manage access to Cortex XSIAM endpoint response actions and action history. - [EDL permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/edl-permissions.md): Manage Cortex XSIAM External Dynamic Lists for firewall-enforced threat blocking. - [Agent Scripts Library permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/agent-scripts-library-permissions.md): Manage Cortex XSIAM endpoint scripts for response, collection, and automation. - [Live Terminal permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/response-permissions/live-terminal-permissions.md): Manage Cortex XSIAM interactive endpoint shell access for investigation and remediation. - [Automation permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions.md): Configure permissions for playbooks, scripts, playground, and automated exclusions in Cortex XSIAM. - [Playbook permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/playbook-permissions.md): Manage access to Cortex XSIAM playbooks and automated response workflows. - [Script permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/script-permissions.md): Manage access to Cortex XSIAM scripts for automation and remediation. - [Jobs permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/jobs-permissions.md): Manage access to Cortex XSIAM scheduled automation jobs and their execution. - [Playground permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/playground-permissions.md): Manage access to the Cortex XSIAM playground for testing commands and scripts. - [Automation Exclusion Center permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/investigation-and-response-permissions/automation-permissions/automation-exclusion-center-permissions.md): Manage Cortex XSIAM automation exclusions for commands, scripts, and remediation. - [Jupyter and Observability apps permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/jupyter-and-observability-apps-permissions.md): Configure permissions to use Jupyter and Observability applications. - [Threat Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/threat-management-permissions.md): Configure Detection Rules and Threat Intel permissions in Cortex XSIAM. - [Detection Rules permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/threat-management-permissions/detection-rules-permissions.md): Configure Detection Rules permissions in Cortex XSIAM. - [Threat Intelligence permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/threat-management-permissions/threat-intelligence-permissions.md): Configure Threat Intelligence permissions in Cortex XSIAM - [Exceptions Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions.md): Configure issue exclusion permissions in Cortex XSIAM. - [Issue Exclusions permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/issue-exclusions-permissions.md): Configure Issue Exclusions permissions in Cortex XSIAM. - [Exception Management Admin permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/exception-management-admin-permissions.md): Configure Exception Management Admin permissions in Cortex XSIAM. - [Exception Approver Admin permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exceptions-configuration-permissions/exception-approver-admin-permissions.md): Configure Exception Approver Admin permissions in Cortex XSIAM. - [Managed Services permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/managed-services-permissions.md): Configure access to Managed Services for Unit 42 Managed Threat Hunting and Managed Detection and Response. - [Cortex Agentic Assistant permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cortex-agentic-assistant-permissions.md): Configure the Cortex Agentic Assistant permissions, which includes AI Prompts and Agent permissions in Cortex XSIAM. - [AI Prompts](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cortex-agentic-assistant-permissions/ai-prompts.md): Configure AI Prompts permissions in Cortex XSIAM. - [Cortex Agentic Assistant Agents](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cortex-agentic-assistant-permissions/cortex-agentic-assistant-agents.md): Configure Cortex Agentic Assistant Agents permissions in Cortex XSIAM. - [Agents and endpoint protection](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/agents-and-endpoint-protection.md): Configure permissions for XDR Agent infrastructure and endpoint data loss prevention in Cortex XSIAM. - [Inventory - Agent permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions.md): Configure permissions for Endpoints (XDR Agent) in Cortex XSIAM. - [Agent Administrations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-administrations.md): Control access to endpoint inventory, agent health, and lifecycle operations in Cortex XSIAM. - [Agent Groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-groups.md): Manage endpoint groups and policy targeting in Cortex XSIAM. - [Agent Prevention Policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-prevention-policies.md): Configure endpoint prevention policies and protection settings in Cortex XSIAM. - [Global Exceptions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/global-exceptions.md): Manage global prevention exceptions and their endpoint scope in Cortex XSIAM. - [Agent Profiles](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-profiles.md): Configure endpoint agent profiles and communication settings in Cortex XSIAM. - [Agent Extension Policies](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-extension-policies.md): Configure endpoint extension policies and capabilities in Cortex XSIAM. - [Agent Installations](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/agent-installations.md): Manage Cortex XSIAM agent installation packages and deployments. - [Host Firewall](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/host-firewall.md): Configure host firewall rules and review firewall events in Cortex XSIAM. - [Device Control](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-agent-permissions/device-control.md): Manage device control policies, rules, and exceptions in Cortex XSIAM. - [Data Security - Endpoint DLP permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions.md): Configure Endpoint Data Loss Prevention permissions in Cortex XSIAM. - [Data-in-Motion Rules](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/data-in-motion-rules.md): Configure endpoint data-in-motion protection rules in Cortex XSIAM. - [Endpoint Applications](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/endpoint-applications.md): Manage endpoint applications monitored by Data Loss Prevention in Cortex XSIAM. - [Endpoint Applications Groups](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/endpoint-applications-groups.md): Manage endpoint application groups for Data Loss Prevention policies in Cortex XSIAM. - [Endpoint DLP Settings](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/data-security-endpoint-dlp-permissions/endpoint-dlp-settings.md): Configure endpoint Data Loss Prevention settings in Cortex XSIAM. - [Inventory - Assets permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions.md): Configure inventory permissions for assets and endpoints in Cortex XSIAM. - [Network Configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/network-configuration-permissions.md): Configure network topology, ranges, and trusted networks in Cortex XSIAM. - [Compliance (Legacy) permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/compliance-legacy-permissions.md): View legacy cloud compliance violations for assets in Cortex XSIAM. - [Asset Inventory permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-inventory-permissions.md): Control access to asset inventory data and metadata in Cortex XSIAM. - [Asset Roles configuration permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-roles-configuration-permissions.md): Configure functional asset roles and endpoint assignments in Cortex XSIAM. - [Asset Groups permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/inventory-assets-permissions/asset-groups-permissions.md): Manage asset groups and scoped access controls in Cortex XSIAM. - [Exposure and Vulnerability Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exposure-and-vulnerability-management-permissions.md): Configure exposure, vulnerability, and attack surface management permissions in Cortex XSIAM. - [Attack Surface permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exposure-and-vulnerability-management-permissions/attack-surface-permissions.md): Configure Attack Surface Management permissions in Cortex XSIAM. - [Vulnerability Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exposure-and-vulnerability-management-permissions/vulnerability-management-permissions.md): Configure Vulnerability Management permissions in Cortex XSIAM. - [Exposure Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/exposure-and-vulnerability-management-permissions/exposure-management-permissions.md): Configure Exposure Management permissions in Cortex XSIAM. - [Cloud Security and Posture Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions.md): Configure Cloud Security and Posture Management permissions in Cortex XSIAM. - [CLI Tool permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/cli-tool-permissions.md): Configure CLI Tool permissions in Cortex XSIAM. - [Application Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions.md): Configure Application Security permissions in Cortex XSIAM. - [Application Security - Generic Collector permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-generic-collector-permissions.md): Configure Generic Collector permissions for Application Security in Cortex XSIAM. - [Application Security - Issues permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-issues-permissions.md): Configure Application Security issue permissions in Cortex XSIAM. - [Application Security - Scans permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-scans-permissions.md): Configure Application Security scan permissions in Cortex XSIAM. - [Application Security - Policy Management permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-policy-management-permissions.md): Configure Application Security policy management permissions in Cortex XSIAM. - [Application Security - 3rd Party tools permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/application-security-3rd-party-tools-permissions.md): Configure third-party tool permissions for Application Security in Cortex XSIAM. - [Configurations - Application Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/application-security-permissions/configurations-application-security-permissions.md): Configure Application Security configuration permissions in Cortex XSIAM. - [Policies - Cloud Workload permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/policies-cloud-workload-permissions.md): Configure Cloud Workload policy permissions in Cortex XSIAM. - [Cloud Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/cloud-security-permissions.md): Configure Cloud Security permissions in Cortex XSIAM. - [Compliance - Cloud permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/compliance-cloud-permissions.md): Configure cloud compliance permissions in Cortex XSIAM. - [Data Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/data-security-permissions.md): Configure Data Security permissions in Cortex XSIAM. - [AI Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/ai-security-permissions.md): Configure AI Security permissions in Cortex XSIAM. - [Data Classification permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/data-classification-permissions.md): Configure Data Classification permissions in Cortex XSIAM. - [Identity Security permissions](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/role-based-access-control/cloud-security-and-posture-management-permissions/identity-security-permissions.md): Configure Identity Security permissions in Cortex XSIAM. - [API documentation](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/api-documentation.md): Use the Cortex XSIAM APIs to integrate Cortex XSIAM with third-party apps or services to ingest alerts and to leverage alert stitching and investigation capabilities. - [Reference](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference.md): Cortex XSIAM reference material: cloud permissions, Windows auditing, XDM mapping, scanner licenses, and fair usage. - [Microsoft Windows security auditing setup](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup.md): Configure Windows security auditing and LDAP event logging for Cortex XSIAM data collection. - [Enable security auditing event IDs](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids.md): Enable Windows security auditing event IDs for Cortex XSIAM using GPO or local machine settings. - [Enable security auditing event IDs with GPO](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/enable-security-auditing-event-ids-with-gpo.md): Use Group Policy to enable Windows security auditing event IDs for Cortex XSIAM data collection. - [Set up local machine security auditing without GPO](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/set-up-local-machine-security-auditing-with-gpo.md): Use auditpol to enable Windows security auditing event IDs locally for Cortex XSIAM data collection. - [Additional setup for Active Directory Certificate Services (ADCS) events](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/additional-setup-for-active-directory-certificate-services-adcs-events.md): Configure Active Directory Certificate Services (ADCS) auditing events for Cortex XSIAM data collection. - [Enable auditing access to AD domain objects - 4662](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-security-auditing-event-ids/enable-auditing-access-to-ad-domain-objects-4662.md): Configure Active Directory domain object auditing for Windows Event ID 4662 in Cortex XSIAM. - [Enable additional event logs using Event Viewer](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-additional-event-logs-using-event-viewer.md): Enable additional Windows Event Viewer logs, including PowerShell and Defender events, for Cortex XSIAM. - [Enable LDAP server events logging (1644)](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644.md): Enable LDAP server Event ID 1644 logging for Cortex XSIAM through Registry Editor or Group Policy. - [Enable LDAP server events logging using RegEdit](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/enable-ldap-server-events-logging-using-regedit.md): Configure LDAP server Event ID 1644 logging through Registry Editor for Cortex XSIAM. - [Enable LDAP server events logging using GPO](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/enable-ldap-server-events-logging-using-gpo.md): Configure LDAP server Event ID 1644 logging through Group Policy for Cortex XSIAM. - [Validate log collection for LDAP Server events](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/microsoft-windows-security-auditing-setup/enable-ldap-server-events-logging-1644/validate-log-collection-for-ldap-server-events.md): Validate LDAP server Event ID 1644 collection in Windows Event Viewer for Cortex XSIAM. - [XDM fields for mapping authentication events](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/xdm-fields-for-mapping-authentication-events.md): Map authentication events to Cortex XSIAM XDM fields for normalized identity data and authentication stories. - [Authentication mapping: Advanced classification and deep dives](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/xdm-fields-for-mapping-authentication-events/authentication-mapping-advanced-classification-and-deep-dives.md): Learn more about technical conventions and implementation logic for complex authentication scenarios in Cortex XSIAM. - [XDM fields for mapping network events](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/xdm-fields-for-mapping-network-events.md): Map network events to Cortex XSIAM XDM fields for normalized identity data and authentication stories. - [Advanced network mapping: deep dives](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/xdm-fields-for-mapping-network-events/advanced-network-mapping-deep-dives.md): Learn more about technical conventions for complex network scenarios in Cortex XSIAM. - [Cortex Network Scanner OSS](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/cortex-network-scanner-oss.md): Review third-party open-source software licenses used by the Cortex Network Scanner for Cortex XSIAM. - [Fair Usage policy for Cortex XSIAM](https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs/reference/fair-usage-policy-for-cortex-xsiam.md): Understand the Fair Usage Policy for data ingestion, connected sources, and API usage for Cortex XSIAM. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsiam/reference-and-developer-docs.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.