> For the complete documentation index, see [llms.txt](https://cortex-docs.paloaltonetworks.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.6/configure-cortex-xsoar/marketplace/content-packs.md).
# Content packs
Cortex XSOAR content in Marketplace is organized in packs. Content packs are created by Palo Alto Networks, technology partners, consulting companies, MSSPs, customers, and individual contributors. Content packs may include a variety of different components, such as integrations, scripts, playbooks, and widgets, grouped together to address a specific use case. Content packs are free and can be used by all customers.
You can view Marketplace content packs from within Cortex XSOAR or at .
#### Pre-installed content packs
Cortex XSOAR comes with a number of pre-installed content packs that cover many common uses cases. Pre-installed content packs include, but are not limited to:
* [Common Scripts](https://cortex.marketplace.pan.dev/marketplace/details/CommonScripts/), [Common Widgets](https://cortex.marketplace.pan.dev/marketplace/details/CommonWidgets/), [Common Playbooks](https://cortex.marketplace.pan.dev/marketplace/details/CommonPlaybooks/), [Common Types](https://cortex.marketplace.pan.dev/marketplace/details/CommonTypes/), [Common Reports](https://cortex.marketplace.pan.dev/marketplace/details/CommonReports/), [Common Dashboards](https://cortex.marketplace.pan.dev/marketplace/details/CommonDashboards/)
These content packs provide important tools and building blocks you can use to customize your playbooks and workflows in Cortex XSOAR. The Common Scripts content pack, for example, includes scripts that convert file formats, fetch indicators from a file, export context data, send emails, and more.
* [VirusTotal](https://cortex.marketplace.pan.dev/marketplace/details/VirusTotal/)
Provides integration with the popular Virus Total service to analyze suspicious files, domains, IPs and URLs to detect malware and other security breaches.
* [TIM - Indicator Auto-Processing](https://cortex.marketplace.pan.dev/marketplace/details/TIM_Processing/)
The TIM - Indicator Auto-Processing content pack includes playbooks that automate the processing of indicators for multiple use cases such as tagging, checking for existence in various lists , running enrichment for specific indicators and preparing indicators if necessary for a manual review. The content pack also includes incident types and incident layouts for manual review.
#### Recommended content packs
In addition, we recommend reviewing if you require the following popular content packs:
* [Phishing](https://cortex.marketplace.pan.dev/marketplace/details/Phishing/)
Create and respond to phishing incidents based on user reports.
* [Cortex XDR by Palo Alto Networks](https://cortex.marketplace.pan.dev/marketplace/details/CortexXDR/)
Automate Cortex XDR incident response. Includes custom Cortex XDR incident views and layouts to aid analyst investigations.
* [ServiceNow](https://cortex.marketplace.pan.dev/marketplace/details/ServiceNow/)
Manage ServiceNow tickets directly from the Cortex XSOAR and enrich them with Cortex XSOAR data.
* [PAN-OS by Palo Alto Networks](https://cortex.marketplace.pan.dev/marketplace/details/PANOS/)
Manage Palo Alto Networks Firewall and Panorama, from Cortex XSOAR.
* [Integrations & Incidents Health Check](https://cortex.marketplace.pan.dev/marketplace/details/IntegrationsAndIncidentsHealthCheck/)
Review failed integrations, incidents, and playbooks.
* A mail sender integration, such as [Microsoft Exchange Online](https://cortex.marketplace.pan.dev/marketplace/details/MicrosoftExchangeOnline/).
* A collaboration integration, such as [Microsoft Teams](https://cortex.marketplace.pan.dev/marketplace/details/MicrosoftTeams/) or [Slack](https://cortex.marketplace.pan.dev/marketplace/details/Slack/) to send messages and notifications to your team.
Content packs such as the **Malware Investigation and Response** content pack and the **Phishing** content pack include a deployment wizard. When you install the content pack, you are prompted to use a wizard, which sets up your use case. The deployment wizard sets up the fetching integration, configures the playbook and parameters, and configures supporting integrations, in a user friendly, step-by-step interface.
---
# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.
## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.
Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:
```
GET https://cortex-docs.paloaltonetworks.com/cortex-xsoar-8-on-prem/8.6/configure-cortex-xsoar/marketplace/content-packs.md?ask=&goal=
```
`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.
The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.
Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.