> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-5.-install-and-configure-content/set-up-your-use-case-with-the-deployment-wizard.md). # Set up your use case with the Deployment Wizard The Deployment Wizard can be used to set up your use case for the **Malware Investigation and Response** content pack and the **Phishing** content pack. In order to work with your content pack you need to set up your integrations. The Deployment Wizard guides you through: * Configuring the integrations that will be used to fetch events (fetching integrations). These events will be mapped as incidents. * Configuring the main playbook and its input parameters. For example, the **Setup Malware playbook** pane opens showing the recommended primary playbook for the incident type you selected when configuring the fetching integration. The playbook configuration includes all the input parameters to configure that will change the playbook behavior, for example, whether to use sandbox detonation or whether to perform isolation response. You can open the playbook by clicking the link on the bottom. * Configuring any supporting integrations. such as an email integration The default fetching integration for your content pack depends on which fetching integration(s) are installed. For example: | Content Pack | Default Fetching Integration in Order of Priority | | ---------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ | | Malware Investigation and Response |

1. Palo Alto Networks Cortex XDR - Investigation and Response

2. CrowdStrike Falcon

3. Microsoft Defender for Endpoint

| | Phishing |

1. Gmail

2. EWS v2 (Make sure you also install the Microsoft Exchange On-Premise pack)

3. O365 Outlook Mail (Using Graph API)

4. Gmail Single User

5. O365 Outlook Mail Single User (Using Graph API)

| **Prerequisites** To access the Deployment Wizard for the first time, you need to first install or update your Malware Investigation and Response content pack or your Phishing content pack in Marketplace. The **Deployment Wizard** tab appears in Marketplace after the content pack installation or update is completed. **For example**: * For the **Malware Investigation and Response** content pack, you need at least one incident fetching content pack (mandatory). You can also optionally install sandbox, messaging, case management, and data enrichment and threat intelligence content packs. * For the **Phishing** content pack, you need at least one email gateway content pack (mandatory). You can also optionally install sandbox, EDR systems, network devices, email security gateways, mail sender, and data enrichment and threat intelligence content packs. **How to set up your use case with the Deployment Wizard** 1. In Marketplace, select the content pack for your use case (for example, **Malware Investigation and Response** or **Phishing**) and click **Install** or **Update** (if the pack is already installed). 2. In the **Select Content Packs** window, select one or more content packs from the required categories. You can also install other supportive content packs from other categories if needed. These items will be automatically be added to the cart. 3. Click **Continue** and then **Install** or **Update**. 4. When the content pack finishes installing or updating, click **Refresh content**. The **Deployment Wizard** tab appears.

Note

After you start running your use case you can return to this tab and make changes to the configurations, such as your integration’s credentials or playbook parameters.

5. Click **Let’s Start** in the small dialog box that appears next to the **Deployment Wizard** tab. The tab opens showing the use case deployment flow. 6. Step 1: **Fetching Integration** - Click the displayed fetching integration. If the integration is new, select **New instance**. If you want to use an existing instance, select it from **Update existing instance**. The integration will stay disabled until you complete all steps of the wizard.

Note

You must define the incident type in order to set the playbook in the next step.

A list of **What needs to be done** guides you through the required fetching integration instance settings configurations. Scroll down to see the complete list. After you save your settings, the wizard initiates a test connection. If the connection succeeds, the **Fetching Integration** step turns green and moves to the next step (**Set Playbook**). 7. Step 2: **Set Playbook** - Select **Configure Playbook & Parameters**.

Note

The wizard displays the recommended playbook. If for the fetching integration setup you chose an incident type that uses a different playbook from the recommended one, the incident type will be detached.

8. Click **Done**. 9. Step 3: **Supporting Integrations** - Configure any installed supporting integrations in the content pack. If a supporting integration is already installed and connected, it appears with a green check. Otherwise, click the integration to configure it.

Note

After you save the settings, the integration instance is automatically enabled.

10. Step 4: **What’s Next** - Select **Turn on Use Case** to start the fetching process and running the playbooks and scripts. --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question. Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter: ``` GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.11/onboard-cortex-xsoar/onboard-and-configure-cortex-xsoar/step-5.-install-and-configure-content/set-up-your-use-case-with-the-deployment-wizard.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.