Configure security settings

Configure Cortex XSOAR 8 SaaS session, access, and user security settings.

You can configure security settings such as how long users can be logged into Cortex XSOAR, and from which domains and IP ranges users can log in.

Go to Settings & Info → Settings → System → Security Settings.

Session Expiration

Options	Description
User Login Expiration	The number of hours (between 1 and 24) after which the user login session expires. You can also choose to automatically log users out after a specified period of inactivity.
Dashboard Expiration	Whether the Dashboard page expires at the same time as the user login session or after seven days. This is useful when you view a dashboard on a separate screen. For example, if you select seven days for dashboards and eight hours for login expiration and you are currently viewing the Dashboard page, the dashboard expiration takes priority (seven days). This ensures that the Dashboard page continues to display the widgets for an extended period. Sessions are saved by browser. If you have both dashboard tabs and non-dashboard tabs open in the same browser, the session applies to all tabs. Consequently, if a non-dashboard tab expires based on the User Login Expiration setting, the Dashboard Expiration setting is overridden and the dashboard session ends. To ensure the dashboard remains open for the configured duration, open the dashboard in a separate browser or an incognito window.

Allowed Sessions

Options	Description
Approved Domains	The domains from which you want to allow user access (login) to Cortex XSOAR. You can add or remove domains as necessary.
Approved IP Ranges	The IP ranges from which you want to allow user access (login) to Cortex XSOAR. You can also choose to limit API access from specific IP addresses.

User Expiration

Options	Description
Deactivate Inactive User	Deactivate an inactive user, and also set the user deactivation trigger period. By default, user expiration is disabled. When enabled, enter the number of days after which inactive users should be deactivated.

Same-Site Cookie Policy

Configure your Cortex tenant's SameSite cookie security policy by selecting between two settings to control how users log in from external links:

Options	Description
Strict	Strict (Recommended): Requires users to reauthenticate when clicking a link from another site, even if they are already signed in.
Lax	Lax: Offers a more seamless experience by allowing users to access the tenant directly from external links without needing to log in again. Yet, we advise against this setting for security reasons.

Allowed Domains

Options	Description
Domain Name	Enables you to specify one or more domain names that can be used in your distribution list for audit forwarding.